Plain-language guidance on the cybersecurity requirements that attach to federal contracts — FAR 52.204-21, DFARS 252.204-7012, CMMC, CUI, NIST SP 800-171, FedRAMP, incident reporting, and the clauses that turn cybersecurity into procurement risk.
Before any FAR or DFARS clause applies, federal and state law already requires your business to secure data and report breaches — the FTC Act, all-50-state breach laws, and rules like GLBA and HIPAA. The contractor requirements build on top of that legal baseline. Make sure you meet it first.
FAR 52.204-21 addresses only physical access logs and DFARS 252.204-7012 names no event types or retention period. The real logging obligation is NIST SP 800-171 section 3.3, which leaves six parameters for the contractor to define and sets no retention number at all. Here is what to write down, and why the 90-day incident preservation duty is not a retention policy.
Read more →Choosing a CMMC Third-Party Assessment Organization is a due-diligence decision, and 32 C.F.R. 170.8 and 170.9 tell you exactly what to check. Authorized and accredited are two different regulatory states, the government vets C3PAOs for foreign ownership and background investigations, and a consultant who prepped you cannot assess you for three years. Here is how to verify the firm that will judge your program.
Read more →The Maryland Data Privacy and Protection Act of 2026 (Chapter 435, House Bill 264) takes effect October 1, 2026 and rewrites State Finance and Procurement § 13-115. Collecting, storing, or processing personal information is now an independent trigger for mandatory security, data collection, and privacy requirements in Maryland State contracts — no connection to a State system required — and the statutory definition of personal information expanded at the same time.
Read more →CISA published the Logging Reference Architecture on August 20, 2026, implementing OMB Memorandum M-26-14, which rescinded M-21-31 and put federal civilian agencies on a maturity clock for how they log, retain, and produce network data. The memorandum reaches systems operated “by third parties on the agency’s behalf” — so contractor-run systems are inside the agency’s plan, and the obligation will arrive through contract terms rather than the memo itself.
Read more →GovConCyber is a free legal reference — not a law firm. We cover the federal cybersecurity rules that apply to government contractors: what they require, who they apply to, and what you need to do. Start here if you're new to the site.
Answer a few questions about your contract type and data to get a plain-language summary of your obligations.
Get started →Start with the fundamentals: what the key frameworks are, why they exist, and how they affect your contracts.
Read the basics →Plain-language definitions for CUI, CMMC, DFARS, FedRAMP, and many other key terms.
Browse the glossary →Original, source-anchored analysis on the harder questions — where requirements, contracts, data-handling, and enforcement intersect.
The obligations that reach contractors outside the CMMC conversation — the FAR baseline, civilian-agency clauses, cloud, incident reporting, and enforcement.
How to identify, mark, handle, and flow down the categories of information federal contracts protect — CUI and beyond.
FAR, DFARS, frameworks, and agency-specific rules
State-level cyber laws affecting government contractors
Sector-specific obligations: defense, healthcare, finance, and more
Requirement triage, roadmaps, educational self-checks, and reference aids for planning compliance work.
Original analysis — beyond CMMC, protected information, maps and trackers
Actions, penalties, and False Claims Act case law
Cybersecurity 101 and a plain-language glossary
GovConCyber is a free reference first. When you need that analysis applied — explained to a room, or mapped to your actual contracts — these are the ways to go further.
Plain-language sessions on CMMC, CUI, and the requirements beyond CMMC — for conferences, bar associations, APEX Accelerator programs, and internal briefings.
Explore speaking topics →The Compliance Roadmap Assessment™ — a structured readiness review that maps which requirements apply to your contracts and what to prioritize. Not a CMMC assessment or legal advice.
See how advisory works →