In plain terms. NMCARS is the Department of the Navy's acquisition supplement (covering the Navy and Marine Corps), layered on the FAR and DFARS.
Who it applies to. Contractors selling to the U.S. Navy or Marine Corps.
What it requires. Follow the FAR and DFARS, then Navy-specific terms in NMCARS. Because the work is Department of Defense work, contracts here generally carry the core DFARS cyber clause 252.204-7012 — protect covered defense information to NIST SP 800-171 and report cyber incidents to DoD within 72 hours — plus CMMC requirements as they phase in.
Why it matters. As with other DoD components, the cybersecurity teeth come from DFARS; NMCARS mainly tailors departmental process.
Citation. NMCARS, the Navy Marine Corps Acquisition Regulation Supplement supplement to the Federal Acquisition Regulation (FAR), codified in the FAR System at Title 48 of the C.F.R.