Topic · dfars

DFARS

Defense Federal Acquisition Regulation Supplement — contracting rules for DoD vendors. Use the parent for general DFARS news; use dfars-7012 for the safeguarding/incident-reporting clause specifically.

RSS feed ↗

trade-press
Software sovereignty isn't in any DFARS clause
A Federal News Network commentary defines four pillars of software sovereignty (location, control, toolchain integrity, and isolation) none of which appear in binding DoD procurement rules today.
A Federal News Network opinion piece by a Coder strategic advisor argues that America-first industrial policy has a blind spot: software supply chains. The piece defines software sovereignty as four requirements, code written on U.S.-controlled infrastructure, government-operated servers, U.S.-sourced toolchains, and no foreign-reachable SaaS dependencies. These requirements don't exist in current DFARS supply-chain clauses (252.239-7018 covers IT supply chain risk broadly; Subpart 239.73 addresses covered systems) or in CMMC or FedRAMP. No proposed rulemaking or draft standard from CISA or DoD yet formalizes software-sovereignty mandates. The commentary flags that the SHIPS Act reauthorization defines sovereignty in maritime terms (shipyards, labor, materials) and is silent on where the software that runs a modern destroyer gets developed.
THU
independent
DFARS Consultant-Lobbyist Ban Takes Effect With Rules Unresolved
Contractors now face contract termination and debarment risk under a prohibition whose safe-harbor boundaries DoD has yet to clarify.
The Section 851 prohibition on defense contractors using consultants who lobby for covered foreign entities took effect June 30 via a DFARS class deviation, not formal rulemaking, after DoD abandoned DFARS Case 2025-D0007. The deviation tracks the statutory text and provides no guidance on the safe harbor for legal, audit, and tax compliance services. Contractors must now self-certify under 252.209-7012 without knowing which consultant arrangements qualify.
THU
trade-press
Trump EO tightens foreign-supplier waivers for defense contractors
The move turns supply-chain visibility into a sourcing duty, while the Pentagon still owes contractors the operating instructions.
Defense News reports Trump signed an executive order removing ease of sourcing and cost as grounds for foreign-supplier waivers tied to critical minerals and other prohibited inputs. Primes, subs and other defense contractors seeking waivers must document alternative searches, provenance and domestic transition plans, and risk contract loss if they cannot show progress. The hard part starts where the order stops: the Pentagon has not issued mapping rules, review timelines or a definition of critical systems and materials.
MON
trade-press
CMMC Phase II pause leaves audits likely to return
Schedule relief is real, but the verification problem that created CMMC is still sitting on DoD’s desk.
Breaking Defense reports that Katie Arrington and other industry voices expect DoD’s CMMC Phase II pause to be temporary, with cybersecurity audits likely to return. Defense contractors preparing for assessments get schedule relief, but no exit from compliance. The hard part remains verification: DoD still needs a way to know whether suppliers actually meet the requirements.
JUL 16
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
independent
War Department pushes FOCI onto CUI contractors over $5M
The old clearance boundary is no longer the government’s comfort zone for foreign ownership risk.
The Department of War’s proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule on foreign ownership, control, or influence (FOCI) closed for comment July 6. It would require primes and subs on covered unclassified sensitive work, including controlled unclassified information (CUI), over $5 million to disclose and mitigate FOCI, with award blocked for noncompliance and nearly 40,000 entities affected by DoW’s estimate. Congress is moving in parallel: the Senate Fiscal Year 2027 National Defense Authorization Act would drop the threshold to $500,000, while an undefined commercial-contract national-security override stays loose enough to slow deals.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
regulator
DoD seeks input on DFARS printed circuit board restrictions
DoD is asking before it writes, leaving the real scope inside the future DFARS text.
DoD is seeking information for a Defense Federal Acquisition Regulation Supplement revision to implement fiscal 2021 and 2022 National Defense Authorization Act sections on prohibiting acquisition of covered printed circuit boards from a covered nation. The immediate audience is the DoD acquisition and supplier community tied to PCB procurement. The notice starts the DFARS drafting work; it does not supply the final clause text.
JUL 2
trade-press
Section 851 bars DoD contractors retaining 1260H lobbyists
The statutory deadline beat the DFARS clauses, leaving legal teams to certify a broad ban before DoD explains the mechanics.
Federal News Network reports that Section 851 of the fiscal 2025 National Defense Authorization Act is now in force, requiring DoD contractors to certify they do not retain lobbyists or consultants representing companies on the Pentagon’s Section 1260H Chinese military-company list. Primes, contractors and counsel face loss of current and future DoD eligibility, including debarment, while DoD has not issued the DFARS clauses, audit process, reporting timelines or retroactive diligence rules.
JUN 30
regulator
DoD proposes DFARS certification for recruitment advertising contracts
The operative burden is still undefined: bidders get a certification gate before DoD has specified the certification work.
DoD proposed a Defense Federal Acquisition Regulation Supplement amendment for certain military recruitment advertising contracts, implementing National Defense Authorization Act provisions from fiscal years 2024, 2025 and 2026. Affected offerors and contractors would need to certify compliance to compete for covered work. The proposal leaves the operative details, including the triggering NDAA provisions, compliance content, sunset date and treatment of existing contracts, unresolved.
JUN 25
trade-press
DIA seeks AI procurement prototype for FAR, DFARS workflows
Clause logic is an obvious automation target, but acquisition judgment is where AI can turn paperwork speed into procurement risk.
DefenseScoop reports that the Defense Intelligence Agency issued a June 17 request for information for an artificial intelligence-enabled acquisition platform tied to Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS) and agency processes. White papers are due July 2, and DIA is considering other transaction prototype awards for commercially available tools. Acquisition staff, program offices, counsel and vendors would see the system touch market research, requirements, solicitation drafting, clause recommendations, evaluation workflows and compliance checks. Speed helps only if the clause logic is right.
JUN 22
trade-press
Senate revives 2027 NDAA cost controls and data rights
The Senate is trying the same procurement fight again, with a narrower IP default and earlier price disclosure aimed at contractor leverage.
Federal News Network reports that the Senate’s fiscal 2027 National Defense Authorization Act would restore acquisition reforms dropped from the 2026 deal: 30-day notice for certain cost-plus price jumps above 25% or 50%-over-five-year thresholds, a bar on post-pricing cost data submissions, and government-purpose rights as the default for DoD technical and manufacturing data. Primes and defense-industrial-base contractors get the bill first. The unresolved part is where it matters: timing, exemptions and existing contracts.
JUN 19
judicial
LOGZONE pays $507,144 over Navy DFARS cyber failures
DOJ is converting DFARS control gaps into fraud exposure, which is a different problem than a bad assessment score.
LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve False Claims Act liability for knowingly failing to meet DFARS cybersecurity requirements on Navy contracts. Primes, defense-industrial-base suppliers and counsel should read this as more than a contract compliance miss. DOJ’s Civil Cyber-Fraud Initiative is again treating covered defense information controls as payment-integrity conditions, with no public answer yet on whether any data was compromised.
JUN 18
independent
FY2025 NDAA China consultant restrictions hit DoD contractors June 30
The useful move is not panic; it is checking consultant relationships before procurement counsel inherits a preventable ambiguity.
Covington says China-related prohibitions added by the Fiscal Year 2025 National Defense Authorization Act for defense contractors and their consultants take effect June 30, 2026. The alert is aimed at defense contractors and consultants working with defense-contractor clients. Because the supplied source does not spell out the operative test or penalties, the practical read is narrower: treat this as a contract-review deadline, not as a license for folklore about every China-adjacent engagement.
JUN 18
trade-press
HASC advances government-purpose rights default for DoD contractors
The amendment turns IP protection from a Pentagon access fight into a contractor documentation problem, which is why industry hates it.
The House Armed Services Committee adopted a fiscal 2027 National Defense Authorization Act amendment making government-purpose rights the default for technical data, software and documentation delivered under future Defense Department contracts. Primes and defense-industrial-base suppliers claiming tighter IP restrictions would have to identify each protected item, prove private development funding and document exclusions. The live question is whether the Senate accepts the burden shift after industry killed earlier right-to-repair language.
JUN 5
trade-press
House NDAA moves FASC from OMB to White House, mandates NSA and DoD seats
Three failed attempts in four years to fix the Federal Acquisition Security Council; folding it into the NDAA is Congress signaling it won't wait for OMB to sort itself out.
The Chairman's mark for the fiscal 2027 National Defense Authorization Act, set for a June 4 House Armed Services Committee markup, incorporates the Federal Acquisition Security Council Improvement Act. The bill relocates the FASC from the Office of Management and Budget to the Executive Office of the President, creates a dedicated FASC Program Office, mandates two DoD seats including one filled by the National Security Agency, and adds designated seats for CISA, ONCD, ODNI, FBI, GSA, and NIST. A streamlined process lets Congress itself designate sources of concern and requires the FASC to open investigations into those designations. A nearly identical bill passed the House in 2024 and cleared the Senate Homeland Security Committee but died on the Senate floor in the 118th Congress.
MAY 27