Department of War Unveils Regulatory Priorities: Cybersecurity Framework Finalized, Prototype Acquisition Rules Revised

On August 14, 2026, the Department of War (DoW) released its Semiannual Regulatory Agenda in the Federal Register, providing a comprehensive look at the regulatory and deregulatory actions the department plans to undertake in the next 12 months. This release, mandated by Executive Order 12866, "Regulatory Planning and Review," and Executive Order 13563, "Improving Regulation and Regulatory Review," underscores the DoW's commitment to enhancing governmental efficiency and aligning its regulatory framework with key administrative priorities. The agenda highlights significant steps to bolster national security, foster innovation within the defense industrial base, and ensure compliance across its vast network of contractors and partners.

The DoW's Strategic Regulatory Imperatives

The agenda details how the DoW's regulatory activities directly support the Administration's broader objectives and the Secretary of Defense's top priorities. These include an explicit focus on reviving the warrior ethos, rebuilding the military's capabilities, and reestablishing deterrence in a complex global environment. The publicly released document serves as a critical mechanism for transparency, allowing interested parties to submit comments on proposed and interim final rulemakings through www.regulations.gov. This update follows a report published on September 22, 2025, and includes regulations expected to be issued or reviewed by the DoW through the next year. Furthermore, the agenda specifically identifies rules impacted by the Regulatory Flexibility Act, the Paperwork Reduction Act of 1995, and the Unfunded Mandates Reform Act of 1995, ensuring that the department's actions consider their broader economic and administrative implications.

Fortifying the Defense Industrial Base with Cybersecurity Mandates

A pivotal development detailed in the agenda is the completion of final rules concerning "Assessing Contractor Implementation of Cybersecurity Requirements" (DFARS Case 2019-D041, RIN 0750-AK81). This regulatory action by the Department of Defense (DoD) amends the Defense Federal Acquisition Regulation Supplement (DFARS) to integrate the contractual requirements of the Cybersecurity Maturity Model Certification (CMMC) 2.0 Framework. The core objective of CMMC 2.0 is to safeguard sensitive unclassified information and intellectual property from theft within the Defense Industrial Base (DIB) sector. The framework establishes a standardized approach for assessing and certifying DIB contractors' compliance with applicable information security standards. The rule ensures that the DoD receives assurances that contractors can adequately protect sensitive information, including its flow down to subcontractors across multi-tier supply chains. This robust cybersecurity initiative comes with an estimated annualized cost to the public of approximately $16 million, reflecting the significant investment required to secure critical defense data. The timeline for this crucial regulation saw an interim final rule published on September 29, 2020, becoming effective on November 30, 2020. A subsequent NPRM was issued on August 15, 2024, leading to the final action on September 10, 2025, with an effective date of November 10, 2025.

Modernizing Acquisition for Prototype Projects

Another significant area of focus within the DoW's agenda is the finalization of revisions to regulations governing "Transactions Other Than Contracts, Grants, or Cooperative Agreements for Prototype Projects" (RIN 0790-AK98). This action by the Department of Defense (DoD) aims to update its existing regulations on Other Transaction (OT) agreements for prototype projects. These updates are necessary to implement statutory changes enacted by Congress since the last revision in 2004. Key modifications include clarifying the authority for follow-on production OTs and contracts, establishing special circumstances for awarding OTs to small businesses, nontraditional defense contractors, nonprofit research institutions, and consortia. The revisions also address approval requirements for large dollar OTs, the authority to supply prototypes and production items to another contractor as Government-furnished items, and the application of procurement ethics requirements to covered OT agreements. These changes are designed to streamline the acquisition process for innovative technologies and ensure ethical conduct. A Notice of Proposed Rulemaking (NPRM) was published on September 4, 2024, with the comment period concluding on November 4, 2024. The DoW anticipates taking final action on these revisions in July 2026.

Regulatory Context and Future Considerations

The agenda underscores that while these rules are critical, the publication does not waive the applicability of the military affairs exemption found in section 553 of title 5 U.S.C. and section 3 of Executive Order 12866. This highlights the inherent balance between public transparency and national security imperatives within federal regulatory processes. The DoW's comprehensive approach reflects a continuous effort to adapt its regulatory environment to address contemporary challenges while fostering an agile and secure defense enterprise.