Defense contractors must now prove their cybersecurity to get paid

The US Department of Defense is making its cybersecurity standards mandatory for contractors. Companies that want to work with the military must now prove they meet these standards, or they will not get contracts.

For years, defense contractors could largely self-attest to their cybersecurity practices. This rule means they must now undergo formal, third-party certification to secure contracts. This shifts the burden of proof and adds a new cost for many firms, especially smaller ones, but aims to reduce vulnerabilities in the defense supply chain.