Cybersecurity rules in this supplement
NMCARS supplements the DoD-wide DFARS cyber rules for the Navy and Marine Corps:
NMCARS Subpart 5204.73 — Safeguarding Covered Defense Information and Cyber Incident Reporting. Implements DFARS Subpart 204.73 for Department of the Navy acquisitions.
NMCARS Annex 16 — Statement of Work language implementing the Defense Industrial Base (DIB) memo. Provides standard SOW language for applying defense cybersecurity requirements.
In plain terms
The Navy applies the full DoD defense cyber rulebook — NIST SP 800-171, SPRS scores, and CMMC — and uses standard statement-of-work language to build those requirements into contracts.
Who it applies to
Navy and Marine Corps contractors and subcontractors handling Federal Contract Information or Covered Defense Information.
What it requires
Everything in the DoD/DFARS cyber baseline (NIST SP 800-171 Rev 2, SPRS, CMMC, 72-hour incident reporting), applied through Navy SOW language.
Why it matters
Navy contracts apply the DoD cyber regime; the Annex 16 SOW language makes those obligations explicit in the contract terms.
Citation
Navy Marine Corps Acquisition Regulation Supplement (NMCARS), codified at 48 C.F.R. Chapter 52; see also DFARS at 48 C.F.R. Chapter 2.