2027 EDITION
FREE ANNUAL REPORT
The Defense Cyber Rulebook 2027
What’s enforced, what’s paused, and what’s coming for defense contractors.
CMMC Phase 2 is paused. Your obligations aren’t. DFARS 7012, your SPRS affirmation, prime flowdowns, and international rules all still apply. The Rulebook is the plain-language guide to every cybersecurity requirement on your contracts, updated every year by the team that helps defense contractors meet them.
Reserve now and it lands in your inbox the day it releases.
as seen as
Why this year matters
The rules moved. The risk didn’t
Pauses, reforms, and new flowdowns make it harder than ever to know what actually applies to your business. Defense leaders who guess wrong lose bids, delay payments, or sign affirmations they can’t back up.
CMMC is paused, not over
Phase 2 third-party assessments are on hold while DoD reviews the program. Phase 1 self-assessments still apply, and certification is coming back.
Your SPRS score is a legal statement
Every affirmation you submit can be tested under the False Claims Act. Settlements against defense contractors keep coming.
Primes set their own deadlines
Your customers aren’t waiting on DoD. Many already require proof of security in flowdowns, questionnaires, and renewals.
Inside the Rulebook
Every rule on your contracts, in plain language.
Not a CMMC manual. A complete view of the cybersecurity obligations defense contractors carry in 2027, what each one means for your business, and what to do first.
Where CMMC stands now
The pause, the Reform Task Force, and what to expect when Phase 2 returns.
What’s enforced today
DFARS 7012, NIST SP 800-171, incident reporting, and your SPRS score.
The legal side of compliance
What the False Claims Act means for every affirmation you sign.
Beyond the U.S.
ITAR, NIS2, DEFSTAN 05-138, and CCSSP for contractors who sell across borders.
What primes will ask for next
Flowdowns, questionnaires, enclaves, and AI use in the supply chain.
Your 90-day plan
The Valor Way: Illuminate, Prioritize, Integrate, Evolve, with a checklist for each step.
Who it’s for
Written for the people who sign, bid, and build
Owners and CEOs
Know what you’re affirming and what it puts at risk.
Contracts and compliance leads
Read every clause and flowdown with confidence.
IT and security leaders
Prioritize the controls that matter for 2027.
Partners and advisors
Guide the defense clients you already serve.
Reserve your copy
Be the first to read the 2027 Rulebook
It’s free. We’ll email the full report the day it releases, plus short updates whenever the rules change during the year.
- The full report on release day
- Rule-change alerts through 2027
- No sales pitch, just the rules and what to do
From the Valor team
Written by the team that protects the defense industrial base.
Valor Cybersecurity is a team of cybersecurity and compliance specialists based in Norfolk, Virginia. Our mission is to consult and architect the digital infrastructure that keeps defense companies compliant and protected.
Every year we turn what we see in the field, from assessments and audits to incidents and the questions primes are asking, into one plain-language guide. The Rulebook is how we help the leaders we serve act with confidence instead of guessing.
“Compliance is one piece. Protecting your business is the job.”
Our vision
100M
people digitally protected, starting with the companies that protect our nation.
DEFEND. DETECT. DOMINATE.
Know a defense leader who needs this?
Valor is aligned with CMMC Level 2 requirements and uses FedRAMP Moderate equivalent systems for sensitive client data, including CUI. This page describes our security practices. It is not a CMMC certification.
Not sure where your security stands?
Don’t wait for the report. In days, you’ll know your gaps, your SPRS score, and what to do next.
