“Hardening” the Supply Chain:

Cybersecurity After the Fighter Jet Data Theft

In response to the theft of F-35 fighter jet design data by Chinese state-sponsored actors, the United States has implemented several cybersecurity measures to protect its defense industrial base.​ 

Cybersecurity Maturity Model Certification (CMMC)

The Department of Defense introduced the CMMC to enforce cybersecurity standards across its supply chain. This framework requires defense contractors to undergo third-party assessments to verify compliance with specific cybersecurity practices. The initiative aims to prevent incidents like the F-35 data breach, where inadequate security measures at a subcontractor led to significant data loss. ​

Enhanced Cybersecurity Standards

The U.S. government has mandated stricter cybersecurity protocols for federal agencies and contractors. These include secure software development practices and comprehensive documentation of security measures. Non-compliance can lead to legal consequences, emphasizing the seriousness of protecting sensitive information.​

Executive Orders on Cybersecurity

In January 2025, an executive order was issued to bolster cybersecurity across federal operations. This directive focuses on improving network monitoring, securing software acquisition processes, and enhancing responses to foreign cyber threats. It also emphasizes the importance of protecting cloud platforms and authentication keys, which have been exploited in past cyberattacks.​

Active Defense Strategies

The U.S. is exploring active defense measures, including the concept of “hack back,” where companies can take proactive steps to disrupt cyberattacks and prevent data theft. While controversial, this approach reflects the urgency in addressing persistent cyber threats from adversaries.

These measures represent a comprehensive effort to safeguard U.S. defense technologies and maintain a competitive edge in the face of ongoing cyber espionage activities.