Lillia J. Damalouji

Lillia (“Lily”) Damalouji is an associate in the Governmental Practice Group in the firm’s Washington, D.C., office and is a member of the firm’s Cybersecurity & Data Protection Team, Commercial Products & Services Team, and Supply Chain Management Team.

Areas of Practice

Lily counsels clients on the full spectrum of government contracting issues to include bid protests before the U.S. Government Accountability Office (“GAO”) and the U.S. Court of Federal Claims, regulatory compliance, and cybersecurity obligations under the FAR, DFARS, and CMMC frameworks.

She also advises clients on issues relating to Federal grant law, including requirements under the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (the Uniform Guidance, 2 C.F.R. Part 200) and program-specific statutory and regulatory conditions imposed by Federal grant programs.

Lily dedicates her pro bono practice to providing legal assistance to military veterans through the National Veterans Legal Services Program.

Previous Experience

Prior to joining Sheppard Mullin, Lily worked for Naval Sea Systems Command (“NAVSEA”) in the agency’s Cyber Engineering and Digital Transformation Directorate where she led enterprise-wide cybersecurity initiatives and digital capabilities to deliver combat power to the fleet.

Lily then transitioned to Program Executive Office Ships, one of the Defense Department’s largest acquisition organizations, where she managed financials for the agency’s then newly-established Common Hull Auxiliary Multi-Mission Platform (“CHAMP”) Program, whose mission is to replace U.S. Navy auxiliary ships approaching the end of service life.

While in law school, Lily was a Research Editor for the George Mason Law Review and a Student Advisor for the Mason Veterans and Servicemembers Legal Clinic, which provides free legal assistance to active duty military personnel and veterans.

Articles

Government Contracts & Investigations Blog Posts

• "Order Up – The First FASCSA Order Has Been Issued by ODNI," September 24, 2025

• "At Long Last – The FAR CUI Rule is Here!," January 29, 2025

• "Countdown to Compliance: DoD Finalizes the CMMC Program Rule," October 15, 2024

• "Government Contractors Beware: The Trap of the Unintended Agency-Level Protest and Timeliness Implications," September 30, 2024

• "The CMMC Rule To Update the DFARS is Here!" August 16, 2024

• "Not an April Fools Joke – FAR Part 40 Final Rule Has Been Published," April 29, 2024

• "CISA Opens Repository for Submission of Software Security Attestation Forms," March 27, 2024
• "Governmental Practice Cybersecurity and Data Protection, 2023 Recap & 2024 Forecast Alert," February 8, 2024

• "Government Contracts Cost and Pricing: Accounting for Unallowable Costs," January 31, 2024

• "Bid Protest Hub – December 2023," January 31, 2024

• "Update: CISA Seeks Additional Input from Software Providers on Security Attestation Form," December 6, 2023

• "Two New Cybersecurity Proposed Rules Mean Big Changes for Federal Contractors," October 4, 2023

• "Challenging Other Transaction Agreements – Navigating the Jurisdictional Highway," September 13, 2023

• "Cybersecurity Labeling is (Almost) Here! Biden Administration Announces the U.S. Cyber Trust Mark Program," August 1, 2023

• "Continuing Skepticism on China: Final Rule Requires Disclosure of Defense Contractor Personnel in China," April 4, 2023

• "In the Interest of National Security – Two New DFARS Rules Reinforce Increased Scrutiny For Chinese-Origin Supply Chains," August 30, 2022

• "NIST Wants Your Input – Updating NIST’s Controlled Unclassified Information (CUI) Guidelines," July 27, 2022
• "DOJ Announces Civil Cyber-Fraud Initiative To Enforce Contractor Cybersecurity Compliance," October 28, 2021
• "Moving to Zero Trust – CISA and OMB Seek Comments on Zero Trust Publications and Cloud Security Technical Reference Architecture under Cybersecurity Executive Order," September 15, 2021
• "Watch Your Boundaries – FedRAMP Releases Draft Authorization Boundary Guidance for Public Comment," July 28, 2021

Privacy & Cybersecurity: Eye on Privacy Blog

• "Cybersecurity Labeling Program to Increase Transparency of IoT Device Security," August 3, 2023

Events