Susan B. Cassidy

Ms. Cassidy represents clients in the defense, intelligence, and information technologies sectors.  She works with clients to navigate the complex rules and regulations that govern federal procurement and her practice includes both counseling and litigation components.  Ms. Cassidy conducts internal investigations for government contractors and represents her clients before the Defense Contract Audit Agency (DCAA), Inspectors General (IG), and the Department of Justice with regard to those investigations.  From 2008 to 2012, Ms. Cassidy served as in-house counsel at Northrop Grumman Corporation, one of the world’s largest defense contractors, supporting both defense and intelligence programs. Previously, Ms. Cassidy held an in-house position with Motorola Inc., leading a team of lawyers supporting sales of commercial communications products and services to US government defense and civilian agencies. Prior to going in-house, Ms. Cassidy was a litigation and government contracts partner in an international law firm headquartered in Washington, DC.

Subscribe to all posts by Susan B. Cassidy

How is DoD Planning to Use the Supplier Performance Risk System (SPRS)?

By Susan B. Cassidy, Ryan Burnette and Darby Rourick on Posted in Cybersecurity, Defense Industry, Supply Chain
As described in an earlier blog post, the Department of Defense (DoD) released an Interim Rule on September 29, 2020 that address DoD’s increased requirements for assessing whether contractors are compliant with the 110 security controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 (NIST 800-171).[1]  Under this new Interim Rule, … Continue Reading

Department of Defense’s Interim Rule Imposes New Assessment Requirements But is Short on Detail on Implementation of CMMC

By Susan B. Cassidy, Ashden Fein, Samantha Clark and Darby Rourick on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance, Supply Chain
On September 29, 2020, the Department of Defense (DoD) released an interim rule that industry hoped would provide clear guidance with regard to DoD’s implementation of its Cybersecurity Maturity Model Certification (CMMC) framework.  The vast majority of the rule focuses on DoD’s increased requirements for confirming that contractors are currently in compliance with all 110 … Continue Reading

New Section 889 Restrictions Included in Updated Uniform Guidance Regulations from the Office of Management and Budget

By Susan B. Cassidy, Samantha Clark, Ryan Burnette and Darby Rourick on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance, NDAA, Supply Chain
On August 13, 2020, the Office of Management and Budget (OMB) released new revisions to its Guidance for Grants and Agreements set forth under 2 CFR (commonly referred to as the Uniform Guidance).  The Uniform Guidance governs the terms of federal funding issued by agencies, including grants, cooperative agreements, federal loans, and non-cash assistance awards.  … Continue Reading

[Updated] If the Acting DHS Secretary Was Unlawfully Selected, What Does that Mean for DHS Procurements?

By Susan B. Cassidy, Jennifer Plitsch, Michael Wagner and Evan R. Sherwood on Posted in Claims and Contract Disputes, Cybersecurity, Government Contracts Regulatory Compliance, Information Technology Contracting, Privacy, Procurement Policy
The Government Accountability Office (“GAO”) released a decision on Friday finding that the Department of Homeland Security (“DHS”) followed the wrong order of succession after Secretary Kirstjen Nielsen resigned in April 2019.  As a result, the Acting Secretaries who have served since then were invalidly selected.  In particular, GAO has questioned the appointments of Acting … Continue Reading

National Institute for Standards and Technology Releases Draft of NIST SP 800-172

By Susan B. Cassidy, Ashden Fein, Ryan Burnette and Darby Rourick on Posted in Cybersecurity, Defense Industry
The National Institute for Standards and Technology released the draft of NIST Special Publication 800-172 (“NIST SP 800-172”) on July 6, 2020.  This draft special publication succeeds the prior draft NIST SP 800-171B that NIST published in June 2019, and operates as a supplement to the NIST SP 800-171 controls that federal contractors generally must … Continue Reading

M&A and Section 889: Due Diligence and Integration Considerations

By Scott A. Freling, Susan B. Cassidy, Samantha Clark and Ryan Burnette on Posted in Commercial Items, Cybersecurity, Defense Industry, Energy, Government Contracts Regulatory Compliance, Information Technology Contracting, Supply Chain
(This article was originally published in Law360 and has been modified for this blog.) Companies in a range of industries that contract with the U.S. Government—including aerospace, defense, healthcare, technology, and energy—are actively working to assess whether or not their information technology systems comply with significant new restrictions that will take effect on August 13, … Continue Reading

“Section 889” Prohibition on “Use” of Covered Telecommunications Equipment by Federal Contractors Released as an Interim Rule

By Susan B. Cassidy, Samantha Clark, Ryan Burnette, Darby Rourick and Zachary Mears on Posted in Defense Industry, Government Contracts Regulatory Compliance, Supply Chain
On July 10, 2020, the interim rule implementing Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. No. 115-232) was released by the U.S. Government’s Federal Acquisition Regulatory Council. Section 889 prohibits the U.S. Government from buying (as of August 2019)—or contracting with an entity that uses … Continue Reading

Contractor Supply Chain Readiness – An Update on Expected Regulatory Changes

By Susan B. Cassidy, Samantha Clark and Ryan Burnette on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance, Information Technology Contracting, NDAA, Procurement Policy, Supply Chain
In recent years, both Congress and the Executive Branch have made it a key priority to mitigate risks across the industrial and innovation supply chains that provide hardware, software, and services to the U.S. government (“USG”).  Five of these initiatives are likely to result in new regulations in 2020, each of which could have a … Continue Reading

CISA Information and Communications Technology Supply Chain Risk Management Task Force Releases New Guidance on Security Resiliency

By Susan B. Cassidy, Trisha Anderson, Zachary Mears and Ryan Burnette on Posted in Information Technology Contracting, Supply Chain
On May 5, 2020 the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (“CISA”) Information and Communications Technology (“ICT”) Supply Chain Risk Management (“SCRM”) Task Force (the “Task Force”) released a six-step guide for organizations to start implementing organizational SCRM practices to improve their overall security resilience.  The Task Force also released a revised … Continue Reading

Can I Recover the Added Costs of Work Caused by COVID-19?

By Michael Wagner, Susan B. Cassidy, Evan R. Sherwood and Peter Terenzio on Posted in Claims and Contract Disputes, Coronavirus, COVID-19, Government Contracts Regulatory Compliance, Uncategorized
As the fallout from COVID-19 continues, federal contractors in every industry are seeing significant impacts on their ability to perform, ranging from scheduling delays to supply chain interruptions and increased costs of performance.  We previously addressed the rules and regulations governing excusable delays, which permit a contractor to avoid default if a failure to perform … Continue Reading

The Show Must Go On: Mission-Essential Services During the Coronavirus Outbreak

By Peter B. Hutt II, Susan B. Cassidy and Brooke Stanley on Posted in Biodefense, Claims and Contract Disputes, Defense Industry
As the COVID-19 virus extends its global reach, defense contractors may be called upon to begin implementing their contracts’ mission-essential services plans. These plans, required by DFARS 252.237-7023, facilitate mission-essential functions in extended crisis situations, including pandemics, which are explicitly noted in the DFARS. As the coronavirus outbreak continues, defense contractors should check whether their … Continue Reading

“Excuse Me, My Performance Has been Interrupted”– How Excusable Delay Provisions in the FAR May Help Federal Contractors Affected by the Coronavirus

By Evan R. Sherwood, Susan B. Cassidy and Michael Wagner on Posted in Biodefense, Claims and Contract Disputes, Supply Chain
The global spread of the COVID-19 virus may put many federal contractors at risk of missing contractual deadlines. In a growing number of cases, supply chains may become cut off, work spaces may be closed, or employees may need to stay home, all of which could impact a contractor’s ability to perform in a timely … Continue Reading

A Closer Look at Version 1.0 of DoD’s Cybersecurity Maturity Model Certification

By Susan B. Cassidy, Ashden Fein, Samantha Clark, Ryan Burnette and Darby Rourick on Posted in Cybersecurity, Defense Industry, Supply Chain
On January 31, the Department of Defense (“DoD”) released Version 1.0 of its Cybersecurity Maturity Model Certification (“CMMC”).  This is the fourth iteration of the CMMC that DoD has publicly released since it issued the first draft in October, and it is intended to be the version that auditors will be trained against, and that … Continue Reading

DoD Announces the Release of CMMC Version 1.0

By Susan B. Cassidy, Ashden Fein, Samantha Clark, Ryan Burnette and Darby Rourick on Posted in Cybersecurity, Defense Industry
On Friday January 31, 2020, Ellen Lord, Under Secretary of Defense for Acquisition and Sustainment, Kevin Fahey, Assistant Secretary of Defense for Acquisition, and Katie Arrington, the Chief Information Security Officer for the Department of Defense (“DoD”), briefed reporters on the release of the Cybersecurity Maturity Model Certification (“CMMC”) Version 1.0.  We have discussed draft … Continue Reading

DoD Releases Version 0.7 of Its Cybersecurity Maturity Model Certification

By Susan B. Cassidy, Samantha Clark and Ryan Burnette on Posted in Cybersecurity, Defense Industry, Procurement Policy
On December 13, the Department of Defense (“DoD”) released the latest version of its Cybersecurity Maturity Model Certification (“CMMC”).  This is the third iteration of the draft model that DoD has publicly released since it issued the first draft in October.  (We previously discussed Version 0.4 and Version 0.6 of the CMMC in prior blog … Continue Reading

New FAR Rule Expands Counterfeit Reporting Obligations

By Susan B. Cassidy, Michael Wagner and Peter Terenzio on Posted in Government Contracts Regulatory Compliance, Procurement Policy, Supply Chain
Last week, the FAR Council issued a Final Rule, setting forth new FAR provisions that require the reporting of certain counterfeit and suspect counterfeit parts and certain major or critical nonconformances to the Government – Industry Data Exchange Program (“GIDEP”).[1]  This Final Rule comes more than five years after the rule was first proposed in … Continue Reading

DoD Releases Version 0.6 of its Cybersecurity Maturity Model Certification

By Susan B. Cassidy, Samantha Clark and Ryan Burnette on Posted in Cybersecurity, Defense Industry, Procurement Policy
On November 7, the Office of the Assistant Secretary of Defense for Acquisition released Version 0.6 of its draft Cybersecurity Maturity Model Certification (CMMC) for public comment. The CMMC was created in response to growing concerns by Congress and within DoD over the increased presence of cyber threats and intrusions aimed at the Defense Industrial … Continue Reading

CISA Information and Communications Technology Supply Chain Risk Management Task Force Issues New Interim Report

By Susan B. Cassidy and Ryan Burnette on Posted in Cybersecurity, Information Technology Contracting, Procurement Policy, Supply Chain
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency’s (“CISA”) Information and Communications Technology (“ICT”) Supply Chain Risk Management Task Force (the “Task Force”) recently released an interim public report.  The report describes the Task Force’s efforts over the last year to develop recommendations for securing the Government’s supply chain, and outlines the potential … Continue Reading

Navy Modifies Acquisition Supplement to Tighten Cybersecurity Requirements and Implement the Geurts Memorandum

By Susan B. Cassidy, Ashden Fein and Moriah Daugherty on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance, Supply Chain
Almost a year after Assistant Secretary of the Navy James Geurts issued his September 28, 2018 memorandum (Geurts Memo) imposing enhanced security controls on “critical” Navy programs, the Navy has issued an update to the Navy Marine Corps Acquisition Regulations Supplement (NMCARS) to implement those changes more formally across the Navy.  Pursuant to this update, a new … Continue Reading

DoD Releases Public Draft of Cybersecurity Maturity Model Certification and Seeks Industry Input

By Susan B. Cassidy, Samantha Clark and Ryan Burnette on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance, Supply Chain
On September 4, the Office of the Assistant Secretary of Defense for Acquisition released Version 0.4 of its draft Cybersecurity Maturity Model Certification (CMMC) for public comment.  The CMMC was created in response to growing concerns by Congress and within DoD over the increased presence of cyber threats and intrusions aimed at the Defense Industrial … Continue Reading

Section 889 Update: First Wave of Acquisition Prohibitions Take Effect

By Jeff Bozman, Samantha Clark and Susan B. Cassidy on Posted in Supply Chain
The FAR Council released an Interim Rule in August implementing part of Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019.  In this briefing, we highlight points where the Interim Rule provides clarity; definitional issues that remain unresolved; and new procedural requirements that government contractors should track. The Interim … Continue Reading

DoD Announces the Cybersecurity Maturity Model Certification (CMMC) Initiative

By Susan B. Cassidy, Melinda Lewis and Weiss Nusraty on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance
The Department of Defense (“DoD”) recently announced the development of the ”Cybersecurity Maturity Model Certification” (“CMMC”), a framework aimed at assessing and enhancing the cybersecurity posture of the Defense Industrial Base (“DIB”), particularly as it relates to controlled unclassified information (“CUI”) within the supply chain. The Office of the Under Secretary of Defense for Acquisition … Continue Reading

NIST Announces and Seeks Public Comment on 800-171 Update and Related Documents

By Susan B. Cassidy, Ashden Fein, Moriah Daugherty and Melinda Lewis on Posted in Cybersecurity
On June 19, 2019, the National Institute of Standards and Technology (“NIST”) announced the long-awaited update to Special Publication (“SP”) 800-171 Rev. 1, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, which includes three separate but related documents.… Continue Reading

Senate Armed Services Subcommittee on Cybersecurity Holds Hearing to Discuss the Responsibilities of the Defense Industrial Base

By Susan B. Cassidy, Zachary Mears, Samantha Clark and Weiss Nusraty on Posted in Cybersecurity, Defense Industry, Government Contracts Regulatory Compliance, Supply Chain
On March 26, 2019, the Senate Armed Services’ Subcommittee on Cybersecurity held a hearing to receive testimony assessing how the Department of Defense’s (“DOD”) cybersecurity policies and regulations have affected the Defense Industrial Base (“DIB”). To gain a better understanding of the DIB’s cybersecurity concerns, the Subcommittee invited William LaPlante, Senior Vice President and General … Continue Reading
LexBlog