Topic · far

FAR

Federal Acquisition Regulation — civilian-agency contracting rules. Increasingly contains cyber clauses (e.g., the proposed FAR cyber rule).

RSS feed ↗

independent
CAS Board Doubles Full-Coverage Threshold to $100M
The rule relieves 200-plus contractors of full CAS, but single-award IDC holders may find themselves pulled in rather than let out.
The CAS Board published two final rules September 1, effective October 1, that double the full-coverage threshold from $50M to $100M, raise the basic coverage threshold from $2.5M to $35M, and eliminate the trigger-contract framework. The Board also rescinded CAS 407, which governed standard-cost accounting for direct material and direct labor. More than 200 entities stand to shed full CAS obligations. But the rules cut both ways: single-award IDCs will now be assessed for CAS applicability at the ceiling value, not the task-order level, meaning some contractors will face full CAS on vehicles they'd structured to stay under the old threshold.
SEP 1
regulator
OMB Raises Cost Accounting Standards Thresholds, Clarifies IDC Rules
For contractors near the line, the new numbers mean the difference between CAS-covered and exempt, and the IDC guidance answers a question that's been unsettled for years.
OMB's Cost Accounting Standards Board published a final rule increasing CAS monetary thresholds and clarifying how exemptions apply to indefinite delivery contracts. Contractors whose negotiated contract values previously triggered CAS coverage may now fall below the updated thresholds. The IDC clarification addresses whether exemptions are evaluated at the task-order level or against aggregate contract value, a distinction that determines whether a contractor faces CAS compliance obligations at all. The rule also increases agency waiver authority thresholds.
SEP 1
trade-press
NRO presses primes to map sub-tier supply chain risks
The three-year-old NRO FAR Supplement clause asks contractors to illuminate, not eliminate, supply chain risk, and the agency grades itself a B-minus.
The NRO has been embedding a supply chain risk visibility clause in its FAR supplement for three years, Director for Systems Engineering Darwyn Banks disclosed at an INSA webinar. The clause requires prime contractors and second-tier subs to map their vendors and suppliers, not to eliminate risk, but to illuminate it. Banks gave the program a B-minus, calling the effort a long-term expectation rather than a one-off initiative.
AUG 25
trade-press
PSC urges CMMC alignment with NIST 800-171 Rev. 3
The contracting group wants risk-tiered assessments but acknowledges that easing small-business requirements widens the supply-chain attack surface.
The Professional Services Council filed comments Aug. 14 on DoD's CMMC review, asking for alignment with NIST 800-171 Rev. 3, reciprocity with FedRAMP Moderate, and grandfathering of existing Level 2 certifications. The filing also recommends risk-tiered C3PAO assessments, then undercuts its own case, conceding that "sophisticated threat actors routinely target the least-protected organization in a supply chain" and "the sensitivity of CUI does not change based on company size."
AUG 25
independent
TINA Threshold Hits $10M; FAR Still Shows $2.5M
The statutory change is self-executing, and contractors who wait for the FAR Council to catch up risk defective-pricing exposure on every action between $2.5 million and $10 million.
The Truthful Cost or Pricing Data threshold for DoD contracts rose from $2.5 million to $10 million on July 1, 2026, per FY 2026 NDAA Section 1804(c). The statute is operative on its own terms, but FAR 15.403-4 still recites $2.5 million and implementing DFARS rules haven't caught up. Because the change keys to contract date and is not retroactive, the two thresholds coexist for years. Primes and subs must segregate pre- and post-July 1 actions immediately: a modification to a legacy contract still triggers certification at $2.5 million, and misapplying the threshold on a $2.5 million to $10 million deal exposes contractors to downward price adjustment plus interest and potential False Claims Act risk.
AUG 25
trade-press
230 firms warn GSA AI clause would block open-source models
The flowdown liability framework forces contractors to police model publishers they can't control, putting GSA procurement in direct collision with the White House's open-ecosystem priorities.
GSA's revised AI procurement rule still imposes flowdown requirements that would functionally exclude open-source and third-party AI from GSA contract vehicles. Over 75 industry comments show June's revisions haven't resolved the core problem: the clause puts contractors on the hook for model behavior they can't control. Palantir urged withdrawal; Microsoft warned the terms could deter commercial AI providers from GSA deals entirely. The pushback coincides with a 230-company letter (Meta, Google, OpenAI, Nvidia among them) arguing open-weight models are essential to U.S. AI leadership, setting up an early collision between the administration's deregulatory AI posture and federal procurement gatekeeping.
AUG 20
trade-press
Palantir urges GSA to withdraw draft LLM acquisition rule
Palantir's legal argument that GSA lacks independent authority under the major questions doctrine is one no other contractor has been willing to make publicly, even as they urge substantial revisions.
Palantir has called on GSA to withdraw its draft large language model acquisition rule entirely, arguing through law firm Freshfields that the agency lacks independent authority to finalize it and that the proposed clause would violate the Federal Acquisition Streamlining Act. The company warned the rule would push agencies toward non-GSA contract vehicles, undermining the administration's procurement consolidation goals. Palantir's position stands alone: a Nextgov/FCW review of public comments shows the rest of industry (including CCSGP, BSA, PSC, and ITI) is focused on narrowing scope and clarifying definitions, not killing the rule.
AUG 6
trade-press
OMB asks Congress to raise simplified acquisition threshold to $10M
The micropurchase threshold would hit $100,000 by 2030, shifting over 100,000 transactions out of full compliance and small-business set-aside rules.
OMB sent Congress 20 acquisition-reform proposals in July, headlined by a phased increase of the simplified acquisition threshold to $10 million for commercial products and services by September 2030. The micropurchase threshold would climb to $100,000 on the same timeline, decoupling from Buy American Act requirements above $15,000. The package also includes task-order protest threshold parity, permanent Commercial Solutions Openings authority for GSA and DHS, and acquisition workforce training funds. Several proposals have been submitted before; the thresholds and the move to a unitary acquisition framework across CFO Act agencies are drawing the most industry attention.
JUL 31
trade-press
FedRAMP certifies that clouds are safe, not that they interoperate
FedRAMP certifies clouds as safe but not interoperable, and fifteen years of modernization have turned that gap into a structural barrier to mission collaboration.
NASA's Artemis II mission ran on PDFs and manual version-tracking. Contractor-to-contractor procedures didn't move directly between Boeing, Lockheed, Airbus, and Northrop Grumman. Every document flowed through the agency, red-lined and reconciled in meetings where someone read line numbers aloud. The culprit isn't just procurement inertia. FedRAMP certifies that a cloud is safe to use; it does not certify that two clouds can talk to each other. Fifteen years of cloud modernization replaced a human coordination problem with a technical and contractual architecture in which sharing data across boundaries is structurally harder than it was before.
JUL 27
trade-press
Chamber Challenges Immediate 800-171 Rev. 3 Mandate in FAR CUI Rule
The absence of a phase-in period is operationally infeasible for most of the 67,000 affected contractors and may expose the rule to legal challenge under the Administrative Procedure Act, the Chamber argues.
The U.S. Chamber of Commerce filed comments opposing the FAR Council's proposed CUI rule, which would require contractors to comply with NIST SP 800-171 Rev. 3 immediately upon contract insertion with no phase-in period. The filing argues this is operationally infeasible for roughly 67,000 unique entities and more than 2 million private-sector employees, most of whom have never been subject to the 800-171 framework. The Chamber warns the absence of a phase-in period may render the rule vulnerable under the Administrative Procedure Act if the FAR Council cannot demonstrate that immediate compliance is feasible across the entire civilian contractor base.
JUL 24
trade-press
FAR cuts 3,000 mandates as procurement chief tells agencies: use discretion
The 3,000-cut tally gets the headlines, but the operational shift from "find the rule that permits it" to "find the rule that forbids it" is what changes Monday morning.
The White House's FAR overhaul has removed roughly 3,000 non-statutory mandates and cut the regulation by about 25%, OFPP Administrator Kevin Rhodes said Thursday at Carahsoft's FedRAMP Summit. The slimmed-down rulebook flips the default posture of federal procurement: if the FAR doesn't say you can't do something, contracting officers should consider it. The shift from compliance-checklist buying to delivery-focused acquisition will take years. "Five years from now," Rhodes said, "we're going to have people that are executing and delivering on the mission."
JUL 23
trade-press
House passes FIT Procurement Act to raise buying thresholds
The operational change is still hypothetical because agencies get faster buying only if the Senate takes up a bill it already let die.
The House passed the Federal Improvement in Technology Procurement Act, HR 4123, under suspension of rules Monday, FedScoop reports. The bill would raise the micro-purchase threshold from $10,000 to $25,000, lift the simplified acquisition threshold from $250,000 to $500,000 and allow advance payments for cloud services. Contracting officers and technology vendors would benefit from faster low-dollar buying, but there is no current Senate companion after last Congress’s version stalled there.
JUL 21
trade-press
Senators press OFPP on delayed FAR conflict rule
Disclosure duties are coming, but contractors still do not know what interests must be reported or when the clock starts.
Sens. Gary Peters, Chuck Grassley, Joni Ernst and Maggie Hassan asked Office of Federal Procurement Policy Administrator Kevin Rhodes for a timeline to update the Federal Acquisition Regulation under Public Law 117-324. The FAR Council has drafted a proposed rule, FedScoop reports, but the Preventing Organizational Conflicts of Interest in Federal Acquisition Act’s June 2024 deadline is nearly two years gone. Primes, contractors and CMMC Third Party Assessment Organizations are left waiting on the actual disclosure categories.
JUL 21
independent
FAR Council squeezes termination settlements to 90 days
The proposal buys faster closeout by making contractors choose between thin support, late filings and False Claims Act exposure.
The FAR Council proposed cutting the deadline for termination settlement proposals from one year to 90 days while leaving the underlying support burden intact. Primes, subcontractors and counsel would have to collect cost data, address inventory, develop profit positions and resolve subcontractor claims on a compressed clock. The efficiency case is obvious. So is the litigation risk if contractors pad estimates or file before the record is ready.
JUL 20
trade-press
GSA AI clause would box out open models, BSA says
A provenance test built for closed models can turn security hygiene into procurement favoritism without saying the word ban.
Business Software Alliance told the General Services Administration that its revised artificial intelligence (AI) acquisition clause still functions as an open-source restriction, even after GSA narrowed a broader foreign-component ban to allow incidental foreign-developed components under conditions. Primes, AI contractors and agencies face the practical problem: tracing model lineage, ownership and foreign control can be infeasible for open models. Comments close Aug. 3, and the final wording may decide whether cheaper open-weight options survive federal procurement.
JUL 20
independent
FAR Council consolidates supply-chain, CUI rules in Part 40 proposal
Putting CUI safeguarding in the FAR itself changes the compliance map more than the clause numbering suggests.
The FAR Council's June 23, 2026 Part 40 proposal would pull supply-chain security restrictions from FAR Parts 4, 25 and 40 into one structure, add FAR-wide Controlled Unclassified Information obligations, impose a uniform reasonable-inquiry standard, and set a 72-hour reporting window for supply-chain violations. Primes, subs and counsel get a central hub, but not yet a settled answer on how agency-specific CUI clauses will run alongside it.
JUL 13
trade-press
OMB cuts 68 Cost Accounting Standards requirements, lifts threshold to $35M
The lower-barrier contracting agenda gets real when half the covered contractor pool can stop maintaining duplicate books.
Federal News Network reports that OMB and the Cost Accounting Standards Board rescinded 68 of 72 Cost Accounting Standards (CAS) requirements and raised the annual federal contract-value threshold to $35 million from $2.5 million, effective August 7, 2026. OMB says about half of CAS-covered contractors exit the regime; primes, subs and auditors still above the line get fewer allocation rules, not a free pass.
JUL 10
independent
GSA weighs Buy American labels for GSA Advantage
Domestic sourcing becomes a search-ranking problem, and the data burden lands on contractors and manufacturers before purchase decisions.
The General Services Administration's June 24 Request for Information, citing Executive Order 14392, asks for July 24 comments on two GSA Advantage ideas: voluntary Buy American Act component-test representations that would trigger an icon and higher search placement, and a new original equipment manufacturer-only Special Item Number for selected categories. GSA Advantage contractors, resellers, manufacturers and federal buyers get no immediate mandate. After the Small Business Administration and GSA delisted 22 offerings over false Made in America representations, the catalog label carries certification risk.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
trade-press
GSA narrows AI safeguarding clause for schedules and GWACs
The first GSA-wide AI guardrail now depends on whether subcontractor commitments can be verified beyond prime-contractor attestations.
Federal News Network reports that GSA reissued its AI safeguarding draft regulations on June 17, narrowing the March version, scheduling a July 14 listening session and taking comments through Aug. 3. The clause would reach schedules and governmentwide acquisition contracts (GWACs), forcing primes, subs, contractors and CMMC Third-Party Assessment Organizations (C3PAOs) advising them to parse data-ownership limits, large language model (LLM) role definitions, flow-down clauses and attestation mechanics. The unresolved test is whether subcontractor AI accountability becomes enforceable.
JUL 7
trade-press
GSA FAS puts resellers under pricing scrutiny
The reorg’s polite promise of consistency now comes with a harder demand: show the government exactly what value the reseller adds.
Federal News Network’s industry-day account says the General Services Administration’s Federal Acquisition Service is pairing procurement consolidation with tighter pricing, supply-chain and transaction-data expectations. Value-added resellers face the clearest change: FAS said it will judge value as services provided, scrutinize line-item pricing and seek detailed descriptions of value-added work, without centering markup disclosures. Schedule vendors also may see reseller channels shift under GSAR 538.7102-1(e) order-placement guidance.
JUL 2
trade-press
FAR Council proposes civilian CUI rule after 15-year gap
The proposal replaces agency improvisation with a contract-marking regime, then gives industry 30 days to parse the buried rewrite.
Federal News Network reports the FAR Council has proposed a government-wide controlled unclassified information (CUI) rule for civilian agencies, built around a standard form and contracting officer directions for identifying and marking CUI. Contractors, primes and subs would get one baseline for scope and flowdown; Cybersecurity Maturity Model Certification (CMMC) third-party assessment organizations (C3PAOs) will have to track the NIST SP 800-171 Revision 3 split from CMMC’s Revision 2 work. The rule still arrives inside the larger FAR overhaul with 30 days for comment, and its effective date and existing-contract treatment remain unresolved.
JUL 1
trade-press
FAR Council gives contractors 30 days on 223,000-word rewrite
A shorter FAR may still leave contractors doing more judgment calls under less time to shape the final text.
Federal News Network reports the FAR Council has opened the first phase of formal rulemaking on the FAR overhaul: 12 proposed rules touching more than 20 parts and running 223,000 words, with comments due in 30 days. Primes, contractors and counsel now have a compressed window to find substantive changes in contract structure, CUI procedures and supply-chain provisions before rules the government wants finalized this year.
JUN 30
trade-press
FAR rewrite leaves CUI confusion intact
Consolidating clauses helps buyers find the rules; it does not tell contractors when agencies have triggered them.
Government Executive says the Federal Acquisition Regulation rewrite has not solved contractors’ recurring problem with controlled unclassified information: inconsistent agency implementation and unclear triggering facts. The FAR overhaul may consolidate information security and supply-chain provisions, but Executive Order 13556, National Archives and Records Administration CUI rules, NIST SP 800-171 and Cybersecurity Maturity Model Certification still sit outside that cleanup. The affected reader is not the policy shop. It is the bidder pricing cyber work before the solicitation tells them what data they will actually touch.
JUN 25
trade-press
White House PQC order turns market edge into FAR requirement
The useful private-sector signal now becomes a procurement filter, which is where federal cyber transitions stop being aspirational.
A June 22 White House executive order moves federal high-value assets and high-impact systems to post-quantum cryptography for key establishment by December 31, 2030, and digital signatures by December 31, 2031, with Federal Acquisition Regulation changes coming for contractors. R Street’s Mark Dalton told Inside Cybersecurity the private-sector race on quantum-safe products can speed the transition, but the hard part is funding agencies and writing contract language that vendors can actually build against.
JUN 25
regulator
FAR Council opens PRA comments on FAR overhaul parts
The useful work is burden math: pricing the reporting, documentation, and attestation hours before OMB numbers set expectations.
The Federal Acquisition Regulatory Council opened Paperwork Reduction Act comments for FAR Case 2026-001, covering Revolutionary FAR Overhaul Parts 1, 2, 4, 33, 39, 40, and 53. Primes, contractors, and MSPs should map the affected information collections and submit comments on necessity, practical utility, burden estimates, clarity, and ways to reduce respondent burden through automation or other information technology.
JUN 25
trade-press
GAO blames FAR gaps for $10B cloud procurement sprawl
Agencies are buying modern cloud services through a rulebook that still cannot define the thing being bought.
GAO found that outdated Federal Acquisition Regulation language, conflicting Office of Management and Budget and National Institute of Standards and Technology guidance, and weak procurement data are slowing cloud acquisition across 24 agencies. Primes and agency counsel are still bidding and drafting around undefined cloud terms as annual federal cloud contract spending tops $10 billion. GAO names the awkward part: the procurement rulebook has aged more slowly than the market it governs.
JUN 23
regulator
FAR Council targets eight FAR parts under EO 14275
For CMMC readers, the important fact is the missing one: the proposal does not say which security obligations survive.
The FAR Council proposed amendments to FAR parts 1, 2, 4, 33, 39, 40, 52 and 53 to implement Executive Order 14275’s directive to eliminate excessive acquisition regulations. Primes, subcontractors, contractors and C3PAOs may see procurement compliance burdens reduced, but the proposal does not define any Cybersecurity Maturity Model Certification thresholds, security flowdown changes, cost impact or final-rule timing.
JUN 23
regulator
FAR Council targets eight FAR parts under Executive Order 14275
The compliance risk is premature certainty, because cyber clauses, reporting duties, and flow-downs still lack a clause-level survival map.
The Federal Acquisition Regulatory Council would revise Federal Acquisition Regulation (FAR) parts 1, 2, 4, 33, 39, 40, 52, and 53 under Executive Order 14275, Restoring Common Sense to Federal Procurement, as part of a 12-rule streamlining. Primes, contractors, and subs face uncertainty before relief: cyber clauses, incident reporting timelines, and flow-down obligations still need a clause-level survival map before anyone changes compliance strategy.
JUN 23
trade-press
FAR overhaul pushes CUI, FedRAMP clauses into rulemaking
This is not one procurement cleanup; it is three contractor security programs being rewritten on the same track.
FedScoop reports that four proposed Federal Acquisition Regulation rules, totaling more than 1,000 pages, are set for Federal Register publication and would revise 20 FAR sections for the first major update in 40 years. Primes, subs and contractors would face 72-hour cyber incident reporting, controlled unclassified information safeguarding changes, and at least a FedRAMP Moderate baseline when CUI sits in the cloud. Comments run through July 23, but the final schedule and phase-in remain unresolved.
JUN 22
trade-press
DIA seeks AI procurement prototype for FAR, DFARS workflows
Clause logic is an obvious automation target, but acquisition judgment is where AI can turn paperwork speed into procurement risk.
DefenseScoop reports that the Defense Intelligence Agency issued a June 17 request for information for an artificial intelligence-enabled acquisition platform tied to Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS) and agency processes. White papers are due July 2, and DIA is considering other transaction prototype awards for commercially available tools. Acquisition staff, program offices, counsel and vendors would see the system touch market research, requirements, solicitation drafting, clause recommendations, evaluation workflows and compliance checks. Speed helps only if the clause logic is right.
JUN 22
trade-press
FAR Council opens 17-part rewrite for July comments
The rulemaking window is the contractor community’s real leverage point, and it is short by design.
Federal News Network reports that the Federal Acquisition Regulatory Council will publish proposed rules for 17 Federal Acquisition Regulation parts, moving Trump’s FAR overhaul from agency deviations into formal rulemaking with comments due by mid-July. Contractors, primes, subcontractors and managed service providers have one compressed chance to press changes on competition, acquisition planning, IT buying, protests and socioeconomic-program language before officials try to finalize the rules by year-end.
JUN 22
trade-press
Senate bill pushes OTA awards onto USASpending.gov
Speed has been the selling point for other transaction agreements; invisibility was never supposed to be part of the bargain.
Federal News Network reports the Senate passed the Stop Secret Spending Act from Sens. James Lankford, Joni Ernst and Gary Peters, requiring agencies to disclose other transaction agreement awards on USASpending.gov. Contractors chasing non-Federal Acquisition Regulation deals would get more visibility into awards that often move through paid consortiums. The Senate’s fiscal 2027 NDAA includes a similar OTA disclosure provision, though the House version does not.
JUN 18
trade-press
GSA gives contracting officers more discretion under RFO
The operational test is whether training and shared guidance can keep judgment from turning into uneven procurement records.
GSA’s Nick West told Federal News Network the agency is using training, AI tools and the Revolutionary FAR Overhaul’s FAR Companion to reduce contracting officers’ paperwork load and clarify what is required versus discretionary. Contracting officers gain room to plan, engage industry and document judgment. The obvious tension is consistency: discretion helps only if new hires and reviewers can see the same reasoning trail.
JUN 17
regulator
GSA opens comments on GSAR LLM data safeguard clause
GSA is using acquisition plumbing to define basic LLM data safeguards before choosing a deviation or formal rulemaking.
The General Services Administration (GSA) published a Federal Register notice seeking comments on a draft General Services Administration Acquisition Regulation (GSAR) clause for basic safeguarding of data within large language model artificial intelligence systems (LLMs). The notice frames the clause as pre-decisional: GSA wants stakeholder feedback because the issue is complex before it takes future action, including a possible deviation or formal rulemaking. For now, stakeholders have a comment record rather than final contract language.
JUN 17
trade-press
Contractors face CMMC, fixed-price squeeze across federal market
The risk shift is not theoretical when small businesses must certify cybersecurity and document hours before invoices move.
Federal News Network’s interview with Barbara Kinosky frames the last 18 months of acquisition changes as a combined squeeze on contractors: mandatory Cybersecurity Maturity Model Certification, changes to small-business set-asides and fixed-price contracting as the default. Kinosky said small businesses are absorbing new compliance cost, while some fixed-price work now requires time cards and invoice-level proof of hours before payment.
JUN 16
trade-press
NIH sunsets NITAAC GWACs as GSA absorbs IT buying
The collapse of CIO-SP4 has become a procurement routing change, with agencies steered toward GSA by 2028.
According to a notice reported by FedScoop, the NIH Information Technology Acquisition and Assessment Center (NITAAC) will stop new orders on CIO-SP3, CIO-SP3 Small Business and CIO-CS on Oct. 29, with new orders now capped at Dec. 31, 2028. Agencies and vendors using those governmentwide acquisition contracts (GWACs) are being pushed toward the General Services Administration (GSA). CIO-SP4’s canceled $50 billion successor fight left a simpler result: GSA gets the work.
JUN 11
trade-press
House Small Business Committee advances HR 2804 to codify Rule of Two
Codification protects the baseline rule while leaving the task-order discretion that drives speed in day-to-day agency buying.
Former GSA Administrator Emily Murphy told Federal News Network that HR 2804, the Protecting Small Business Competitions Act of 2025, cleared the House Small Business Committee by voice vote and would put the small-business Rule of Two into statute. As marked up, the bill applies to contracts but no longer extends the requirement to task and delivery orders above the simplified acquisition threshold. Small businesses get a statutory floor; contracting officers keep task-order discretion.
JUN 3
trade-press
House NDAA moves FASC from OMB to White House, mandates NSA and DoD seats
Three failed attempts in four years to fix the Federal Acquisition Security Council; folding it into the NDAA is Congress signaling it won't wait for OMB to sort itself out.
The Chairman's mark for the fiscal 2027 National Defense Authorization Act, set for a June 4 House Armed Services Committee markup, incorporates the Federal Acquisition Security Council Improvement Act. The bill relocates the FASC from the Office of Management and Budget to the Executive Office of the President, creates a dedicated FASC Program Office, mandates two DoD seats including one filled by the National Security Agency, and adds designated seats for CISA, ONCD, ODNI, FBI, GSA, and NIST. A streamlined process lets Congress itself designate sources of concern and requires the FASC to open investigations into those designations. A nearly identical bill passed the House in 2024 and cleared the Senate Homeland Security Committee but died on the Senate floor in the 118th Congress.
MAY 27
independent
Contractors must now verify which FAR version governs each contract
A year into rolling model deviations, agency implementation is uneven enough that clause applicability is a contract-by-contract question, not an assumption.
The FAR Council has released model deviation text for all FAR parts under the RFO initiative, launched via EO 14275 and OMB M-25-26 (May 2, 2025). Agencies had 30 days to implement each tranche via class or individual deviations, and they are doing so at different speeds. The result: which clauses govern a given contract now depends on the agency, bureau, and buying activity. Covington flags a compounding problem: procurement systems often lag the policy, meaning contract documents may not yet reflect adopted deviations. Contractors cannot treat the codified FAR as a reliable proxy for what is actually in their contracts.
MAY 22
independent
Trump EO makes fixed-price contracts the federal default
Large contractors have 90 days before agencies start renegotiating their biggest cost-reimbursement deals.
An April 30 Executive Order directs agencies to treat fixed-price, performance-based contracts as the default procurement method and requires contracting officers to submit written justifications to use anything else. Above certain dollar thresholds, agency-head approval is required. The 90-day clock is the immediate pressure point: each agency must review its 10 largest non-fixed-price contracts by value and seek to modify, restructure, or renegotiate them. Two categories are exempt: emergency or contingency operations, and R&D or pre-production development for major systems. OMB guidance is due within 45 days; proposed FAR amendments within 120. Cost-reimbursement-heavy primes should expect renegotiation outreach before late July.
MAY 22
trade-press
GAO finds uneven search methods hide China-linked equipment on agency networks
Four agencies reporting zero findings while DOD and DOE found covered devices is a methodology gap, not a clean bill of health.
A May 19 GAO report on six federal agencies' compliance with the Section 899 NDAA prohibition on China-linked telecom and video surveillance equipment found that only DOD conducted physical searches, and only DOD and DOE found covered devices. DHS, DOJ, State, and Treasury all reported zero findings, but none ran physical searches. GAO identified procurement record gaps, supply-chain opacity, and rebranding as structural limits on every agency's search approach. The divergence in methods makes the zero-finding results hard to read as actual risk clearance.
MAY 21