I recently read an article in the Orlando Florida Business Journal describing a letter that a local employer received from a defense prime contractor. The letter advised that "if the (local company) wasn't working to become compliant with new federal cybersecurity regulations, it was in jeopardy of losing out on future work on an (existing) contract worth $750,000" (a major contract for this small employer).

For several years, the Workers' Compensation Institute (WCI) had been reviewing the new cybersecurity standards, referred to as CMMC, to determine whether the standards applied to workers' compensation. There are three significant areas of concern:

• Would previously required compliance with cybersecurity standards be expanded to relate to data and information retained as a matter of law for workers' comp purposes?
• Would the previously compliant companies be considered in the "defense supply chain" due to the expanded definition of that term?
• Even if the new cybersecurity standards would not apply to companies concerned with workers' comp issues (which is highly doubtful), could the standards be used as a "best practice" method of protecting confidential information?

The new cybersecurity standards require adherence by a company within the defense supply chain, which is defined to include not only prime contractors but also subcontractors and suppliers of services and products to defense contractors and subcontractors. Also, the newly defined protected data would include information relevant to workers' compensation issues.