When there are changes in the project requirements, such as changes in the government's cybersecurity requirements, it is important to manage these changes through a formal change control process1. This process usually involves documenting the change, estimating the effort required to implement the change, modifying the project schedule to include the change, and getting approval from the customer or project sponsor1. In this case, since the design changes can be made at no additional cost, the project manager should direct the team to request a change through the change control process to manage the new cybersecurity requirements1.
References: How to Manage Project Changes and Stay Ahead of the Curve