Defense work can place cybersecurity obligations on a company even when it never contracts directly with the Department of Defense. Prime contractors may pass CMMC requirements to subcontractors that receive Federal Contract Information or Controlled Unclassified Information. Understanding what data the subcontractor handles, where...