Updates
New laws, rules and programs that change what drone and robotics companies can sell, build and get funded forOne entry per change, newest first, with what to do about it and a source to confirm. Reviewed monthly; last review September 21, 2026. Know of a change that belongs here? Send it.
July 13, 2026CybersecurityCMMC Phase II suspendedThe Department paused the third-party (C3PAO) certification requirement that would have entered new solicitations on November 10, 2026, while a task force reviews the cost to small businesses. Phase I self-assessments stay in effect; DFARS 252.204-7012 and NIST SP 800-171 obligations are unchanged.
What to do: Keep your SPRS score posted. Do not cancel an assessment a prime contractor requires. A posted score is still a differentiator.Source: BDO
What to do: Keep your SPRS score posted. Do not cancel an assessment a prime contractor requires. A posted score is still a differentiator.Source: BDO
November 10, 2025CybersecurityCMMC Phase 1 beganNew DoD contracts that involve federal contract information or controlled unclassified information now carry a CMMC Level 1 or Level 2 self-assessment as a condition of award. The rule flows down to subcontractors and service providers handling that information.
What to do: Know whether you touch CUI. If you do, the 110 NIST 800-171 controls apply and your score must be in SPRS.Source: Venable
What to do: Know whether you touch CUI. If you do, the 110 NIST 800-171 controls apply and your score must be in SPRS.Source: Venable