Get tomorrow's brief in your inbox
Today: DOJ announced a major False Claims Act enforcement policy revision that limits sub-regulatory guidance as the basis for fraud claims, OFCCP eliminated the Section 503 disability self-ID and 7% utilization goal effective Monday, and AAFES is investigating suspicious messages sent through its official app that may indicate a security breach.
DOJ revises Justice Manual to limit False Claims Act enforcement to binding legal obligations. The Department announced two policy changes: (1) sub-regulatory guidance cannot impose legal obligations beyond statute or regulation, and (2) the Department will more actively consider dismissing qui tam cases that don't serve U.S. interests, especially when declining to intervene. This is a signed policy memo in effect now. For DIB contractors during the CMMC Phase 2 suspension: self-attestation under DFARS 252.204-7012 and NIST 800-171 remains a binding contractual obligation, but agency white papers or blog posts cannot create new FCA liability. Update your compliance risk assessments to distinguish between regulatory requirements (DFARS clauses, 32 CFR 170, NIST standards) and non-binding guidance. If you're facing a qui tam action based on sub-regulatory interpretations, this policy shift may support a motion to dismiss. DOJ Press Release
Illegal alien arrested for fraudulent U.S. citizenship claims to secure aerospace contractor employment. A Mexican national ordered removed decades ago was indicted on eight counts for lying on I-9 employment authorization forms, claiming U.S. citizenship and submitting someone else's naturalization certificate to work at a South Bay aerospace manufacturer and military contractor. This case underscores ongoing scrutiny of I-9 compliance and citizenship verification at defense contractors. Review your Form I-9 procedures and E-Verify practices; false claims of work authorization at a cleared facility or defense contractor will draw both immigration and FCA attention. DOJ Press Release
OFCCP eliminates Section 503 disability compliance requirements effective September 21. A final rule removes: (1) the requirement to invite applicants/employees to self-identify disability status via Form CC-305, (2) the 7% utilization goal for individuals with disabilities, and (3) related data collection and annual utilization analysis requirements. This is a final rule in effect Monday. The rationale: disability inquiries conflict with the ADA. What remains: non-discrimination obligations, general recordkeeping, and Affirmative Action Program (AAP) development for contractors with 50+ employees and contracts $50K+. Action: Remove Form CC-305 from application packages immediately, stop collecting disability self-ID data, and update your AAPs to remove utilization analyses and CC-305-derived data points. Note that Vietnam Era Veterans' Readjustment Assistance Act (VEVRAA) requirements are unaffected. PilieroMazza analysis
CISA and Five Eyes partners release CI Fortify guidance on network isolation for critical infrastructure. The July 28 framework (CISA, ASD, CCCS, NCSC) urges operators to physically and digitally isolate critical systems (OT, third-party connections) to sustain operations during geopolitical conflict. This is voluntary guidance, not a mandate, but echoes NIS2 (EU) and prior NIST segmentation guidance. The concern: bi-directional remote access paths (VPNs, firewalls, shared auth) enable lateral movement after initial compromise (see: Polish power grid wiper incident). For DIB contractors with OT environments or who support critical infrastructure primes: expect flow-down language requiring network segmentation and isolation capabilities in new solicitations. Air-gapping and data diodes have security benefits but create operational friction (shadow IT risk, data transfer delays). Start planning now if you operate ICS/SCADA or provide OT services to primes; "isolation readiness" will become a differentiator. Federal News Network commentary
AAFES investigating suspicious messages sent via email and official mobile app. The Army and Air Force Exchange Service (30M eligible customers, 5,500+ facilities globally) confirmed it's investigating messages sent to customers Wednesday that contained a "wishlist" link purportedly from the "AAFES Security Team." Messages went out via both email and the My Exchange app. AAFES has not confirmed the source (breach vs. spoofed account) but said PII breach notifications would follow "standard operating procedure" if data is compromised. One security analyst noted the specificity of targeting (AAFES customers only) and transmission through official channels suggests "a breach somewhere or someone got in" at AAFES or a third-party partner. For DIB contractors: this incident highlights supply chain and third-party risk. If you operate a customer portal or mobile app, audit push notification infrastructure, review third-party integrations, and ensure your incident response plan includes PII breach notification timelines. Watch for AAFES updates; if this is confirmed as a breach, it will inform NIST 800-171 3.14.6 (monitor communications at external boundaries) and 3.14.7 (identify unauthorized use) control implementations. DefenseScoop