CMMC entered Phase 1 in November 2025, relying primarily on Level 1 and Level 2 self-assessments. Phase 2 was scheduled to begin on November 10, 2026, and would have expanded third-party Level 2 certification requirements, with additional implementation phases planned for 2027 and 2028. The rollout changed course on July 13, 2026, when DoW suspended the Phase 2 transition and placed future CMMC milestones on hold while a task force conducts a review. The suspension follows concerns that certification costs, limited assessment capacity, and complicated compliance timelines could discourage small businesses and nontraditional companies from participating in defense contracting. The pause, however, does not eliminate contractors’ existing cybersecurity obligations. Contractors and subcontractors must continue protecting covered defense information under DFARS 252.204-7012 and applicable NIST SP 800-171 requirements. As federal policy increasingly treats domestic production, supply chain visibility, and cybersecurity as interconnected parts of defense readiness, contractors should continue reviewing their lower-tier suppliers, documenting sourcing, and strengthening cybersecurity controls even while the CMMC rollout remains under review.
DOJ Issues First Corporate Enforcement Policy Declination: Lessons from Bosch’s FDPR Export Control Resolution
Contributors: Thad McBride and Faith Dibble
In June, the U.S. Department of Justice (DOJ) National Security Division issued its first-ever declination under the Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), opting not to prosecute Robert Bosch GmbH for potential criminal violations of the Export Control Reform Act arising from exports to restricted parties in China. Although the products were manufactured outside the United States, they were subject to U.S. export controls under the Foreign Direct Product Rule (FDPR), which extends U.S. jurisdiction to certain foreign-produced items derived from U.S. technology. Bosch subsidiaries shipped approximately $72.4 million in products without required U.S. export licenses. DOJ determined that Bosch qualified for a declination because it voluntarily disclosed the conduct while still investigating the matter, fully cooperated with authorities, and implemented significant compliance enhancements, including expanding its trade compliance staff and strengthening FDPR-related controls. Although Bosch avoided criminal prosecution, it agreed to pay approximately $40 million in combined civil penalties and disgorgement, including a $36 million penalty imposed by the Commerce Department’s Bureau of Industry and Security. The case highlights several key compliance lessons: voluntary self-disclosure can significantly reduce criminal enforcement risk, early disclosure carries substantial weight with regulators, remediation efforts must be meaningful and well-documented, and the FDPR's reach can extend U.S. export controls to foreign-made products sold by non-U.S. companies. The Bosch outcome also illustrates that while cooperation and remediation may help companies avoid criminal charges, they do not eliminate the potential for significant civil liability.
For more details, please see an article our international trade team published here.
5 MANUFACTURING & INDUSTRIAL: OUTLOOK & TRENDS |
Powered by FlippingBook