Your plain-language map to the national procurement cybersecurity ecosystem.
Before any FAR or DFARS clause applies, federal and state law already requires your business to secure data and report breaches — the FTC Act, all-50-state breach laws, and rules like GLBA and HIPAA. The contractor requirements build on top of that legal baseline. Make sure you meet it first.
A June 2, 2026 executive order sets up a voluntary pre-release security review of frontier AI models and puts CISA on a 30-day clock for new cyber directives. Most binding obligations reach contractors through agencies, clauses, and the supply chain.
Read more →CISA's long-delayed cyber-incident reporting rule is back in finalization. For government contractors, it adds a third reporting clock on top of the ones you already run.
Read more →The FY2026 defense law directs DoD to build a security framework for the AI it buys and wire it into DFARS and CMMC. A status report to Congress is due June 16, 2026.
Read more →CMMC 2.0 is live and phasing into DoD contracts. Here is what the program requires, the three levels, and who needs which.
Read more →GovConCyber is a free legal reference — not a law firm. We cover the federal cybersecurity rules that apply to government contractors: what they require, who they apply to, and what you need to do. Start here if you're new to the site.
Answer a few questions about your contract type and data to get a plain-language summary of your obligations.
Get started →Start with the fundamentals: what the key frameworks are, why they exist, and how they affect your contracts.
Read the basics →Plain-language definitions for CUI, CMMC, DFARS, FedRAMP, and many other key terms.
Browse the glossary →FAR, DFARS, frameworks, and agency-specific rules
State-level cyber laws affecting government contractors
Sector-specific obligations: defense, healthcare, finance, and more
Checklists, templates, and program-building guides
Actions, penalties, and False Claims Act case law
Cybersecurity 101 and a plain-language glossary
GovConCyber is a free, independent legal reference for government contractors. We translate complex federal cybersecurity requirements into plain English — without the billable hour. Content is reviewed for accuracy against the underlying statutes, regulations, and official guidance, and updated periodically as those rules evolve.
Learn more about this site →