Get tomorrow's brief in your inbox
Today: No new CMMC-specific rulemaking or enforcement actions landed today. PilieroMazza flagged expanded FOCI submission requirements that affect cleared DIB contractors, the Pentagon's Cyber Mastery Incentive Pay launched with pay-cut concerns across the cyber workforce, and DISA doubled down on sole-sourcing the combatant command DoDNet migration to Leidos under the $11.5B Enclave contract.
DoD Proposed Rule Would Expand FOCI Reporting for Cleared Contractors. PilieroMazza's three-part series on Foreign Ownership, Control, or Influence (FOCI) obligations covers how the DoD proposed rule would broaden the documentation that cleared contractors must submit, including Standard Form 328 filings and "change condition" packages. This is a proposed rule, not in force. But if your company holds or is pursuing a facility clearance, the direction of travel is clear: the government is tightening its scrutiny of foreign influence in the defense supply chain. Action: Review your current SF 328 and FOCI mitigation agreements now. If you have any foreign investment, board members, or supply chain dependencies, brief your FSO and outside counsel before the rule finalizes. (PilieroMazza)
No cyber-related False Claims Act cases, CMMC enforcement actions, or DIB-relevant DOJ settlements today. The DOJ press release volume was high (20+ releases) but focused entirely on drug trafficking, firearms violations, immigration fraud, and violent crime. The DOJ's National Fraud Enforcement Division did issue a memorandum on corporate enforcement priorities, but the available text references SSA benefits fraud and healthcare kickback schemes, not cyber or defense contractor attestation. (DOJ)
Watch item: The corporate enforcement priorities memo is worth reading in full when published. Past memos from this office have set the tone for Civil Cyber-Fraud Initiative case selection. If the priorities explicitly name government contractor cybersecurity attestations, that signals intensified scrutiny of SPRS scores and self-assessments during the Phase 2 suspension.
DISA Sole-Sources Combatant Command Migration to Leidos Under $11.5B Enclave Contract. After a GDIT bid protest forced DISA to redo its market research, the agency concluded again that Leidos is the only vendor capable of migrating combatant commands to the Defense Department Network (DoDNet) by the September 2028 deadline. DISA cited Leidos' institutional knowledge of DoDNet automation scripts, Active Directory schemas, and ICAM structures. The contract ceiling stays at $11.5B. Competitors got 24 hours to respond to one of the sources-sought notices, which drew skepticism about whether the market research was genuine. Action for DIB subcontractors: If you provide network migration, identity management, or zero-trust services in the combatant command space, this consolidation narrows your path to the work. Check SAM.gov for subcontracting opportunities under the Leidos Enclave vehicle. (Federal News Network)
DIA Fast-Tracks Schneider Electric Data Center Maintenance. DIA awarded a sole-source follow-on to Schneider Electric Federal for preventive maintenance, parts, and software across its global data center infrastructure, citing proprietary lock-in on hardware, firmware, and diagnostics. The prior contract was $29M+; the new value is redacted. DIA acknowledged this is a vendor-lock problem and committed to pursuing open-architecture replacements at end-of-life. Relevance: DIB contractors supporting DIA missions should confirm whether their own data center or hosting environments face similar single-vendor dependencies, which auditors and primes increasingly flag as supply chain risk. (DefenseScoop)
Pentagon Cyber Mastery Incentive Pay (C-MIP) Launches With Pay Cuts. The DoD's new Cyber Mastery Incentive Pay program went live October 1 as part of Cybercom 2.0 force generation. The program is supposed to reward advanced technical skills with escalating pay. Instead, internal documents show Army cyber troops facing $100 to $1,000/month pay cuts, with the Army's top cyber officer emailing leaders to discuss financial assistance options like military loan programs. The Air Force was still "working to finalize" its rollout days before launch. The Navy expects "generally" increased pay for eligible sailors. Why DIB cares: If C-MIP accelerates the exodus of skilled cyber operators to the private sector, expect more demand for cleared contractor support to military cyber missions, and more competition for the same talent pool DIB companies are hiring from. This is a workforce planning signal. (DefenseScoop)
AI Social Engineering Is Erasing the Traditional Red Flags. Federal News Network analysis on how generative AI enables attackers to build polished, personalized phishing communications that no longer contain the misspellings and awkward phrasing that training programs teach employees to spot. For DIB contractors subject to NIST 800-171 controls (AT-2 Security Awareness Training, SI-3 Malicious Code Protection, IR-1 Incident Response), this is a direct reminder: your awareness training content needs to move beyond "look for typos." Action: Update your security awareness training to address AI-generated phishing. If your SSP references awareness training procedures, verify they reflect current threat patterns, not 2023-era indicators. (Federal News Network)