Topic · dfars

DFARS

Defense Federal Acquisition Regulation Supplement — contracting rules for DoD vendors. Use the parent for general DFARS news; use dfars-7012 for the safeguarding/incident-reporting clause specifically.

RSS feed ↗

judicial
Honeywell Aerospace Pays $2.04M to Settle DFARS Cyber FCA Case
The settlement continues DOJ's Civil Cyber-Fraud Initiative string of enforcement actions against defense contractors for cybersecurity noncompliance on federal contracts.
Honeywell Aerospace Inc. agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to comply with cybersecurity requirements in a Department of Defense contract. The DOJ press release does not specify which DFARS controls were at issue or what contract was involved. Honeywell Aerospace was a business segment of Honeywell International Inc. until June 29, when it became a standalone public company. The settlement follows a pattern of CCFI enforcement actions against defense contractors, including the $8.4M Raytheon/Nightwing settlement and the $4.6M MORSECORP settlement earlier this year.
SEP 1
trade-press
Feinberg directs API supply-chain transparency for $10M+ contracts
The third industry-facing directive in three months, it deepens concerns that DoD's compliance demands are undercutting its own industrial-base expansion goals.
Deputy Defense Secretary Steve Feinberg's Aug. 18 memo directs contracting officers to obtain supply-chain cost transparency through APIs on commercial contracts over $10 million, and to establish fair profit margins by product line. Major system providers face stricter Cost and Software Data Reporting requirements. The memo is the latest in a sequence that industry says contradicts Defense Secretary Hegseth's pledge to cut bureaucracy and expand the defense industrial base. "These send a signal that DoD doesn't trust industry," said former acquisition executive David Berteau.
AUG 26
trade-press
CUI rules keep fracturing because the government isn't a business
Former GSA Administrator Emily Murphy says the push for commercial technology runs into procurement requirements that commercial buyers simply don't have.
Former GSA Administrator Emily Murphy told Federal News Network the government's push for commercial technology keeps colliding with the reality that agencies aren't commercial buyers. The fractured CUI landscape illustrates the problem: NIST publishes one standard, but DoD spent a decade building CMMC around it while GSA issued its own procedural guide and the FAR Council's government-wide rule remains unfinished. "We always say we want the government to act more like a business, but at the end of the day, the government isn't a business," Murphy said. The protest rights, cyber requirements, and socioeconomic rules that distinguish federal procurement aren't temporary.
AUG 25
trade-press
PSC renews call for single cyber standard in CMMC reform comments
Seven years and multiple program pauses later, the trade group is still asking why a contractor serving both DoD and DHS faces two different sets of cybersecurity rules.
The Professional Services Council filed comments on the latest CMMC reform proposal, reiterating three longstanding concerns: inconsistent cybersecurity standards across federal agencies, the cost of demonstrating compliance versus actually improving security, and what happens to companies that already earned certifications under prior versions of the program. The consistency argument is the sharpest, a contractor serving both DoD and DHS faces different rules for fundamentally the same work, and PSC has been raising it since CMMC's inception.
AUG 25
trade-press
PSC urges CMMC alignment with NIST 800-171 Rev. 3
The contracting group wants risk-tiered assessments but acknowledges that easing small-business requirements widens the supply-chain attack surface.
The Professional Services Council filed comments Aug. 14 on DoD's CMMC review, asking for alignment with NIST 800-171 Rev. 3, reciprocity with FedRAMP Moderate, and grandfathering of existing Level 2 certifications. The filing also recommends risk-tiered C3PAO assessments, then undercuts its own case, conceding that "sophisticated threat actors routinely target the least-protected organization in a supply chain" and "the sensitivity of CUI does not change based on company size."
AUG 25
independent
TINA Threshold Hits $10M; FAR Still Shows $2.5M
The statutory change is self-executing, and contractors who wait for the FAR Council to catch up risk defective-pricing exposure on every action between $2.5 million and $10 million.
The Truthful Cost or Pricing Data threshold for DoD contracts rose from $2.5 million to $10 million on July 1, 2026, per FY 2026 NDAA Section 1804(c). The statute is operative on its own terms, but FAR 15.403-4 still recites $2.5 million and implementing DFARS rules haven't caught up. Because the change keys to contract date and is not retroactive, the two thresholds coexist for years. Primes and subs must segregate pre- and post-July 1 actions immediately: a modification to a legacy contract still triggers certification at $2.5 million, and misapplying the threshold on a $2.5 million to $10 million deal exposes contractors to downward price adjustment plus interest and potential False Claims Act risk.
AUG 25
trade-press
CMMC architect wants AI to sharpen CUI targeting
Katie Arrington says the standard shouldn't budge, but inconsistent CUI determinations across the defense industrial base are wasting money and leaving real exposure, and AI-assisted triage could fix the mismatch without touching the security bar.
Katie Arrington, who built the CMMC program, argues in a NextGov op-ed that the framework's requirements shouldn't loosen, but its targeting needs sharpening. CUI determinations remain inconsistent across the defense industrial base: some small businesses get assessed for data that isn't really CUI, while others handling sensitive material slide through with lighter requirements. Her fix: use AI to do first-pass sorting of contract language and CUI flow-down, with a human contracting officer making the final call. She also calls for a dedicated SBA loan program to fund cybersecurity investment at small businesses outside the defense supply chain.
AUG 17
trade-press
DoD seeks GAAP-aligned accounting to lower contractor barriers
The CAS Board already scrapped most individual standards. DoD is now asking whether its own business-system audits should follow GAAP and SOX instead.
Acquisition chief Michael Duffey and acting comptroller Michael Powers issued an open letter asking industry for "common sense contract accounting changes" that would align DoD's data and audit requirements with GAAP and Sarbanes-Oxley internal controls companies already maintain. Stakeholders have until Aug. 15 to submit ideas. The request is the latest in a year-long CAS-to-GAAP conformance push (OMB and the Cost Accounting Standards Board eliminated 68 of 72 individual CAS requirements in a July final rule) but DoD's separate DFARS business-system audit framework hasn't yet been touched.
AUG 12
trade-press
DoD’s Anthropic ban fractures across agencies mid-enforcement
Contractors are getting materially different certification demands from different DoD offices: some hewing to the letter of the order, others demanding blanket non-use of Claude.
Five months after the Pentagon designated Anthropic a supply-chain risk, contractors are discovering that enforcement isn't uniform. Different DoD agencies (and even different offices within the same agency) are issuing conflicting certification requests. Some ask only what the active designation requires: no Claude on DoD contracts. Others demand contractors certify they aren't using Claude at all, including on commercial or civilian-agency work. Subcontractors face a compounding problem, with primes sometimes flowing down their own broader checklists rather than the government's actual request. The gap between what the order says and what contracting officers are demanding is now a live liability question.
AUG 11
independent
DoD Guidance Narrows Section 851 Ban to 1260H List
The guidance diverges from the broader definition in the DFARS class deviation, contractors get a narrower compliance target but face two standards that don't align.
DoD published guidance interpreting the Section 851 NDAA FY2025 prohibition on defense contractors retaining consultants tied to Chinese military companies. The guidance ties the ban specifically to entities on DoD's 1260H list, rather than the broader "Chinese military company" definition found in the DFARS class deviation that implemented the prohibition. For contractors, that means vetting consultants against a known list rather than an open-ended category, but the mismatch means both standards are arguably in play, and satisfying one doesn't guarantee satisfying the other.
JUL 31
judicial
Sierra Nevada Company to Pay $7.75M in FCA Cyber Settlement
The latest Civil Cyber-Fraud Initiative enforcement shows DOJ doesn't need a breach to extract millions. A false cybersecurity attestation is treated like a padded invoice.
Sierra Nevada Company has agreed to pay $7.75 million to resolve False Claims Act allegations that it submitted false claims regarding its cybersecurity compliance in federal contract submissions, the U.S. Attorney's Office for the Eastern District of Virginia announced. The settlement fits a now-familiar Civil Cyber-Fraud Initiative pattern, joining ATI-Gallant, MORSECORP, and Raytheon/Nightwing, in which DOJ has extracted millions without alleging any data breach or system compromise. The false attestation alone was the claim.
JUL 28
trade-press
Software sovereignty isn't in any DFARS clause
A Federal News Network commentary defines four pillars of software sovereignty (location, control, toolchain integrity, and isolation) none of which appear in binding DoD procurement rules today.
A Federal News Network opinion piece by a Coder strategic advisor argues that America-first industrial policy has a blind spot: software supply chains. The piece defines software sovereignty as four requirements, code written on U.S.-controlled infrastructure, government-operated servers, U.S.-sourced toolchains, and no foreign-reachable SaaS dependencies. These requirements don't exist in current DFARS supply-chain clauses (252.239-7018 covers IT supply chain risk broadly; Subpart 239.73 addresses covered systems) or in CMMC or FedRAMP. No proposed rulemaking or draft standard from CISA or DoD yet formalizes software-sovereignty mandates. The commentary flags that the SHIPS Act reauthorization defines sovereignty in maritime terms (shipyards, labor, materials) and is silent on where the software that runs a modern destroyer gets developed.
JUL 23
independent
DFARS Consultant-Lobbyist Ban Takes Effect With Rules Unresolved
Contractors now face contract termination and debarment risk under a prohibition whose safe-harbor boundaries DoD has yet to clarify.
The Section 851 prohibition on defense contractors using consultants who lobby for covered foreign entities took effect June 30 via a DFARS class deviation, not formal rulemaking, after DoD abandoned DFARS Case 2025-D0007. The deviation tracks the statutory text and provides no guidance on the safe harbor for legal, audit, and tax compliance services. Contractors must now self-certify under 252.209-7012 without knowing which consultant arrangements qualify.
JUL 23
trade-press
Trump EO tightens foreign-supplier waivers for defense contractors
The move turns supply-chain visibility into a sourcing duty, while the Pentagon still owes contractors the operating instructions.
Defense News reports Trump signed an executive order removing ease of sourcing and cost as grounds for foreign-supplier waivers tied to critical minerals and other prohibited inputs. Primes, subs and other defense contractors seeking waivers must document alternative searches, provenance and domestic transition plans, and risk contract loss if they cannot show progress. The hard part starts where the order stops: the Pentagon has not issued mapping rules, review timelines or a definition of critical systems and materials.
JUL 20
trade-press
CMMC Phase II pause leaves audits likely to return
Schedule relief is real, but the verification problem that created CMMC is still sitting on DoD’s desk.
Breaking Defense reports that Katie Arrington and other industry voices expect DoD’s CMMC Phase II pause to be temporary, with cybersecurity audits likely to return. Defense contractors preparing for assessments get schedule relief, but no exit from compliance. The hard part remains verification: DoD still needs a way to know whether suppliers actually meet the requirements.
JUL 16
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
independent
War Department pushes FOCI onto CUI contractors over $5M
The old clearance boundary is no longer the government’s comfort zone for foreign ownership risk.
The Department of War’s proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule on foreign ownership, control, or influence (FOCI) closed for comment July 6. It would require primes and subs on covered unclassified sensitive work, including controlled unclassified information (CUI), over $5 million to disclose and mitigate FOCI, with award blocked for noncompliance and nearly 40,000 entities affected by DoW’s estimate. Congress is moving in parallel: the Senate Fiscal Year 2027 National Defense Authorization Act would drop the threshold to $500,000, while an undefined commercial-contract national-security override stays loose enough to slow deals.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
regulator
DoD seeks input on DFARS printed circuit board restrictions
DoD is asking before it writes, leaving the real scope inside the future DFARS text.
DoD is seeking information for a Defense Federal Acquisition Regulation Supplement revision to implement fiscal 2021 and 2022 National Defense Authorization Act sections on prohibiting acquisition of covered printed circuit boards from a covered nation. The immediate audience is the DoD acquisition and supplier community tied to PCB procurement. The notice starts the DFARS drafting work; it does not supply the final clause text.
JUL 2
trade-press
Section 851 bars DoD contractors retaining 1260H lobbyists
The statutory deadline beat the DFARS clauses, leaving legal teams to certify a broad ban before DoD explains the mechanics.
Federal News Network reports that Section 851 of the fiscal 2025 National Defense Authorization Act is now in force, requiring DoD contractors to certify they do not retain lobbyists or consultants representing companies on the Pentagon’s Section 1260H Chinese military-company list. Primes, contractors and counsel face loss of current and future DoD eligibility, including debarment, while DoD has not issued the DFARS clauses, audit process, reporting timelines or retroactive diligence rules.
JUN 30
regulator
DoD proposes DFARS certification for recruitment advertising contracts
The operative burden is still undefined: bidders get a certification gate before DoD has specified the certification work.
DoD proposed a Defense Federal Acquisition Regulation Supplement amendment for certain military recruitment advertising contracts, implementing National Defense Authorization Act provisions from fiscal years 2024, 2025 and 2026. Affected offerors and contractors would need to certify compliance to compete for covered work. The proposal leaves the operative details, including the triggering NDAA provisions, compliance content, sunset date and treatment of existing contracts, unresolved.
JUN 25
trade-press
DIA seeks AI procurement prototype for FAR, DFARS workflows
Clause logic is an obvious automation target, but acquisition judgment is where AI can turn paperwork speed into procurement risk.
DefenseScoop reports that the Defense Intelligence Agency issued a June 17 request for information for an artificial intelligence-enabled acquisition platform tied to Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS) and agency processes. White papers are due July 2, and DIA is considering other transaction prototype awards for commercially available tools. Acquisition staff, program offices, counsel and vendors would see the system touch market research, requirements, solicitation drafting, clause recommendations, evaluation workflows and compliance checks. Speed helps only if the clause logic is right.
JUN 22
trade-press
Senate revives 2027 NDAA cost controls and data rights
The Senate is trying the same procurement fight again, with a narrower IP default and earlier price disclosure aimed at contractor leverage.
Federal News Network reports that the Senate’s fiscal 2027 National Defense Authorization Act would restore acquisition reforms dropped from the 2026 deal: 30-day notice for certain cost-plus price jumps above 25% or 50%-over-five-year thresholds, a bar on post-pricing cost data submissions, and government-purpose rights as the default for DoD technical and manufacturing data. Primes and defense-industrial-base contractors get the bill first. The unresolved part is where it matters: timing, exemptions and existing contracts.
JUN 19
judicial
LOGZONE pays $507,144 over Navy DFARS cyber failures
DOJ is converting DFARS control gaps into fraud exposure, which is a different problem than a bad assessment score.
LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve False Claims Act liability for knowingly failing to meet DFARS cybersecurity requirements on Navy contracts. Primes, defense-industrial-base suppliers and counsel should read this as more than a contract compliance miss. DOJ’s Civil Cyber-Fraud Initiative is again treating covered defense information controls as payment-integrity conditions, with no public answer yet on whether any data was compromised.
JUN 18
independent
FY2025 NDAA China consultant restrictions hit DoD contractors June 30
The useful move is not panic; it is checking consultant relationships before procurement counsel inherits a preventable ambiguity.
Covington says China-related prohibitions added by the Fiscal Year 2025 National Defense Authorization Act for defense contractors and their consultants take effect June 30, 2026. The alert is aimed at defense contractors and consultants working with defense-contractor clients. Because the supplied source does not spell out the operative test or penalties, the practical read is narrower: treat this as a contract-review deadline, not as a license for folklore about every China-adjacent engagement.
JUN 18
trade-press
HASC advances government-purpose rights default for DoD contractors
The amendment turns IP protection from a Pentagon access fight into a contractor documentation problem, which is why industry hates it.
The House Armed Services Committee adopted a fiscal 2027 National Defense Authorization Act amendment making government-purpose rights the default for technical data, software and documentation delivered under future Defense Department contracts. Primes and defense-industrial-base suppliers claiming tighter IP restrictions would have to identify each protected item, prove private development funding and document exclusions. The live question is whether the Senate accepts the burden shift after industry killed earlier right-to-repair language.
JUN 5
trade-press
House NDAA moves FASC from OMB to White House, mandates NSA and DoD seats
Three failed attempts in four years to fix the Federal Acquisition Security Council; folding it into the NDAA is Congress signaling it won't wait for OMB to sort itself out.
The Chairman's mark for the fiscal 2027 National Defense Authorization Act, set for a June 4 House Armed Services Committee markup, incorporates the Federal Acquisition Security Council Improvement Act. The bill relocates the FASC from the Office of Management and Budget to the Executive Office of the President, creates a dedicated FASC Program Office, mandates two DoD seats including one filled by the National Security Agency, and adds designated seats for CISA, ONCD, ODNI, FBI, GSA, and NIST. A streamlined process lets Congress itself designate sources of concern and requires the FASC to open investigations into those designations. A nearly identical bill passed the House in 2024 and cleared the Senate Homeland Security Committee but died on the Senate floor in the 118th Congress.
MAY 27