Golden Dome for America is a missile defense program, and its supply chain asks come through contracts. Law firm summaries of a July 2025 DoD CIO memo describe CMMC, supply chain risk management, bills of materials and secure development attestation. We could not retrieve the memo itself, so read it and your solicitation before acting.
What is Golden Dome?
It began as the Iron Dome for America under Executive Order 14186 of January 27, 2025, and the Pentagon later renamed it. A Congressional Research Service report says it is run by DOD's Office of Golden Dome for America, with the Army Space and Missile Defense Command as operational lead. Cost estimates vary widely across sources, so this post gives none.
What do the summaries say about cybersecurity?
Greenberg Traurig's December 2025 alert describes a July 2025 DoD CIO memorandum on cybersecurity implementation and verification requirements, applying across the program's industrial base including vendors. Items it lists:
- Controlled unclassified information controls under several DFARS 252.204 clauses.
- CMMC certification, based on NIST SP 800-171 and SP 800-172.
- Threat intelligence sharing across supply chain vendors, plus vulnerability monitoring and scanning.
- An insider threat program and a tamper protection program.
- A complete bill of materials covering hardware, software, firmware, microelectronics and other materials.
- Mature supply chain risk management, with provenance and pedigree validation under the SP 800-172 enhancements.
- A secure software development environment and an attestation to Executive Order 14028.
The alert reports that DoD issued the final DFARS rule implementing CMMC on September 10, 2025, that phase 1 began on November 1, 2025, and that Level 3 requirements may appear in solicitations from November 2026.
How does that sit with the January 2026 OMB change?
OMB M-26-05 rescinded the civilian-side memos M-22-18 and M-23-16 and put the choice of attestation and SBOM terms with agencies. It is a memorandum to executive agencies, and defense contract terms are set in solicitations and DFARS clauses. We could not confirm how the Golden Dome memo's reference to an EO 14028 attestation reads after that change. Ask the contracting officer.
Is it a benchmark for everyone?
Defense terms are stricter than most commercial ones. They are useful as a ceiling to practice against, but they do not apply to you unless your contract says so.
A constructed example
A firm supplies a signal processing library to a subcontractor on a Golden Dome related program. The subcontract flows down three asks: a CMMC level, an SBOM per release including firmware blobs, and a named contact for vulnerability notices within a set time. The firm finds its SBOM does not cover firmware blobs bundled in a test fixture. It adds them, records origin for each, and writes the notice contact into its incident runbook.
How to check or apply this
- Read the actual solicitation and flow-down clauses, not summaries.
- Confirm which CMMC level your work needs, and how far along your assessment is.
- Build SBOMs that include firmware, binaries and vendored code, tied to each release.
- Record origin and integrity for components, as the provenance asks imply.
- Set up a supplier notification path in both directions.
- Document your secure development practices against NIST SP 800-218.
- Ask counsel what an EO 14028 attestation means in your contract today.
Safeguard can generate SBOMs and scan dependencies. It does not provide CMMC certification, and none of this means any defense requirement is met.
What if you are only a small subcontractor?
Flow-down clauses reach small firms. You may be asked for a CMMC level, SBOMs and incident notice commitments by a prime contractor that is itself responding to the program's terms. Start by asking the prime for the exact clauses and the dates they expect evidence. Small teams do best by choosing a few controls to do well and documenting them clearly.
Quick check
Are SBOMs required for Golden Dome vendors?
Law firm summaries say the DoD CIO memo calls for a complete bill of materials, but the contract language decides. Check your solicitation.
Does OMB M-26-05 change defense contracts?
It rescinded civilian software attestation memos. Defense obligations come from contracts and DFARS clauses, so confirm with your contracting officer.
Sources
- Greenberg Traurig, Federal contracting updates for Golden Dome for America contractors
- CRS, The U.S. Army and the Golden Dome Program
- OMB M-26-05 (PDF)
- NIST, Secure Software Development Framework
Last reviewed: 18 October 2026.
