Organizations in the District often answer to two rulebooks: D.C. breach notification law and the cyber clauses in federal contracts. DarkThreat helps Washington DC teams spot exposed credentials and relevant hacker chatter early, so they can act before an incident triggers either one.
Washington DC is home to many organizations that work with or around the federal government. Each has a different reason to watch the dark web.
Prime contractors and subcontractors that handle federal contract information or controlled unclassified information, and the staff accounts that reach it.
Member organizations, advocacy groups and NGOs that hold donor, member and staff data, often with small security teams.
Firms whose email accounts carry privileged and politically sensitive material, making them attractive to targeted phishing.
Consultancies and IT providers that support agencies and regulated clients, and so sit inside other organizations’ supply chains.
See our government, legal and professional services pages.
The two regimes protect different information and report to different authorities. A single incident at a D.C. contractor can trigger both.
| Topic | D.C. Code § 28-3851 onward | Federal contract clauses |
|---|---|---|
| Who it covers | Any person or entity that conducts business in D.C. and owns or licenses electronic personal information of D.C. residents. | Contractors and subcontractors whose contracts include FAR 52.204-21 or DFARS 252.204-7012. |
| What it protects | Personal information, including email account logins, ID and account numbers, medical, genetic and biometric data. | Federal contract information (FAR) and covered defense information (DFARS). |
| Trigger | Discovering a breach of the security of the system. | Discovering a cyber incident affecting a covered contractor information system (DFARS). |
| Deadline | Most expedient time possible and without unreasonable delay. | Rapidly report, defined as within 72 hours of discovery (DFARS). |
| Who you tell | Affected residents; the D.C. Attorney General if 50 or more residents are affected; consumer reporting agencies above 1,000. | DoD, through dibnet.dod.mil (DFARS). |
The District's Consumer Security Breach Notification Act is D.C. Code § 28-3851 onward. The Security Breach Protection Amendment Act of 2019, effective June 8, 2020, expanded it.
For threat intelligence teams, one definition stands out. Personal information includes a user name or email address with a password, security question and answer, or other means of authentication that permits access to an individual's email account.
It also covers a name or other identifier combined with Social Security, taxpayer, passport, driver's licence or military ID numbers, account or card numbers with access codes, and medical, genetic, health insurance and biometric data.
Section 28-3852.01 adds a security duty. Anyone who owns, licenses, maintains or handles District residents' personal information must keep reasonable security safeguards suited to the data and the size of the organization.
When you share that data with a service provider under a written agreement, the agreement must require the provider to keep reasonable security too. Violations are an unfair or deceptive trade practice under D.C. law.
This clause sets 15 basic security requirements for contractor systems that handle federal contract information. They include limiting access to authorized users, authenticating users before granting access, and monitoring communications at system boundaries.
Defense contractors with this clause must provide adequate security, generally by implementing NIST SP 800-171. After discovering a cyber incident, they must review for evidence of compromise, including compromised user accounts, and rapidly report to DoD, defined as within 72 hours.
The clause also requires preserving images of affected systems for at least 90 days, and it flows down to subcontractors that handle covered defense information.
The first phase of the Cybersecurity Maturity Model Certification (CMMC) program began on November 10, 2025. On July 13, 2026, the Department of War announced it had suspended Phase II, which had been scheduled for November 10, 2026.
Phase 1 self-assessment requirements remain in place. The DoD CIO notes that the pause does not remove the duty to protect information under DFARS 252.204-7012. Check the DoD CIO site for the latest status before planning.
For more, read dark web monitoring for government contractors in Washington DC and credential leak detection for government agencies and contractors.
Exposed email logins. D.C. law singles out email account credentials. Finding staff logins in a leak lets you reset them and check whether the account was accessed.
Compromised user accounts after an incident. DFARS asks contractors to identify compromised user accounts during their review. Knowing which accounts already appeared in leaks can help focus that work.
Targeted phishing and impersonation. Hacker chatter that names your organization, programs or staff can warn you about campaigns aimed at people with access.
Indicators for your team. Intelligence is most useful when it becomes something your analysts can act on. See where indicators of compromise come from, how nation-state actors use leaked credentials and whether you need a threat intelligence platform.
Teams that map these activities to a framework often use the NIST Cybersecurity Framework, ISO 27001 or SOC 2.
DarkThreat helps with credential leak detection, hacker chatter alerts and automated breach reports for the domains you monitor.
That intelligence supports your incident response, your D.C. breach assessment and any contract reporting. It does not replace them, and no tool makes an organization compliant with D.C. law, DFARS or CMMC.
You can start with a 7-day free trial, and no credit card is required. Paid plans start from $288 per month. See pricing for plan details.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which domains, brands and vendors you need watched.
Yes, in some cases. D.C. Code § 28-3851 defines personal information to include a user name or email address combined with a password, security question and answer, or other means of authentication that permits access to an individual’s email account.
When a breach affects 50 or more District residents. The notice must be made without unreasonable delay and no later than notice to residents, and it cannot be delayed because the total number affected is not yet known.
Possibly both. D.C. breach law applies to personal information of District residents. If your contract includes DFARS 252.204-7012, you must also report cyber incidents affecting covered contractor information systems to DoD within 72 hours of discovery.
No tool can do that. DarkThreat supports the detection side of your security program by helping you find exposed credentials and relevant hacker chatter. Assessments, affirmations and incident reports stay with your security leadership and counsel.
DarkThreat offers a 7-day free trial with no credit card required. Paid plans start from $288 per month. See the pricing page for plan details.
This page summarizes public law and official government guidance for general information. It is not legal advice.
Explore DarkThreat coverage across additional US cities and states.
Join 500+ security teams monitoring 2M+ dark web sources daily. Schedule a demo to see the platform in action.
Setup in under 5 minutes · No agents or software required · Cancel anytime
