Defense contractors are racing to implement CMMC controls and prepare for assessments, zooming right by the legal implications of getting it wrong in the process. You don’t need a cybersecurity incident to face million-dollar penalties, contract termination, or federal investigation.
The Department of Justice’s Civil Cyber-Fraud Initiative has already proven that misrepresenting your cybersecurity compliance can trigger enforcement action regardless of whether you’ve experienced a breach. Aerojet Rocketdyne paid $9 million in 2022 for allegedly misrepresenting its compliance with DFARS cybersecurity requirements — the same standards that form the foundation of CMMC.
Chelsea Zortman, Associate at McDonald Hopkins PLC and member of the firm’s Data Privacy and Cybersecurity Practice Group, is revealing the legal risks contractors face at CMMC CON 2025 on Sept. 24-25. Her session “Legal Insights: Regulatory Landscape with Guest Counsel” will expose the compliance traps that catch contractors off guard and show how legal missteps can derail even technically sound CMMC implementations.
Zortman specializes in cybersecurity incident response, data breach notification, and regulatory investigations. She’s seen firsthand how contractors who focus solely on technical compliance miss the legal landmines that can destroy their business relationships with the DOD. Her session will address five critical legal risk areas based on real enforcement cases. She’ll detail how contract termination works when contractors fail to meet CMMC requirements, and why even self-attestation creates legal liability that can be used as evidence in civil or criminal cases.
With CMMC requirements taking effect Oct. 1, 2025, contractors can no longer ignore the legal implications. Organizations that understand the legal implications will protect themselves from enforcement actions, contract disputes, and regulatory investigations.
Register for CMMC CON 2025 to understand the legal risks that could impact your organization’s CMMC compliance and learn how to protect against enforcement actions that have already cost other contractors millions.