While traditional government enforcement areas, such as healthcare, dominate headlines, one emerging enforcement priority continues to grow, albeit with less fanfare: compliance with cybersecurity requirements in government contracts. The government announced its most recent settlement last month, signaling that these enforcement actions continue to proliferate.
Cybersecurity enforcement is here to stay.
On June 10, 2026, nineteen states and the District of Columbia filed suit in the District of Maryland seeking to halt implementation of Executive Order 14398, which was issued on March 26, 2026. The order requires federal agencies to insert a mandatory contract clause into all contracts, subcontracts, and “contract-like instruments” prohibiting contractors from engaging
Two recent regulatory notices spotlight often overlooked “brokering” obligations for international defense contractors. For companies involved in any aspect of the international defense trade, these notices serve as a useful reminder of companies’ obligations and the need for effective policies to prevent violations.
On April 14, 2026, the State Department’s Directorate of Defense
In a recent blog post, Bradley discussed increased False Claims Act (FCA) enforcement by the Department of Justice (DOJ) aimed at curbing diversity, equity and inclusion (DEI) programs in the private sector. Since then, the administration continues to ramp up regulatory pressures on DEI initiatives.
On March 26, 2026, President Trump issued another executive
On December 28, 2025, media outlets, including the Wall Street Journal, reported that the Department of Justice (DOJ) had begun investigating large private sector entities for their diversity, equity, and inclusion (DEI) practices. Companies, including Alphabet’s Google and Verizon Communications, have reportedly received civil investigative demands (CIDs) from DOJ relating to DEI practices. To
In an announcement made earlier this month, the U.S. Treasury Department unveiled “a comprehensive audit of all contracts and task orders awarded under preference-based contracting, totaling approximately $9 billion in contract value across Treasury and its bureaus.” The Treasury Department added that “[t]he audit will examine potential misuse of the Small Business Administration’s [SBA] 8(a)
The Department of Justice (DOJ) recently obtained several cybersecurity-related False Claims Act (FCA) settlements totaling more than $50 million dollars. Collectively, these settlements reflect a clear message: Cybersecurity is an enforcement priority for the second Trump administration, and any organization that contracts with the federal government is a potential target.
On June 6, 2025
In United States v. Mims, No. 22-13215, 2025 WL 1934570 (11th Cir., July 15, 2025), the Eleventh Circuit addressed a relatively straightforward question of first impression: “whether a district court continues to have jurisdiction in a criminal case to order compliance with unsatisfied restitution obligations after the defendant completes her probationary sentence.” In
Mandatory disclosure obligations significantly changed for federal grant recipients, sub-recipients, and applicants on October 1, 2024. The amended federal regulation establishing these mandatory disclosures (2 C.F.R. § 200.113) not only expands the scope of conduct that must be reported but it also lowers the standard of evidence triggering the mandatory disclosure. The regulation, which is
The U.S. Department of Justice (DOJ) filed its first major complaint-in-intervention under the False Claims Act (FCA) premised on a government contractor’s alleged cybersecurity deficiencies since the DOJ’s Civil Cyber-Fraud Initiative was launched in 2021. Its complaint accuses the Georgia Institute of Technology (Georgia Tech) of violating cybersecurity regulations while fulfilling $31 million of