Topic · far

FAR

Federal Acquisition Regulation — civilian-agency contracting rules. Increasingly contains cyber clauses (e.g., the proposed FAR cyber rule).

RSS feed ↗

trade-press
FAR Council opens formal comment window on historic procurement rewrite
Four new proposed rules land with an Oct. 19 deadline, commercial tech firms have one month to shape the acquisition framework that will govern their federal revenue for roughly 30 years.
The FAR Council published four additional proposed rules on Sept. 18, bringing the total to eight of a planned twelve, for the first comprehensive rewrite of the Federal Acquisition Regulation since the 1990s. Comments are due October 19. The overhaul streamlines how agencies buy cloud, software, and AI, removing clause checklists, letting commercial terms drive applicability, and shifting the default away from government-added requirements. Companies that sell technology to the federal government and stay silent risk letting legacy players write the rules for the next three decades.
OCT 13
trade-press
DHS deputy CIO joins CACI subsidiary weeks after $983M award
CACI says it screened Granger and found no conflict, but the Procurement Integrity Act's one-year compensation bar turns on whether the departing official participated in the procurement.
Chris Granger, DHS's deputy CIO, left the department and joined a CACI subsidiary less than two months after the subsidiary won a five-year, $983 million contract to provide desktop support services for DHS's Office of the Chief Information Officer. The Procurement Integrity Act bars former officials from accepting compensation from a contractor for one year post-award when they participated in procurement decisions on contracts over $10 million. CACI told FedScoop it screened Granger for conflicts and that any connection between the award and his hiring "is non-existent." Ethics experts and attorneys consulted by FedScoop didn't say the move was illegal, but several told the outlet the timing raised eyebrows.
OCT 7
trade-press
GSA bypasses rulemaking, binds contractors with AI memo
GSA buried a data-safeguard regime in an internal memo after industry comment stalled the formal rule, sidestepping notice-and-comment while keeping the obligations binding on contractors.
Page 129 of a January memo, signed by GSA Senior Procurement Executive Jeffrey Koses in July with the LLM section added, sets binding safeguards effective Oct. 19. Contractors whose products process government data in large language models can't use that data for training, advertising or resale, must encrypt transmissions and keep audit logs, and face a 120-day disclosure deadline, 72-hour incident reporting, 30-day notice before major model swaps, and deletion of embeddings and fine-tuned weights at closeout. The scope spares back-office LLM use and products where AI is "incidental." GSA tried this route by proposed GSAR rule in March, took industry fire through an August comment window, then moved the package by memo instead.
OCT 3
trade-press
VA OIG finds 435 contract terminations generally followed FAR
The IG confirmed the process generally complied with procurement rules, but the timeline (some staff got hours to review hundreds of contracts) makes "methodical" a stretch.
VA's Office of Inspector General found the agency terminated 435 contracts worth $1.1 billion last year under a compressed, DOGE-driven review, and that contracting officials generally complied with FAR requirements for terminations for convenience. About 86% of the cancelled contracts were for consulting services. VA built procedures to reduce the risk of cutting critical contracts, requiring offices to justify retaining essential ones and assess whether the work could shift to VA employees. In some cases, staff had less than 11 hours to review hundreds of contracts, obtain senior approval, and submit responses.
SEP 25
regulator
FAR Council Opens PRA Comment Window for Overhaul Parts 9, 27, 47
The paperwork burden estimate hasn't been published yet, so contractors are being asked to comment on a number they can't see.
The FAR Council is requesting public comment on the Paperwork Reduction Act information-collection changes tied to FAR Case 2026-011, its proposed overhaul of Parts 9, 27, and 47, covering contractor qualifications, patents and data rights, and transportation. This is a separate process from the proposed rule's own comment period. The PRA notice, published September 23, asks for input on necessity, burden accuracy, and ways to reduce the collection load. The proposed rule itself appeared September 18, running 100 pages and carrying a 60-day comment window that closes October 19, 2026.
SEP 23
trade-press
Second FAR Overhaul Tranche Lands With a 30-Day Clock
1,650 pages of proposed rules covering Parts 9, 14, 27, 28, 36, 47, and 52, and the comment window barely stretches past fiscal year-end closeout.
The FAR Council dropped three proposed rules on September 18 covering seven FAR parts, the second tranche in a planned 12-rule sequence under the Revolutionary FAR Overhaul. Comments are due October 19, a 30-day window that leaves contractors roughly two working weeks after the fiscal year closes to digest the changes. The package follows the first tranche published June 23, which covered Parts 1, 2, 4, 33, 39, 40, and 53. The RFO implements Executive Order 14275 and OMB Memo M-25-26, stripping non-statutory text from the FAR and rewriting what remains in plain language. Former GSA administrator Emily Murphy told Federal News Network the latest release is roughly 1,650 pages.
SEP 22
independent
NDAA provisions would make GPR the default for DoD technical data
For the first time, a bill would flip the burden: contractors must prove by clear and convincing evidence why internally funded technology shouldn't carry Government Purpose Rights, and the standard is higher than the preponderance rule that governs most civil disputes.
FY 2027 NDAA provisions moving through the House and Senate would make Government Purpose Rights the default license for technical data and computer software delivered under future DoD contracts, subcontracts, and other transaction agreements. Contractors seeking more restrictive rights would bear the burden of identifying every affected deliverable and substantiating the basis for restrictions by clear and convincing evidence, a higher bar than the preponderance standard that governs most civil disputes. Every proposal would need a compliant assertions table, deliverable by deliverable; every subcontract would flow the same requirement down. The legislation goes well beyond repair access, reaching internally funded commercial and dual-use technology that contractors currently protect with Limited or Restricted Rights.
SEP 22
trade-press
FAR Council Rewrites Part 15 Negotiations, Part 12 Commercial Buying
The shift from "discussions" to "negotiations" is the most consequential competitive-procurement rewrite in decades, and the proposed rule doesn't resolve whether multiple competitive ranges or late-stage re-entries open new bid protest exposure.
The FAR Council released proposed rule FAR Case 2026-003, restructuring Part 12 (commercial buying), Part 15 (competitive procurements), and related parts to emphasize negotiations, streamlined deficiency definitions, and commercial market practices. The Part 15 rewrite shifts the default from discussions (where agencies pointed out flaws so bidders could fix them) to negotiations aimed at improving the deal for both sides. The proposal also opens the door to keeping lower-ranked proposals in the competitive range. Comments are due October 19, 2026. This is the second major tranche of the Revolutionary FAR Overhaul under EO 14275; eight of twelve proposed rules are now published.
SEP 21
regulator
FAR Council Proposes Overhaul of Parts 14, 28, 36, and 52
The proposed rule is the latest tranche in the Revolutionary FAR Overhaul, but the Federal Register notice is light on clause-level line-out, contractors need the full text to know what actually changes.
The FAR Council proposed amendments to FAR parts 14 (Sealed Bidding), 28 (Bonds and Insurance), 36 (Construction and Architect-Engineer Contracts), and 52 (Solicitation Provisions and Contract Clauses) on September 18, implementing Executive Order 14275's mandate to strip non-statutory content from the FAR. The Part 14 rewrite has been in motion since at least September 2025, when the Council released model deviation text preserving only statutory requirements, agencies including DoD and the Udall Foundation adopted class deviations shortly after. The proposed rule extends that pruning approach to the other three parts. Specific clause retentions and deletions aren't surfaced in the notice; contractors will need to review the full proposed text to assess the impact on their existing compliance structures.
SEP 18
trade-press
Navy's $1.4B Microsoft BPA faces bid-protest survival
The Court of Federal Claims kept Minburn's protest alive by distinguishing challenges to an agency's evaluation from claims that a bidder misrepresented its qualifications, a line that matters far beyond this procurement.
The Court of Federal Claims preserved a bid protest over the Navy's $1.4 billion blanket purchase agreement for Microsoft software, awarded to Dell Federal in May 2026. Minburn Technology Group argued the Navy's evaluation was arbitrary and that Dell materially misrepresented its GSA schedule coverage, alleging Dell's price list said full product lists were "available upon request" rather than demonstrating all required Microsoft SKUs were on its schedule contract. The court drew a distinction between challenges to the agency's evaluation and claims of bidder misrepresentation.
SEP 17
trade-press
BSA backs CISA reauthorization in House NDAA, flags three amendments
The software trade group's letter supports NIST-aligned vulnerability disclosure rules and a FedRAMP reciprocity pilot, while opposing provisions it says could sweep in routine commercial practices.
BSA (The Business Software Alliance) released an August 27 letter to Armed Services and party leaders backing CISA 2015's nine-year reauthorization through fiscal 2035, along with House NDAA provisions on FedRAMP reciprocity, vulnerability disclosure aligned to NIST guidelines, and post-quantum cryptography mandates. The letter also flags three House amendments it opposes or finds problematic: one on software-based cryptographic protections that BSA says conflicts with commercial cloud key-management architectures, one barring DoD contracts with providers that give advance vulnerability disclosure to countries-of-concern entities, and a third adding a 72-hour reporting deadline for discovering Chinese-linked hardware in contractor networks.
SEP 15
independent
CAS Board Doubles Full-Coverage Threshold to $100M
The rule relieves 200-plus contractors of full CAS, but single-award IDC holders may find themselves pulled in rather than let out.
The CAS Board published two final rules September 1, effective October 1, that double the full-coverage threshold from $50M to $100M, raise the basic coverage threshold from $2.5M to $35M, and eliminate the trigger-contract framework. The Board also rescinded CAS 407, which governed standard-cost accounting for direct material and direct labor. More than 200 entities stand to shed full CAS obligations. But the rules cut both ways: single-award IDCs will now be assessed for CAS applicability at the ceiling value, not the task-order level, meaning some contractors will face full CAS on vehicles they'd structured to stay under the old threshold.
SEP 1
regulator
OMB Raises Cost Accounting Standards Thresholds, Clarifies IDC Rules
For contractors near the line, the new numbers mean the difference between CAS-covered and exempt, and the IDC guidance answers a question that's been unsettled for years.
OMB's Cost Accounting Standards Board published a final rule increasing CAS monetary thresholds and clarifying how exemptions apply to indefinite delivery contracts. Contractors whose negotiated contract values previously triggered CAS coverage may now fall below the updated thresholds. The IDC clarification addresses whether exemptions are evaluated at the task-order level or against aggregate contract value, a distinction that determines whether a contractor faces CAS compliance obligations at all. The rule also increases agency waiver authority thresholds.
SEP 1
trade-press
NRO presses primes to map sub-tier supply chain risks
The three-year-old NRO FAR Supplement clause asks contractors to illuminate, not eliminate, supply chain risk, and the agency grades itself a B-minus.
The NRO has been embedding a supply chain risk visibility clause in its FAR supplement for three years, Director for Systems Engineering Darwyn Banks disclosed at an INSA webinar. The clause requires prime contractors and second-tier subs to map their vendors and suppliers, not to eliminate risk, but to illuminate it. Banks gave the program a B-minus, calling the effort a long-term expectation rather than a one-off initiative.
AUG 25
trade-press
PSC urges CMMC alignment with NIST 800-171 Rev. 3
The contracting group wants risk-tiered assessments but acknowledges that easing small-business requirements widens the supply-chain attack surface.
The Professional Services Council filed comments Aug. 14 on DoD's CMMC review, asking for alignment with NIST 800-171 Rev. 3, reciprocity with FedRAMP Moderate, and grandfathering of existing Level 2 certifications. The filing also recommends risk-tiered C3PAO assessments, then undercuts its own case, conceding that "sophisticated threat actors routinely target the least-protected organization in a supply chain" and "the sensitivity of CUI does not change based on company size."
AUG 25
independent
TINA Threshold Hits $10M; FAR Still Shows $2.5M
The statutory change is self-executing, and contractors who wait for the FAR Council to catch up risk defective-pricing exposure on every action between $2.5 million and $10 million.
The Truthful Cost or Pricing Data threshold for DoD contracts rose from $2.5 million to $10 million on July 1, 2026, per FY 2026 NDAA Section 1804(c). The statute is operative on its own terms, but FAR 15.403-4 still recites $2.5 million and implementing DFARS rules haven't caught up. Because the change keys to contract date and is not retroactive, the two thresholds coexist for years. Primes and subs must segregate pre- and post-July 1 actions immediately: a modification to a legacy contract still triggers certification at $2.5 million, and misapplying the threshold on a $2.5 million to $10 million deal exposes contractors to downward price adjustment plus interest and potential False Claims Act risk.
AUG 25
trade-press
230 firms warn GSA AI clause would block open-source models
The flowdown liability framework forces contractors to police model publishers they can't control, putting GSA procurement in direct collision with the White House's open-ecosystem priorities.
GSA's revised AI procurement rule still imposes flowdown requirements that would functionally exclude open-source and third-party AI from GSA contract vehicles. Over 75 industry comments show June's revisions haven't resolved the core problem: the clause puts contractors on the hook for model behavior they can't control. Palantir urged withdrawal; Microsoft warned the terms could deter commercial AI providers from GSA deals entirely. The pushback coincides with a 230-company letter (Meta, Google, OpenAI, Nvidia among them) arguing open-weight models are essential to U.S. AI leadership, setting up an early collision between the administration's deregulatory AI posture and federal procurement gatekeeping.
AUG 20
trade-press
Palantir urges GSA to withdraw draft LLM acquisition rule
Palantir's legal argument that GSA lacks independent authority under the major questions doctrine is one no other contractor has been willing to make publicly, even as they urge substantial revisions.
Palantir has called on GSA to withdraw its draft large language model acquisition rule entirely, arguing through law firm Freshfields that the agency lacks independent authority to finalize it and that the proposed clause would violate the Federal Acquisition Streamlining Act. The company warned the rule would push agencies toward non-GSA contract vehicles, undermining the administration's procurement consolidation goals. Palantir's position stands alone: a Nextgov/FCW review of public comments shows the rest of industry (including CCSGP, BSA, PSC, and ITI) is focused on narrowing scope and clarifying definitions, not killing the rule.
AUG 6
trade-press
OMB asks Congress to raise simplified acquisition threshold to $10M
The micropurchase threshold would hit $100,000 by 2030, shifting over 100,000 transactions out of full compliance and small-business set-aside rules.
OMB sent Congress 20 acquisition-reform proposals in July, headlined by a phased increase of the simplified acquisition threshold to $10 million for commercial products and services by September 2030. The micropurchase threshold would climb to $100,000 on the same timeline, decoupling from Buy American Act requirements above $15,000. The package also includes task-order protest threshold parity, permanent Commercial Solutions Openings authority for GSA and DHS, and acquisition workforce training funds. Several proposals have been submitted before; the thresholds and the move to a unitary acquisition framework across CFO Act agencies are drawing the most industry attention.
JUL 31
trade-press
FedRAMP certifies that clouds are safe, not that they interoperate
FedRAMP certifies clouds as safe but not interoperable, and fifteen years of modernization have turned that gap into a structural barrier to mission collaboration.
NASA's Artemis II mission ran on PDFs and manual version-tracking. Contractor-to-contractor procedures didn't move directly between Boeing, Lockheed, Airbus, and Northrop Grumman. Every document flowed through the agency, red-lined and reconciled in meetings where someone read line numbers aloud. The culprit isn't just procurement inertia. FedRAMP certifies that a cloud is safe to use; it does not certify that two clouds can talk to each other. Fifteen years of cloud modernization replaced a human coordination problem with a technical and contractual architecture in which sharing data across boundaries is structurally harder than it was before.
JUL 27
trade-press
Chamber Challenges Immediate 800-171 Rev. 3 Mandate in FAR CUI Rule
The absence of a phase-in period is operationally infeasible for most of the 67,000 affected contractors and may expose the rule to legal challenge under the Administrative Procedure Act, the Chamber argues.
The U.S. Chamber of Commerce filed comments opposing the FAR Council's proposed CUI rule, which would require contractors to comply with NIST SP 800-171 Rev. 3 immediately upon contract insertion with no phase-in period. The filing argues this is operationally infeasible for roughly 67,000 unique entities and more than 2 million private-sector employees, most of whom have never been subject to the 800-171 framework. The Chamber warns the absence of a phase-in period may render the rule vulnerable under the Administrative Procedure Act if the FAR Council cannot demonstrate that immediate compliance is feasible across the entire civilian contractor base.
JUL 24
trade-press
FAR cuts 3,000 mandates as procurement chief tells agencies: use discretion
The 3,000-cut tally gets the headlines, but the operational shift from "find the rule that permits it" to "find the rule that forbids it" is what changes Monday morning.
The White House's FAR overhaul has removed roughly 3,000 non-statutory mandates and cut the regulation by about 25%, OFPP Administrator Kevin Rhodes said Thursday at Carahsoft's FedRAMP Summit. The slimmed-down rulebook flips the default posture of federal procurement: if the FAR doesn't say you can't do something, contracting officers should consider it. The shift from compliance-checklist buying to delivery-focused acquisition will take years. "Five years from now," Rhodes said, "we're going to have people that are executing and delivering on the mission."
JUL 23
trade-press
House passes FIT Procurement Act to raise buying thresholds
The operational change is still hypothetical because agencies get faster buying only if the Senate takes up a bill it already let die.
The House passed the Federal Improvement in Technology Procurement Act, HR 4123, under suspension of rules Monday, FedScoop reports. The bill would raise the micro-purchase threshold from $10,000 to $25,000, lift the simplified acquisition threshold from $250,000 to $500,000 and allow advance payments for cloud services. Contracting officers and technology vendors would benefit from faster low-dollar buying, but there is no current Senate companion after last Congress’s version stalled there.
JUL 21
trade-press
Senators press OFPP on delayed FAR conflict rule
Disclosure duties are coming, but contractors still do not know what interests must be reported or when the clock starts.
Sens. Gary Peters, Chuck Grassley, Joni Ernst and Maggie Hassan asked Office of Federal Procurement Policy Administrator Kevin Rhodes for a timeline to update the Federal Acquisition Regulation under Public Law 117-324. The FAR Council has drafted a proposed rule, FedScoop reports, but the Preventing Organizational Conflicts of Interest in Federal Acquisition Act’s June 2024 deadline is nearly two years gone. Primes, contractors and CMMC Third Party Assessment Organizations are left waiting on the actual disclosure categories.
JUL 21
independent
FAR Council squeezes termination settlements to 90 days
The proposal buys faster closeout by making contractors choose between thin support, late filings and False Claims Act exposure.
The FAR Council proposed cutting the deadline for termination settlement proposals from one year to 90 days while leaving the underlying support burden intact. Primes, subcontractors and counsel would have to collect cost data, address inventory, develop profit positions and resolve subcontractor claims on a compressed clock. The efficiency case is obvious. So is the litigation risk if contractors pad estimates or file before the record is ready.
JUL 20
trade-press
GSA AI clause would box out open models, BSA says
A provenance test built for closed models can turn security hygiene into procurement favoritism without saying the word ban.
Business Software Alliance told the General Services Administration that its revised artificial intelligence (AI) acquisition clause still functions as an open-source restriction, even after GSA narrowed a broader foreign-component ban to allow incidental foreign-developed components under conditions. Primes, AI contractors and agencies face the practical problem: tracing model lineage, ownership and foreign control can be infeasible for open models. Comments close Aug. 3, and the final wording may decide whether cheaper open-weight options survive federal procurement.
JUL 20
independent
FAR Council consolidates supply-chain, CUI rules in Part 40 proposal
Putting CUI safeguarding in the FAR itself changes the compliance map more than the clause numbering suggests.
The FAR Council's June 23, 2026 Part 40 proposal would pull supply-chain security restrictions from FAR Parts 4, 25 and 40 into one structure, add FAR-wide Controlled Unclassified Information obligations, impose a uniform reasonable-inquiry standard, and set a 72-hour reporting window for supply-chain violations. Primes, subs and counsel get a central hub, but not yet a settled answer on how agency-specific CUI clauses will run alongside it.
JUL 13
trade-press
OMB cuts 68 Cost Accounting Standards requirements, lifts threshold to $35M
The lower-barrier contracting agenda gets real when half the covered contractor pool can stop maintaining duplicate books.
Federal News Network reports that OMB and the Cost Accounting Standards Board rescinded 68 of 72 Cost Accounting Standards (CAS) requirements and raised the annual federal contract-value threshold to $35 million from $2.5 million, effective August 7, 2026. OMB says about half of CAS-covered contractors exit the regime; primes, subs and auditors still above the line get fewer allocation rules, not a free pass.
JUL 10
independent
GSA weighs Buy American labels for GSA Advantage
Domestic sourcing becomes a search-ranking problem, and the data burden lands on contractors and manufacturers before purchase decisions.
The General Services Administration's June 24 Request for Information, citing Executive Order 14392, asks for July 24 comments on two GSA Advantage ideas: voluntary Buy American Act component-test representations that would trigger an icon and higher search placement, and a new original equipment manufacturer-only Special Item Number for selected categories. GSA Advantage contractors, resellers, manufacturers and federal buyers get no immediate mandate. After the Small Business Administration and GSA delisted 22 offerings over false Made in America representations, the catalog label carries certification risk.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
trade-press
GSA narrows AI safeguarding clause for schedules and GWACs
The first GSA-wide AI guardrail now depends on whether subcontractor commitments can be verified beyond prime-contractor attestations.
Federal News Network reports that GSA reissued its AI safeguarding draft regulations on June 17, narrowing the March version, scheduling a July 14 listening session and taking comments through Aug. 3. The clause would reach schedules and governmentwide acquisition contracts (GWACs), forcing primes, subs, contractors and CMMC Third-Party Assessment Organizations (C3PAOs) advising them to parse data-ownership limits, large language model (LLM) role definitions, flow-down clauses and attestation mechanics. The unresolved test is whether subcontractor AI accountability becomes enforceable.
JUL 7
trade-press
GSA FAS puts resellers under pricing scrutiny
The reorg’s polite promise of consistency now comes with a harder demand: show the government exactly what value the reseller adds.
Federal News Network’s industry-day account says the General Services Administration’s Federal Acquisition Service is pairing procurement consolidation with tighter pricing, supply-chain and transaction-data expectations. Value-added resellers face the clearest change: FAS said it will judge value as services provided, scrutinize line-item pricing and seek detailed descriptions of value-added work, without centering markup disclosures. Schedule vendors also may see reseller channels shift under GSAR 538.7102-1(e) order-placement guidance.
JUL 2
trade-press
FAR Council proposes civilian CUI rule after 15-year gap
The proposal replaces agency improvisation with a contract-marking regime, then gives industry 30 days to parse the buried rewrite.
Federal News Network reports the FAR Council has proposed a government-wide controlled unclassified information (CUI) rule for civilian agencies, built around a standard form and contracting officer directions for identifying and marking CUI. Contractors, primes and subs would get one baseline for scope and flowdown; Cybersecurity Maturity Model Certification (CMMC) third-party assessment organizations (C3PAOs) will have to track the NIST SP 800-171 Revision 3 split from CMMC’s Revision 2 work. The rule still arrives inside the larger FAR overhaul with 30 days for comment, and its effective date and existing-contract treatment remain unresolved.
JUL 1
trade-press
FAR Council gives contractors 30 days on 223,000-word rewrite
A shorter FAR may still leave contractors doing more judgment calls under less time to shape the final text.
Federal News Network reports the FAR Council has opened the first phase of formal rulemaking on the FAR overhaul: 12 proposed rules touching more than 20 parts and running 223,000 words, with comments due in 30 days. Primes, contractors and counsel now have a compressed window to find substantive changes in contract structure, CUI procedures and supply-chain provisions before rules the government wants finalized this year.
JUN 30
trade-press
FAR rewrite leaves CUI confusion intact
Consolidating clauses helps buyers find the rules; it does not tell contractors when agencies have triggered them.
Government Executive says the Federal Acquisition Regulation rewrite has not solved contractors’ recurring problem with controlled unclassified information: inconsistent agency implementation and unclear triggering facts. The FAR overhaul may consolidate information security and supply-chain provisions, but Executive Order 13556, National Archives and Records Administration CUI rules, NIST SP 800-171 and Cybersecurity Maturity Model Certification still sit outside that cleanup. The affected reader is not the policy shop. It is the bidder pricing cyber work before the solicitation tells them what data they will actually touch.
JUN 25
trade-press
White House PQC order turns market edge into FAR requirement
The useful private-sector signal now becomes a procurement filter, which is where federal cyber transitions stop being aspirational.
A June 22 White House executive order moves federal high-value assets and high-impact systems to post-quantum cryptography for key establishment by December 31, 2030, and digital signatures by December 31, 2031, with Federal Acquisition Regulation changes coming for contractors. R Street’s Mark Dalton told Inside Cybersecurity the private-sector race on quantum-safe products can speed the transition, but the hard part is funding agencies and writing contract language that vendors can actually build against.
JUN 25
regulator
FAR Council opens PRA comments on FAR overhaul parts
The useful work is burden math: pricing the reporting, documentation, and attestation hours before OMB numbers set expectations.
The Federal Acquisition Regulatory Council opened Paperwork Reduction Act comments for FAR Case 2026-001, covering Revolutionary FAR Overhaul Parts 1, 2, 4, 33, 39, 40, and 53. Primes, contractors, and MSPs should map the affected information collections and submit comments on necessity, practical utility, burden estimates, clarity, and ways to reduce respondent burden through automation or other information technology.
JUN 25
trade-press
GAO blames FAR gaps for $10B cloud procurement sprawl
Agencies are buying modern cloud services through a rulebook that still cannot define the thing being bought.
GAO found that outdated Federal Acquisition Regulation language, conflicting Office of Management and Budget and National Institute of Standards and Technology guidance, and weak procurement data are slowing cloud acquisition across 24 agencies. Primes and agency counsel are still bidding and drafting around undefined cloud terms as annual federal cloud contract spending tops $10 billion. GAO names the awkward part: the procurement rulebook has aged more slowly than the market it governs.
JUN 23
regulator
FAR Council targets eight FAR parts under EO 14275
For CMMC readers, the important fact is the missing one: the proposal does not say which security obligations survive.
The FAR Council proposed amendments to FAR parts 1, 2, 4, 33, 39, 40, 52 and 53 to implement Executive Order 14275’s directive to eliminate excessive acquisition regulations. Primes, subcontractors, contractors and C3PAOs may see procurement compliance burdens reduced, but the proposal does not define any Cybersecurity Maturity Model Certification thresholds, security flowdown changes, cost impact or final-rule timing.
JUN 23
regulator
FAR Council targets eight FAR parts under Executive Order 14275
The compliance risk is premature certainty, because cyber clauses, reporting duties, and flow-downs still lack a clause-level survival map.
The Federal Acquisition Regulatory Council would revise Federal Acquisition Regulation (FAR) parts 1, 2, 4, 33, 39, 40, 52, and 53 under Executive Order 14275, Restoring Common Sense to Federal Procurement, as part of a 12-rule streamlining. Primes, contractors, and subs face uncertainty before relief: cyber clauses, incident reporting timelines, and flow-down obligations still need a clause-level survival map before anyone changes compliance strategy.
JUN 23
trade-press
FAR overhaul pushes CUI, FedRAMP clauses into rulemaking
This is not one procurement cleanup; it is three contractor security programs being rewritten on the same track.
FedScoop reports that four proposed Federal Acquisition Regulation rules, totaling more than 1,000 pages, are set for Federal Register publication and would revise 20 FAR sections for the first major update in 40 years. Primes, subs and contractors would face 72-hour cyber incident reporting, controlled unclassified information safeguarding changes, and at least a FedRAMP Moderate baseline when CUI sits in the cloud. Comments run through July 23, but the final schedule and phase-in remain unresolved.
JUN 22
trade-press
DIA seeks AI procurement prototype for FAR, DFARS workflows
Clause logic is an obvious automation target, but acquisition judgment is where AI can turn paperwork speed into procurement risk.
DefenseScoop reports that the Defense Intelligence Agency issued a June 17 request for information for an artificial intelligence-enabled acquisition platform tied to Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS) and agency processes. White papers are due July 2, and DIA is considering other transaction prototype awards for commercially available tools. Acquisition staff, program offices, counsel and vendors would see the system touch market research, requirements, solicitation drafting, clause recommendations, evaluation workflows and compliance checks. Speed helps only if the clause logic is right.
JUN 22
trade-press
FAR Council opens 17-part rewrite for July comments
The rulemaking window is the contractor community’s real leverage point, and it is short by design.
Federal News Network reports that the Federal Acquisition Regulatory Council will publish proposed rules for 17 Federal Acquisition Regulation parts, moving Trump’s FAR overhaul from agency deviations into formal rulemaking with comments due by mid-July. Contractors, primes, subcontractors and managed service providers have one compressed chance to press changes on competition, acquisition planning, IT buying, protests and socioeconomic-program language before officials try to finalize the rules by year-end.
JUN 22
trade-press
Senate bill pushes OTA awards onto USASpending.gov
Speed has been the selling point for other transaction agreements; invisibility was never supposed to be part of the bargain.
Federal News Network reports the Senate passed the Stop Secret Spending Act from Sens. James Lankford, Joni Ernst and Gary Peters, requiring agencies to disclose other transaction agreement awards on USASpending.gov. Contractors chasing non-Federal Acquisition Regulation deals would get more visibility into awards that often move through paid consortiums. The Senate’s fiscal 2027 NDAA includes a similar OTA disclosure provision, though the House version does not.
JUN 18
trade-press
GSA gives contracting officers more discretion under RFO
The operational test is whether training and shared guidance can keep judgment from turning into uneven procurement records.
GSA’s Nick West told Federal News Network the agency is using training, AI tools and the Revolutionary FAR Overhaul’s FAR Companion to reduce contracting officers’ paperwork load and clarify what is required versus discretionary. Contracting officers gain room to plan, engage industry and document judgment. The obvious tension is consistency: discretion helps only if new hires and reviewers can see the same reasoning trail.
JUN 17
regulator
GSA opens comments on GSAR LLM data safeguard clause
GSA is using acquisition plumbing to define basic LLM data safeguards before choosing a deviation or formal rulemaking.
The General Services Administration (GSA) published a Federal Register notice seeking comments on a draft General Services Administration Acquisition Regulation (GSAR) clause for basic safeguarding of data within large language model artificial intelligence systems (LLMs). The notice frames the clause as pre-decisional: GSA wants stakeholder feedback because the issue is complex before it takes future action, including a possible deviation or formal rulemaking. For now, stakeholders have a comment record rather than final contract language.
JUN 17
trade-press
Contractors face CMMC, fixed-price squeeze across federal market
The risk shift is not theoretical when small businesses must certify cybersecurity and document hours before invoices move.
Federal News Network’s interview with Barbara Kinosky frames the last 18 months of acquisition changes as a combined squeeze on contractors: mandatory Cybersecurity Maturity Model Certification, changes to small-business set-asides and fixed-price contracting as the default. Kinosky said small businesses are absorbing new compliance cost, while some fixed-price work now requires time cards and invoice-level proof of hours before payment.
JUN 16
trade-press
NIH sunsets NITAAC GWACs as GSA absorbs IT buying
The collapse of CIO-SP4 has become a procurement routing change, with agencies steered toward GSA by 2028.
According to a notice reported by FedScoop, the NIH Information Technology Acquisition and Assessment Center (NITAAC) will stop new orders on CIO-SP3, CIO-SP3 Small Business and CIO-CS on Oct. 29, with new orders now capped at Dec. 31, 2028. Agencies and vendors using those governmentwide acquisition contracts (GWACs) are being pushed toward the General Services Administration (GSA). CIO-SP4’s canceled $50 billion successor fight left a simpler result: GSA gets the work.
JUN 11
trade-press
House Small Business Committee advances HR 2804 to codify Rule of Two
Codification protects the baseline rule while leaving the task-order discretion that drives speed in day-to-day agency buying.
Former GSA Administrator Emily Murphy told Federal News Network that HR 2804, the Protecting Small Business Competitions Act of 2025, cleared the House Small Business Committee by voice vote and would put the small-business Rule of Two into statute. As marked up, the bill applies to contracts but no longer extends the requirement to task and delivery orders above the simplified acquisition threshold. Small businesses get a statutory floor; contracting officers keep task-order discretion.
JUN 3
trade-press
House NDAA moves FASC from OMB to White House, mandates NSA and DoD seats
Three failed attempts in four years to fix the Federal Acquisition Security Council; folding it into the NDAA is Congress signaling it won't wait for OMB to sort itself out.
The Chairman's mark for the fiscal 2027 National Defense Authorization Act, set for a June 4 House Armed Services Committee markup, incorporates the Federal Acquisition Security Council Improvement Act. The bill relocates the FASC from the Office of Management and Budget to the Executive Office of the President, creates a dedicated FASC Program Office, mandates two DoD seats including one filled by the National Security Agency, and adds designated seats for CISA, ONCD, ODNI, FBI, GSA, and NIST. A streamlined process lets Congress itself designate sources of concern and requires the FASC to open investigations into those designations. A nearly identical bill passed the House in 2024 and cleared the Senate Homeland Security Committee but died on the Senate floor in the 118th Congress.
MAY 27