Topic · procurement

Federal procurement

Federal procurement policy broadly — contract vehicles, fixed-price vs cost-plus, category management, set-asides. Distinct from FAR/DFARS rule text.

RSS feed ↗

trade-press
DHS readies $626M NCCS 2.0 cyber contract
The SOW puts one contractor in the chair for the full detect-to-recover lifecycle across DHS OneNet, making this the most operationally significant piece of the department's IT centralization push yet.
DHS plans to award the Network, Cloud and Cybersecurity Services 2.0 vehicle by late November with a $626 million ceiling. The draft SOW tasks the winning vendor with running the NOSC as a "central hub" for network, cloud, and cybersecurity operations across all classification levels of DHS OneNet, covering monitoring, incident response, and alerting for the CIO's office and select components. The final RFP is expected in early October.
SAT
trade-press
ICE seeks vendor to build agentic software factory
Months after ICE's CIO said the agency wasn't planning on AI agents, the RFI now bars any agent from approving its own release.
ICE published an RFI Friday seeking a vendor to build an "agentic software factory," with three layers from governance to an independent assurance boundary for pre-production testing. The design rule requires that generation, assurance and authorization stay distinguishable, and no autonomous component may silently expand its own permissions or approve its own release. Responses are due Oct. 16. ICE also asks vendors to recommend how evaluation can distinguish genuine hands-on capability from polished generative-AI proposals.
SAT
trade-press
GSA binds AI contractors with class deviation clause
The first binding federal AI procurement clause arrives as rescindable policy, not codified regulation, and it lets the government pull the plug on a procured LLM without explaining how factual accuracy gets measured.
GSA issued its AI acquisition clause as a class deviation from the GSAR, effective Oct. 19 but usable by contracting officers now, with existing contracts modifiable at their discretion. After 75-plus comments from Palantir, Microsoft and Nvidia, the clause shrank to apply only when the government is buying AI, dropped "unbiased AI principles" and the ban on "partisan or ideological judgments," and replaced them with a "reasonable efforts" factual-accuracy standard for LLMs. The government keeps broad audit and suspension rights, and decommissioning liability is capped at 25% of the affected order. Formal rulemaking has no date.
SAT
trade-press
GSA bypasses rulemaking, binds contractors with AI memo
GSA buried a data-safeguard regime in an internal memo after industry comment stalled the formal rule, sidestepping notice-and-comment while keeping the obligations binding on contractors.
Page 129 of a January memo, signed by GSA Senior Procurement Executive Jeffrey Koses in July with the LLM section added, sets binding safeguards effective Oct. 19. Contractors whose products process government data in large language models can't use that data for training, advertising or resale, must encrypt transmissions and keep audit logs, and face a 120-day disclosure deadline, 72-hour incident reporting, 30-day notice before major model swaps, and deletion of embeddings and fine-tuned weights at closeout. The scope spares back-office LLM use and products where AI is "incidental." GSA tried this route by proposed GSAR rule in March, took industry fire through an August comment window, then moved the package by memo instead.
SAT
trade-press
GAO third panel finds CIRCIA and SEC rules conflict with sector regs
After two rounds of industry feedback, the picture isn't improving: energy, financial, and healthcare participants say reporting thresholds, timelines, and definitions across federal rules can't all be met.
GAO's third industry panel report, delivered September 28 to Senators Peters and Garbarino, documents conflicts between CISA's proposed CIRCIA rule, the SEC's 2023 cyber disclosure rules, and sector-specific regulations, NERC-CIP, TSA pipeline requirements, HIPAA, the Bank Secrecy Act, and others. Participants from energy, financial services, and healthcare and public health each described reporting thresholds, timelines, and definitions that diverge across the rules they're subject to. Most participants said federal harmonization progress over the past year has been limited. The panel floated establishing a single entity with authority over regulatory consistency.
SAT
judicial
Enterprise Technology Solutions pays $2.25M over SBA set-aside fraud claims
The $2.25 million civil settlement resolves the False Claims Act allegations, but the release is silent on debarment and any criminal exposure for the named individuals.
Enterprise Technology Solutions and Zahid and Shamela Sheikh agreed to pay $2.25 million to resolve False Claims Act allegations that the company falsely claimed eligibility for two SBA programs and used the misrepresentation to win set-aside contracts. U.S. Attorney Jeanine Ferris Pirro announced the civil settlement. Contractors certifying size and status on bids should read it as another sign that set-aside eligibility is an active enforcement front; the release doesn't say whether ETS faces debarment.
SAT
trade-press
Feinberg memo shifts DoD from CAS to GAAP
The September directive embraces commercial accounting, but Feinberg's August memo demanding direct access to company cost data pulls in the opposite direction, and no one has reconciled the two.
Deputy Defense Secretary Steve Feinberg issued a memo Tuesday directing the Pentagon to shift from Cost Accounting Standards to Generally Accepted Accounting Principles, framing the move as adopting "the accounting every American company already uses." The push follows months of CAS-to-GAAP conformance rulemaking by the CAS Board, which has already rescinded two standards outright and gutted two others. But procurement expert David Berteau flagged an unresolved tension: Feinberg's August 18 memo, which floated the possibility of DoD installing software in company systems to pull cost data directly, appears to require the very granular cost tracking that GAAP doesn't provide. "How do you go one way and then go in the opposite way?" Berteau told Federal News Network.
SAT
trade-press
GAO finds acquisition bottlenecks slow federal threat response
The speed gap isn't new, but AI-accelerated exploitation timelines mean procurement delays that were once tolerable are now a structural vulnerability.
A June GAO report found that 15 of 24 major federal agencies cited outdated acquisition regulations as directly slowing their ability to procure technology. The same number reported difficulty obtaining solutions they'd already identified as necessary. The finding lands as AI tools shrink the disclosure-to-exploitation window from weeks to hours, a mismatch the acquisition system, designed for predictability, was never built to absorb.
SAT
trade-press
86% of agencies missed SCuBA cloud deadline, IG finds
The compliance gap isn't about the quality of the baselines, it's that CISA has no authority to make anyone follow them, and the DHS IG just put that in writing.
A DHS Inspector General audit found that 86% of federal civilian agencies failed to implement all mandatory SCuBA cloud security baselines by the June 2025 deadline. The IG also concluded that CISA "lacks the authority necessary to require full and timely implementation of Binding Operational Directives", a finding that echoes GAO's 2020 assessment and that the IG explicitly cited as the reason it issued no recommendations to the agency. CISA didn't comment.
SAT
trade-press
VA OIG finds 435 contract terminations generally followed FAR
The IG confirmed the process generally complied with procurement rules, but the timeline (some staff got hours to review hundreds of contracts) makes "methodical" a stretch.
VA's Office of Inspector General found the agency terminated 435 contracts worth $1.1 billion last year under a compressed, DOGE-driven review, and that contracting officials generally complied with FAR requirements for terminations for convenience. About 86% of the cancelled contracts were for consulting services. VA built procedures to reduce the risk of cutting critical contracts, requiring offices to justify retaining essential ones and assess whether the work could shift to VA employees. In some cases, staff had less than 11 hours to review hundreds of contracts, obtain senior approval, and submit responses.
SEP 25
trade-press
GSA flags $1.2B in suspected COVID-era contract fraud
The national emergency ended in 2023 but contracts tied to it kept receiving funds, and GSA now says 93% of the flagged money hadn't gone out yet, which makes this as much a payment-suspension story as a fraud story.
GSA announced Wednesday that it identified more than $1.2 billion in suspected fraud across five COVID-related contracts and suspended further payments, stopping $41 million before it went out the door. The contracts were tied to pandemic-era acquisition flexibilities that ended in 2023, yet unnamed contractors kept receiving funding. GSA estimates roughly 6.78% of the total had been disbursed; the remaining 93% was halted before distribution. No criminal charges have been announced. The finding comes one month after GSA claimed $13 billion in suspected procurement fraud across its portfolio, a figure an outside expert cautioned is "suspected" rather than adjudicated.
SEP 24
trade-press
Warner, Cruz propose voluntary telecom security bill
The bill creates a working group and voluntary assessments nearly two years after Salt Typhoon, but Cruz's framing rejects the binding rules Wyden proposed in 2024.
Sens. Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act on Thursday, establishing an NTIA-chaired working group to develop voluntary telecom cybersecurity best practices within 18 months, plus a process for independent assessment of carrier adoption. The bill lands nearly two years after Salt Typhoon compromised systems handling lawful surveillance requests across multiple U.S. carriers. It follows the FCC's reversal last November of a Biden-era security measure, a rollback Warner criticized as leaving scant detail on how voluntary efforts would prevent another breach.
SEP 24
trade-press
DOJ arrests Oxygen Forensics CEO for concealing Russian ownership
Wire fraud charges target a scheme that netted over $2 million in DHS and DOD contracts after 2022 sanctions made the true ownership structure radioactive.
DOJ arrested Oxygen Forensics CEO Lee Reiber in Idaho and Russian co-owner Oleg Davydov in London on wire fraud conspiracy charges. The criminal complaint alleges the phone-forensics company concealed that five Russian nationals controlled it while selling to the Secret Service, Homeland Security Investigations, the DHS inspector general, and DOD. After the U.S. expanded Russia sanctions in 2022, Reiber was installed as CEO and the Russian owners were removed from public filings, but internal emails show the shareholders continued calling "fateful decisions." Government procurement officials told investigators they wouldn't have awarded or renewed contracts had they known the company was Russian-owned. Access Now's Natalia Krapiva called the timing "both a national security and a human rights scandal."
SEP 24
judicial
DOJ Arrests Tech CEO for Hiding Russian Ownership From Feds
The complaint doesn't allege a breach or a defective security control, it alleges the company lied about who owned it and where the code was written, and that's now a criminal matter.
DOJ arrested the CEO of a Virginia software firm and a Russian national for allegedly concealing that the company was owned and controlled by Russian nationals and that its software was developed in Russia. The firm sold software to U.S. government agencies. The complaint (filed in the Eastern District of New York) charges conspiracy to violate the Export Control Reform Act and other offenses tied to procurement of controlled technology for a Russian end user. The case signals DOJ is willing to treat supply-chain deception in federal software procurement as a criminal matter, not just a contractual dispute.
SEP 23
regulator
FAR Council Opens PRA Comment Window for Overhaul Parts 9, 27, 47
The paperwork burden estimate hasn't been published yet, so contractors are being asked to comment on a number they can't see.
The FAR Council is requesting public comment on the Paperwork Reduction Act information-collection changes tied to FAR Case 2026-011, its proposed overhaul of Parts 9, 27, and 47, covering contractor qualifications, patents and data rights, and transportation. This is a separate process from the proposed rule's own comment period. The PRA notice, published September 23, asks for input on necessity, burden accuracy, and ways to reduce the collection load. The proposed rule itself appeared September 18, running 100 pages and carrying a 60-day comment window that closes October 19, 2026.
SEP 23
vendor
AWS Elastic VMware Service clears FedRAMP Class C
The first VMware Cloud Foundation service to hit Class C on AWS removes the ATO barrier that kept federal VMware workloads pinned to on-prem data centers.
Amazon Elastic VMware Service (EVS) is now in scope for FedRAMP Class C (formerly the Moderate baseline) across all US commercial regions. It's the first VMware Cloud Foundation service on AWS to reach that authorization level. For defense contractors and civilian agencies still running aging on-premises VMware stacks, the news eliminates a critical procurement obstacle: workloads that require Class C no longer need a separate agency ATO. The authorization covers commercial US regions; EVS isn't yet listed for Class D (High) in GovCloud.
SEP 22
trade-press
Gottheimer bill would fund $100M CISA AI pilot for critical infrastructure
The proposal arrives as ONCD's Texas Watershed 250 pilot runs without dedicated federal funding, and as the Trump administration's AI executive order left critical-infrastructure testing largely voluntary.
Rep. Josh Gottheimer (D-N.J.) introduced the AI Cyber Defense Act, which would authorize $100 million over fiscal years 2027, 2031 for a CISA-run pilot giving critical infrastructure operators free access to frontier AI models for vulnerability detection and remediation. The bill would prioritize nonprofit, publicly owned, rural, and small organizations. Gottheimer cited the recent wave of cyberattacks on water facilities as the impetus. Unlike the ONCD-led Watershed 250 pilot in Texas, which relies on voluntary private-sector contributions, the legislation puts a dollar figure on the table, though appropriators haven't followed through yet, and CISA has faced funding cuts under the Trump administration.
SEP 22
trade-press
Second FAR Overhaul Tranche Lands With a 30-Day Clock
1,650 pages of proposed rules covering Parts 9, 14, 27, 28, 36, 47, and 52, and the comment window barely stretches past fiscal year-end closeout.
The FAR Council dropped three proposed rules on September 18 covering seven FAR parts, the second tranche in a planned 12-rule sequence under the Revolutionary FAR Overhaul. Comments are due October 19, a 30-day window that leaves contractors roughly two working weeks after the fiscal year closes to digest the changes. The package follows the first tranche published June 23, which covered Parts 1, 2, 4, 33, 39, 40, and 53. The RFO implements Executive Order 14275 and OMB Memo M-25-26, stripping non-statutory text from the FAR and rewriting what remains in plain language. Former GSA administrator Emily Murphy told Federal News Network the latest release is roughly 1,650 pages.
SEP 22
independent
NDAA provisions would make GPR the default for DoD technical data
For the first time, a bill would flip the burden: contractors must prove by clear and convincing evidence why internally funded technology shouldn't carry Government Purpose Rights, and the standard is higher than the preponderance rule that governs most civil disputes.
FY 2027 NDAA provisions moving through the House and Senate would make Government Purpose Rights the default license for technical data and computer software delivered under future DoD contracts, subcontracts, and other transaction agreements. Contractors seeking more restrictive rights would bear the burden of identifying every affected deliverable and substantiating the basis for restrictions by clear and convincing evidence, a higher bar than the preponderance standard that governs most civil disputes. Every proposal would need a compliant assertions table, deliverable by deliverable; every subcontract would flow the same requirement down. The legislation goes well beyond repair access, reaching internally funded commercial and dual-use technology that contractors currently protect with Limited or Restricted Rights.
SEP 22
trade-press
CMMC workloads displacing security duties, ISC2 survey finds
The Phase II pause has layered uncertainty onto a deeper structural problem: compliance preparation that cannibalizes the security work CMMC exists to ensure.
ISC2 surveyed 219 U.S. cybersecurity professionals involved in CMMC. Seventy-six percent support the program, but views on the Phase II pause are nearly split (38% support, 42% oppose). Sixty-six percent report heavier workloads from CMMC preparation, and 32% say they've spent less time on actual cybersecurity duties over the past year. Meanwhile, Redspin reports half its consulting clients have canceled contracts, and a quarter of assessment clients canceled believing "CMMC is going away." Primes are still pushing subs to certify regardless of the DoD review.
SEP 21
trade-press
DOJ market-researches AI legal assistant platforms
The RFI asks whether a platform can execute multi-step legal tasks without step-by-step attorney prompting, a capability very different from the legal research tools DOJ already uses.
The Justice Department posted an RFI Friday seeking commercially available AI legal assistant platforms that can analyze documents and conduct legal research autonomously. A pilot would involve 20 to 30 government users on synthetic or public data, hosted in a vendor's FedRAMP-authorized or commercially available cloud. DOJ already uses LexisNexis, Westlaw, and Bloomberg for legal research, per its 2025 AI use case inventory, but those are search and retrieval tools, not platforms that execute multi-step legal tasks without attorney prompting at each stage.
SEP 21
trade-press
FAR Council Rewrites Part 15 Negotiations, Part 12 Commercial Buying
The shift from "discussions" to "negotiations" is the most consequential competitive-procurement rewrite in decades, and the proposed rule doesn't resolve whether multiple competitive ranges or late-stage re-entries open new bid protest exposure.
The FAR Council released proposed rule FAR Case 2026-003, restructuring Part 12 (commercial buying), Part 15 (competitive procurements), and related parts to emphasize negotiations, streamlined deficiency definitions, and commercial market practices. The Part 15 rewrite shifts the default from discussions (where agencies pointed out flaws so bidders could fix them) to negotiations aimed at improving the deal for both sides. The proposal also opens the door to keeping lower-ranked proposals in the competitive range. Comments are due October 19, 2026. This is the second major tranche of the Revolutionary FAR Overhaul under EO 14275; eight of twelve proposed rules are now published.
SEP 21
trade-press
SBA size-standard hike draws pushback at town hall
The proposal would lift some NAICS ceilings over 1,100%, and small contractors say the jump would let firms with vastly deeper benches compete for set-aside dollars.
More than 200 commenters logged in for SBA's virtual town hall Thursday, most opposing proposed size-standard increases that push certain NAICS codes dramatically higher, one to $295 million from $24.5 million. Several small-business owners said the one-minute speaking window was tight but enough to flag the core problem: firms operating at the proposed ceilings carry staffing, financial, and business-development resources that would swamp smaller incumbents in the same set-aside pool. A few voiced qualified support, and comments close today.
SEP 21
trade-press
NIST drafts first CSF 2.0 profile for federal Open RAN
The profile operationalizes CSF 2.0's supply-chain risk management language against an architecture deliberately designed to multiply vendors rather than consolidate them.
NIST released draft IR 8623, a CSF 2.0 community profile for federal agencies deploying Open Radio Access Network infrastructure. The profile maps disaggregated RAN components to CSF 2.0 outcomes and references O-RAN Alliance security specifications. It adds new columns for O-RAN risk scores and technical reports, a structural departure from earlier CSF community profiles. Comments close November 2. It's the first profile built for an architecture whose defining feature is multiplying vendors, making it an operational test of the supply-chain risk management language CSF 2.0 added in its Govern function.
SEP 18
trade-press
Stop Rogue AI Act Would Make NIST Agent Guidance a Procurement Mandate
This bipartisan bill would turn NIST's ongoing AI agent security work into mandatory FAR requirements, marking the first legislative push to route AI governance through federal procurement rules.
The bipartisan Stop Rogue AI Act directs NIST to develop standards for discovering, verifying, and controlling AI agents, continuous inventory, verifiable provenance, real-time monitoring for prompt injection and data theft, and human-overridable access controls. The FAR Council must then impose those standards on contractors and agencies procuring or deploying AI agents or systems that interact with them. NIST is already doing this work through CAISI's Agent Standards Initiative and an RFI that closed earlier this year. The bill's real move is converting voluntary guidance into procurement mandates. Timeline and retroactivity are unspecified.
SEP 18
regulator
FAR Council Proposes Overhaul of Parts 14, 28, 36, and 52
The proposed rule is the latest tranche in the Revolutionary FAR Overhaul, but the Federal Register notice is light on clause-level line-out, contractors need the full text to know what actually changes.
The FAR Council proposed amendments to FAR parts 14 (Sealed Bidding), 28 (Bonds and Insurance), 36 (Construction and Architect-Engineer Contracts), and 52 (Solicitation Provisions and Contract Clauses) on September 18, implementing Executive Order 14275's mandate to strip non-statutory content from the FAR. The Part 14 rewrite has been in motion since at least September 2025, when the Council released model deviation text preserving only statutory requirements, agencies including DoD and the Udall Foundation adopted class deviations shortly after. The proposed rule extends that pruning approach to the other three parts. Specific clause retentions and deletions aren't surfaced in the notice; contractors will need to review the full proposed text to assess the impact on their existing compliance structures.
SEP 18
trade-press
Navy's $1.4B Microsoft BPA faces bid-protest survival
The Court of Federal Claims kept Minburn's protest alive by distinguishing challenges to an agency's evaluation from claims that a bidder misrepresented its qualifications, a line that matters far beyond this procurement.
The Court of Federal Claims preserved a bid protest over the Navy's $1.4 billion blanket purchase agreement for Microsoft software, awarded to Dell Federal in May 2026. Minburn Technology Group argued the Navy's evaluation was arbitrary and that Dell materially misrepresented its GSA schedule coverage, alleging Dell's price list said full product lists were "available upon request" rather than demonstrating all required Microsoft SKUs were on its schedule contract. The court drew a distinction between challenges to the agency's evaluation and claims of bidder misrepresentation.
SEP 17
trade-press
DHS gives bidders 55 days, one shot at NOSC 2.0 consolidation
No discussions plus a 55-day sprint means bidders submit their best offer first, or don't submit at all.
DHS released the procurement schedule for its NOSC Network, Cloud, and Cyber Services 2.0 contract Thursday. The timeline runs 55 days from October 1 solicitation to late-November award. No discussions are permitted, so bidders get one shot at Phase 2, where prior experience carries the most weight. The RFP requires agentic AI to automate low-level IT operations across DHS's 22 components. Leidos holds the current NOSC bridge contract; GDIT and Peraton own adjacent legacy pieces being folded into the new vehicle.
SEP 17
trade-press
BSA backs CISA reauthorization in House NDAA, flags three amendments
The software trade group's letter supports NIST-aligned vulnerability disclosure rules and a FedRAMP reciprocity pilot, while opposing provisions it says could sweep in routine commercial practices.
BSA (The Business Software Alliance) released an August 27 letter to Armed Services and party leaders backing CISA 2015's nine-year reauthorization through fiscal 2035, along with House NDAA provisions on FedRAMP reciprocity, vulnerability disclosure aligned to NIST guidelines, and post-quantum cryptography mandates. The letter also flags three House amendments it opposes or finds problematic: one on software-based cryptographic protections that BSA says conflicts with commercial cloud key-management architectures, one barring DoD contracts with providers that give advance vulnerability disclosure to countries-of-concern entities, and a third adding a 72-hour reporting deadline for discovering Chinese-linked hardware in contractor networks.
SEP 15
trade-press
FCC's SBOM proposal splits telecom industry groups
NCTA and NTCA back mandatory SBOM/HBOM disclosure at equipment authorization; USTelecom and CTIA say vendor attestations would do the job with less burden.
Telecom industry groups filed sharply divergent comments on the FCC's proposal to require software and hardware bills of materials as part of equipment authorization. NCTA and NTCA-The Rural Broadband Association support mandatory SBOM/HBOM disclosure, with NTCA arguing small providers lack the market power to demand them from vendors otherwise. USTelecom and CTIA oppose the requirement, contending vendor attestations and confidential supplier lists can achieve the Commission's Covered List compliance goals without the compliance burden of full BOM disclosure. The comments respond to the FCC's August 2026 Third Further Notice of Proposed Rulemaking in ET Docket No. 21-232.
SEP 14
independent
DoW Revises CMMC Suspension and Adds Three Supply-Chain Bans
Third revision in 18 months bundles a prolonged Phase 2 freeze with new restrictions on semiconductors, employee data, and drones, contracting officers now carry all four in one directive.
DoW issued Revision 3 of its Class Deviation on September 3, directing contracting officers to remove or revise CMMC Phase 2 third-party assessment requirements from new and existing contracts. The suspension of the November 2026 transition, first ordered by the CIO in July, remains in place, 800-171 compliance is unaffected. New to Revision 3: three procurement prohibitions covering semiconductor dealings with Huawei-affiliated entities, transfers of covered DoW employee data, and use or procurement of certain unmanned aircraft systems from China, Russia, Iran, or North Korea. Scott Kupor's DoW now runs supply-chain enforcement and CMMC timeline management through the same Part 240 vehicle.
SEP 14
trade-press
DOD nears 90% cutover of classified AI off Anthropic
Maven warfighters say they prefer ChatGPT and Grok over what they left behind, and the multi-vendor shift was overdue regardless of the contract fight.
The Pentagon has migrated roughly 90% of its classified AI workloads away from Anthropic's Claude and is on track to complete the transition by the end of September, Under Secretary Emil Michael told reporters Thursday. Palantir's Maven Smart Systems cut over months ago. The move follows DOD's February designation of Anthropic as a national security supply-chain risk (a designation the company is challenging in two federal courts) after negotiations collapsed over Anthropic's insistence on ethical-use restrictions the department wouldn't accept. Meanwhile, the eight-vendor coalition DOD announced in May (OpenAI, Google, SpaceX, NVIDIA, Reflection, Microsoft, AWS, Oracle) is deploying frontier models across IL6 and IL7 classified networks.
SEP 11
trade-press
DIU Pilots Facility Clearances Before Contract Award
The chicken-and-egg that locked startups out of classified work wasn't a policy, it was the DD 254 requirement itself.
The Defense Innovation Unit is launching a solicitation that lets venture-backed startups obtain facility security clearances before they win a government contract. Historically, companies needed a contract to trigger the DD Form 254 that starts the clearance process, but without clearance, they couldn't see the classified solicitations needed to compete. Under the pilot, which DIU's Sarah Pearson said would cap around 30 to 40 companies in the first round, selected vendors share capability artifacts like product roadmaps rather than sell a product. DCSA would then vet eligibility. The clearance (maintained by DIU for a period "longer than a year" but not yet fixed) grants access to classified conversations and demand signals, not an immediate sale.
SEP 10
trade-press
OpenAI extends ChatGPT government deal through 2028 as $1 era ends
The $1-per-agency era ends, and consumption-based pricing means agencies now pay for the dependency they spent a year building.
GSA and OpenAI announced a new OneGov deal extending ChatGPT access through December 2028, replacing the $1-per-agency offer that expires September 30. The new terms: roughly 50% off token-based consumption pricing across ChatGPT models in FedRAMP-authorized environments, no platform-access fee, no minimum spend commitment. Access expands from ~3.5M federal employees to ~23M across federal, state, local, and tribal governments. The $1 era was always a land-grab; consumption pricing means agencies now pay for the dependency they spent a year building.
SEP 10
independent
NDAA Would Make 1260H Listings Automatic Procurement Bans
Section 1812 would convert designation into a mandatory FASC exclusion referral within 90 days, no discretion, no case-by-case screening, and the bar can outlast the listing itself.
The FY 2027 NDAA proposes roughly 200 China-related provisions, but one stands apart: Section 1812 would require DoW to refer every Section 1260H Chinese military company designee to the Federal Acquisition Security Council within 90 days for a government-wide exclusion order. The FASC gets 270 days to review; if it recommends exclusion, the President gets 90 more. The bar covers a listed entity, its subsidiaries, and affiliates, and survives removal from the 1260H list. The definition of "covered article" sweeps in IT, telecom, cloud services, and any hardware or software with embedded IT, reaching deep into the defense supply chain.
SEP 9
trade-press
NIST admits crypto agility answers aren't clear yet
The post-quantum transition has an executive order deadline and boardroom urgency, but the guidance framework mapping agility to procurement, hardware, and embedded systems doesn't exist yet.
NIST official Bill Newhouse acknowledged the agency hasn't yet mapped cryptographic agility questions to the specific procurement language, hardware constraints, and architecture standards agencies and contractors need for the post-quantum cryptography transition. NIST finalized its crypto agility white paper (CSWP 39) in late 2025, but the implementation answers that would let acquisition officers and engineers actually act on it remain unresolved. The admission comes months after EO 14412 accelerated the PQC migration timeline and the NCCoE continues working with over 40 organizations to build the missing mapping.
SEP 9
trade-press
DOE Opens Comment on Foreign Bulk-Power Equipment Ban
EO 14421 doesn't just block future sales, it authorizes the Energy Secretary to force isolation, disconnection, or replacement of equipment already bolted to the grid.
The Department of Energy published an RFI on September 9 seeking public input on implementing Executive Order 14421, which prohibits acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment. The EO (issued August 26, 2026, under IEEPA and the National Emergencies Act) also grants the Energy Secretary authority to impose conditions on existing foreign equipment, including isolation, monitoring, disconnection, or replacement. Comments are due within 30 days; a public webinar is set for September 16. DOE has 120 days from the EO to publish implementing rules.
SEP 9
trade-press
CDAO pilots shared-savings AI contract under $100M OTA
Traditional defense contracts pay whether the thing works or not, this one pays only when the vendor proves it saved the department money.
The Pentagon's Chief Digital and AI Office is piloting a "shared savings" contract model with venture studio Red Cell Partners under a one-year OTA worth up to $100 million. Red Cell covers all upfront costs; its portfolio companies earn revenue only from proven cost reductions. The model is adapted from healthcare and energy contracting and amounts to a third option alongside traditional procurement: vendors deploy AI tools for free, then take a percentage of whatever savings they generate. A Red Cell portfolio company is developing an AI audit agent that would identify high-value consulting contracts the Air Force could cancel.
SEP 9
trade-press
Microsoft puts MDASH vulnerability-hunting AI into Azure Government
The limited preview names no agencies, provides zero vulnerability counts, and offers no benchmarks, an announcement in search of evidence.
Microsoft placed MDASH, an AI vulnerability-hunting system that deploys more than 100 AI agents to find exploitable software flaws, into limited preview on Azure Government. Both defense and civilian agencies are testing it, though Microsoft named none. The company's CTO said the tool is "uncovering previously unknown vulnerabilities and significantly improving the quality of the underlying code", then provided zero examples and zero counts to back the claim.
SEP 8
trade-press
Pentagon Keeps Anthropic Supply-Chain Tag as Commerce Warms
The designation survives on appeal even after a district judge vacated it under one statute, and Lutnick's praise won't change the D.C. Circuit docket.
Anthropic got a split-screen this week. Commerce Secretary Howard Lutnick told Bloomberg the company and the government were "in tune together" after appearing with Anthropic co-founder Tom Brown at a G20 event. A day later, Pentagon R&E official Emil Michael posted that Anthropic "is still a designated supply chain risk" at the department and within the defense industrial base. The contradiction reflects the two-track legal reality: Judge Rita Lin struck down the supply-chain risk designation under one statute in August, but a separate designation under a different statute remains on appeal at the D.C. Circuit. Meanwhile, the FCC signed Claude delivery orders in May and July, and DOE's top IT official said recently that "everybody wants" it.
SEP 4
trade-press
Contractors Press DCSA for Continuous Vetting Metrics
Open CV alerts are delaying cleared employees from transitioning to new roles, and industry says it can't plan without data on how long resolution takes.
Cleared contractors are pressing the Defense Counterintelligence and Security Agency for metrics on its continuous vetting system, citing cases where open CV alerts have held up employees moving to new positions or programs. At a Sept. 2 NISPPAC meeting, ManTech's LaToya Coleman said the lack of data on alert resolution timelines leaves industry without insight into what to expect from the process. DCSA's Tom Giancoli said the agency is working to gather more data on the CV service, including the alert management issue resolution process, but offered no specifics on when industry would see it.
SEP 4
trade-press
Minnesota extends cybersecurity baseline to local governments
The state's whole-of-state plan layers assessments, enterprise tools, and cyber navigators onto municipalities and critical infrastructure, but adoption is voluntary, and the entities getting hit aren't using the capabilities.
Minnesota CISO John Israel's office is expanding a statewide cybersecurity baseline program to local governments and critical infrastructure. The effort, built on a 2023 plan and backed by DHS grant funding, runs on three pillars: baseline assessments to help entities build a security program, enterprise-class tools offered at no or low cost through the state's buying power, and a team of cyber navigators who build ongoing relationships with local governments. Israel said the data shows that entities hit by ransomware and other attacks are the ones that haven't adopted the capabilities. The plan doesn't mandate use of state services, the goal is baseline controls, however sourced.
SEP 3
trade-press
Pentagon launches mobile SCIF network for small contractors
50 transportable units won't solve the accreditation bottleneck unless DCSA's process speeds up too, and the announcement names no timeline, no prime, and no per-unit cost.
The Pentagon's Office of Industrial Base Growth launched the Secure Space Network on Thursday, aiming to produce roughly 50 mobile SCIFs deployable to military installations and industry sites nationwide. The program targets a barrier that small and non-traditional defense suppliers have flagged for years: fixed classified facilities require significant investment and months-long accreditation timelines, which favors incumbents who already have them. The announcement does not name a prime contractor, a production timeline, or a per-unit cost. DCSA's facility clearance process doesn't accelerate just because the walls are on wheels.
SEP 3
regulator
CISA and G7 Issue Joint Call for PQC Transition
The quantum threat graduates from a NIST research track to a synchronized international priority, and the framework's procurement language gives agencies cover to write PQC into RFPs before formal rulemaking.
CISA and the G7 Cyber Security Working Group jointly released a post-quantum cryptography transition framework urging organizations and governments to begin migrating cryptographic systems now. The call to action sets out five priorities: awareness, national strategies, R&D, public-private partnerships, and integrating PQC into procurement requirements. It's the first time the quantum threat has been framed as a coordinated international demand rather than a single-nation research program. The framework doesn't impose mandates, but its procurement language arrives alongside CISA's January 2026 product-category list, which says agencies should acquire only PQC-capable products in categories where they're widely available.
SEP 3
trade-press
DoD solicits software encryption for weapons systems
The software-only requirement sidesteps hardware swaps on platforms that can't be retrofitted, but it also means DoD is accepting the gap between what's deployable now and what post-quantum readiness actually requires.
The Defense Department issued an Aug. 27 RFI for data packet-protection software that works without replacing, modifying, or augmenting existing hardware, chips, radios, the works. It's an interim layer on the way to post-quantum cryptography, with responses due Sept. 27. The solicitation requires DoD-approved multifactor authentication, exclusion of unauthorized parties, and full government control of decryption keys. The department's June 2026 PQC strategy told the military to stop using legacy platforms that can't support advanced encryption, but this software bridge suggests the sunset won't be clean.
SEP 2
independent
CAS Board Doubles Full-Coverage Threshold to $100M
The rule relieves 200-plus contractors of full CAS, but single-award IDC holders may find themselves pulled in rather than let out.
The CAS Board published two final rules September 1, effective October 1, that double the full-coverage threshold from $50M to $100M, raise the basic coverage threshold from $2.5M to $35M, and eliminate the trigger-contract framework. The Board also rescinded CAS 407, which governed standard-cost accounting for direct material and direct labor. More than 200 entities stand to shed full CAS obligations. But the rules cut both ways: single-award IDCs will now be assessed for CAS applicability at the ceiling value, not the task-order level, meaning some contractors will face full CAS on vehicles they'd structured to stay under the old threshold.
SEP 1
trade-press
The quantum attack surface is bigger than it seems
EO 14412 and M-26-15 prioritize high-value system migration, but the trust infrastructure that keeps federal networks authenticating, routing, and verifying software updates sits outside the mandate, and adversaries won't wait for separate guidance.
The White House and OMB have set hard deadlines for migrating high-value and high-impact federal systems to post-quantum cryptography, key establishment by 2030, digital signatures by 2031. But the mandates are silent on the broader trust infrastructure those systems depend on: PKI, device identity, code-signing, network routing, and forensic logs. A cryptographically relevant quantum computer wouldn't need to crack the prioritized systems directly. It could forge certificates, redirect traffic, or push malware through trusted update channels, and the agencies that followed the mandate to the letter would still be exposed. With Google, Microsoft, and Cloudflare targeting 2029 for their own PQC migrations, the gap between what's mandated and what's actually protected is a vulnerability window measured in years.
SEP 1
trade-press
NIST opens SP 800-213A comment as scope question surfaces
Third IoT guidance revision in two years, and NIST still hasn't settled whether the catalog controls devices or products.
NIST opened a pre-draft comment period on SP 800-213A, the federal IoT device cybersecurity requirement catalog, with comments due October 15. The agency's explicitly asking whether the revised catalog should expand its scope from IoT devices to IoT products, bringing it in line with SP 800-213 Rev. 1, which made the same shift in June. For contractors and integrators supplying IoT products to federal agencies, this is the window to shape how the catalog defines compliance requirements. The alternative's inheriting definitions written without them.
SEP 1
trade-press
SBA Would Classify $531M-Receipt Firms as Small
Collapsing roughly 1,000 NAICS categories into 338, the proposed rule would redraw the competitive map for set-aside contracts while mid-size contractors watch as closely as small firms.
The SBA released a proposed rule that would collapse roughly 1,000 NAICS industry categories into 338 and replace the current size-standard methodology with one based on national industry size, geographic markets, and a net import adjustment. In computer systems design, the small-business receipt ceiling would jump from $34 million in annual government receipts to $531 million, a roughly 15-fold increase. Comments are due September 21. PSC president Stephanie Kostro told Federal News Network that mid-size and large contractors are tracking the proposal as closely as small firms are.
SEP 1
regulator
OMB Raises Cost Accounting Standards Thresholds, Clarifies IDC Rules
For contractors near the line, the new numbers mean the difference between CAS-covered and exempt, and the IDC guidance answers a question that's been unsettled for years.
OMB's Cost Accounting Standards Board published a final rule increasing CAS monetary thresholds and clarifying how exemptions apply to indefinite delivery contracts. Contractors whose negotiated contract values previously triggered CAS coverage may now fall below the updated thresholds. The IDC clarification addresses whether exemptions are evaluated at the task-order level or against aggregate contract value, a distinction that determines whether a contractor faces CAS compliance obligations at all. The rule also increases agency waiver authority thresholds.
SEP 1