A Nunn-McCurdy breach is the legal tripwire that forces the Department of Defense to tell Congress when a major weapons program's cost overruns grow too large to ignore. The law, added to Title 10 of US Code in the early 1980s and named for its sponsors, Senator Sam Nunn and Representative Dave McCurdy, applies to programs designated as major defense acquisition programs (MDAPs), the biggest and most expensive buys in the Pentagon's portfolio.
The mechanism is simple in outline. When a program's unit cost or total program cost grows past a fixed percentage above its original baseline estimate, the service or agency running the program must notify Congress. A breach does not kill a program by itself. It starts a review process, and in the most serious cases it forces the Secretary of Defense to personally certify that the program is worth continuing.
Cost overruns are the trigger for all of it. In plain terms, an overrun is the gap between what a program was promised to cost and what it actually costs. The Cambridge Dictionary defines "defense" in its ordinary sense as protection from attack, but in the budget sense the word covers the machinery of that protection, and that machinery is where overruns land: in the price of a ship, an aircraft, or a satellite system that ends up costing far more than the estimate Congress approved.
What exactly is a Nunn-McCurdy breach?
A breach happens when the current estimate of a program's cost grows past a threshold set in statute, measured against the baseline established when the program entered engineering and manufacturing development. The law sets two levels. A significant breach is a cost growth above the lower threshold. A critical breach is growth above the higher one, and it carries much heavier consequences.
The Pentagon measures this two ways. Program acquisition unit cost tracks the average cost of each unit, such as one aircraft or one ship. Procurement unit cost tracks the cost of producing the hardware, excluding research and development. A breach in either measure can set the notification process in motion.
When a breach occurs, the program office must submit a Selected Acquisition Report, a detailed accounting of the program's costs, schedule and performance. The department then has a fixed window to complete a review and report its findings to Congress. This reporting duty is the point of the law: Congress cannot make informed decisions about weapons funding if the Pentagon keeps cost growth quiet.
What happens after a significant breach?
A significant breach starts with formal notification to Congress. The service or agency must explain the causes of the growth, describe the corrective actions it plans to take, and estimate whether those actions will work. Common causes include immature technology at the start of the program, unrealistic initial estimates, requirements changes, and schedule slips that ripple into higher labor and support costs. Readers following this should also see Civil Service Reform Returns: Schedule Policy/Career and the New Federal Accountability Rules.
Corrective action plans are the standard response. A program office may re-baseline the program, which means resetting the cost and schedule baseline to current reality, or it may restructure, cutting requirements to bring the price down. The Government Accountability Office (GAO), Congress's audit arm, reviews these programs independently and has repeatedly found that optimistic initial estimates are a root cause of later growth.
During the review period, funding for the breached program can be restricted. The department may not proceed with new production contracts until the review concludes, which gives the process real teeth even at the significant level.
What makes a breach critical, and why does it matter more?
A critical breach is the severe tier. Cost growth past the higher threshold means the program cannot continue on its current path without a decision at the very top of the department. The Secretary of Defense must conduct a review of alternatives and then decide, in writing, which of several statutory options to take: terminate the program, restructure it, or continue it with a formal certification.
The certification must state, among other things, that the program is essential to national security, that no cheaper alternative will meet the need, and that the new cost estimate is reasonable. Congress receives this certification, and the program's future funding depends on it. This is the highest-profile form of the process, and critical breaches tend to draw congressional hearings, GAO reviews and press scrutiny.
Historically, most breached programs are not terminated. The certification-and-continue path is the most common outcome for critical breaches, which critics have long read as a sign that the process flags failing programs without changing their fate. Defenders of the law counter that the threat of termination disciplines estimates and gives Congress a documented record it would otherwise never see.
What triggers cost overruns in defense contracts in the first place?
Several causes recur across breached programs, and they are documented in GAO reports and Pentagon reviews rather than guessed at.
- Optimistic baselines. Programs often set their original cost estimates before the design is mature, so early numbers reflect hope more than engineering reality.
- Technology risk. Pushing new technology into production before it is proven drives rework, redesign and schedule growth.
- Requirements churn. When the military service keeps changing what it wants the system to do, every change adds cost.
- Quantity and schedule changes. Stretching production or buying fewer units spreads fixed costs across fewer items, raising the cost of each one.
- Estimating error. Cost analysts work from assumptions, and when those assumptions prove wrong, the estimate does too.
None of these causes is exotic. They are the ordinary failure modes of very large engineering programs, and the Nunn-McCurdy process exists precisely because they are predictable.
What this means for oversight and the budget
Our analysis of the process points to its real function. Nunn-McCurdy does not prevent cost overruns. It documents them, at a fixed point, in a form Congress can act on. The notification creates a paper trail; the certification requirement forces a decision; the Selected Acquisition Report gives auditors the numbers. Readers who follow the broader acquisition debate, including the effort to rewrite the Federal Acquisition Regulation itself, will find the same theme: the rules matter less than whether anyone enforces the record they create. We covered a connected angle in FAR Council's First Overhaul Rules Would Rewrite Federal Acquisition Regulation Entirely.
For the budget, a breach matters most at the moment of re-baselining. When a program's baseline resets upward, the extra money has to come from somewhere, either from other programs in the same service's budget or from a topline increase. That trade is where breached programs touch the rest of the defense budget, and it is why a single critical breach can reshape a service's entire investment plan.
The bottom line for readers tracking a breached program
The evidence established here is procedural: the thresholds exist in statute, the notification and certification duties are mandatory, and the review options are fixed in law. What remains unknown in any given case is the outcome. A breach tells readers that a program's costs have grown past a legal line, not whether the program will survive. The reliable signals to watch are the certification decision, the GAO's independent assessment, and whether the program's next budget request matches the corrected estimate or quietly grows again.
