Topic · procurement

Federal procurement

Federal procurement policy broadly — contract vehicles, fixed-price vs cost-plus, category management, set-asides. Distinct from FAR/DFARS rule text.

RSS feed ↗

independent
NDAA Would Make 1260H Listings Automatic Procurement Bans
Section 1812 would convert designation into a mandatory FASC exclusion referral within 90 days, no discretion, no case-by-case screening, and the bar can outlast the listing itself.
The FY 2027 NDAA proposes roughly 200 China-related provisions, but one stands apart: Section 1812 would require DoW to refer every Section 1260H Chinese military company designee to the Federal Acquisition Security Council within 90 days for a government-wide exclusion order. The FASC gets 270 days to review; if it recommends exclusion, the President gets 90 more. The bar covers a listed entity, its subsidiaries, and affiliates, and survives removal from the 1260H list. The definition of "covered article" sweeps in IT, telecom, cloud services, and any hardware or software with embedded IT, reaching deep into the defense supply chain.
YESTERDAY
trade-press
NIST admits crypto agility answers aren't clear yet
The post-quantum transition has an executive order deadline and boardroom urgency, but the guidance framework mapping agility to procurement, hardware, and embedded systems doesn't exist yet.
NIST official Bill Newhouse acknowledged the agency hasn't yet mapped cryptographic agility questions to the specific procurement language, hardware constraints, and architecture standards agencies and contractors need for the post-quantum cryptography transition. NIST finalized its crypto agility white paper (CSWP 39) in late 2025, but the implementation answers that would let acquisition officers and engineers actually act on it remain unresolved. The admission comes months after EO 14412 accelerated the PQC migration timeline and the NCCoE continues working with over 40 organizations to build the missing mapping.
YESTERDAY
trade-press
DOE Opens Comment on Foreign Bulk-Power Equipment Ban
EO 14421 doesn't just block future sales, it authorizes the Energy Secretary to force isolation, disconnection, or replacement of equipment already bolted to the grid.
The Department of Energy published an RFI on September 9 seeking public input on implementing Executive Order 14421, which prohibits acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment. The EO (issued August 26, 2026, under IEEPA and the National Emergencies Act) also grants the Energy Secretary authority to impose conditions on existing foreign equipment, including isolation, monitoring, disconnection, or replacement. Comments are due within 30 days; a public webinar is set for September 16. DOE has 120 days from the EO to publish implementing rules.
YESTERDAY
trade-press
CDAO pilots shared-savings AI contract under $100M OTA
Traditional defense contracts pay whether the thing works or not, this one pays only when the vendor proves it saved the department money.
The Pentagon's Chief Digital and AI Office is piloting a "shared savings" contract model with venture studio Red Cell Partners under a one-year OTA worth up to $100 million. Red Cell covers all upfront costs; its portfolio companies earn revenue only from proven cost reductions. The model is adapted from healthcare and energy contracting and amounts to a third option alongside traditional procurement: vendors deploy AI tools for free, then take a percentage of whatever savings they generate. A Red Cell portfolio company is developing an AI audit agent that would identify high-value consulting contracts the Air Force could cancel.
YESTERDAY
trade-press
Microsoft puts MDASH vulnerability-hunting AI into Azure Government
The limited preview names no agencies, provides zero vulnerability counts, and offers no benchmarks, an announcement in search of evidence.
Microsoft placed MDASH, an AI vulnerability-hunting system that deploys more than 100 AI agents to find exploitable software flaws, into limited preview on Azure Government. Both defense and civilian agencies are testing it, though Microsoft named none. The company's CTO said the tool is "uncovering previously unknown vulnerabilities and significantly improving the quality of the underlying code", then provided zero examples and zero counts to back the claim.
TUE
trade-press
Pentagon Keeps Anthropic Supply-Chain Tag as Commerce Warms
The designation survives on appeal even after a district judge vacated it under one statute, and Lutnick's praise won't change the D.C. Circuit docket.
Anthropic got a split-screen this week. Commerce Secretary Howard Lutnick told Bloomberg the company and the government were "in tune together" after appearing with Anthropic co-founder Tom Brown at a G20 event. A day later, Pentagon R&E official Emil Michael posted that Anthropic "is still a designated supply chain risk" at the department and within the defense industrial base. The contradiction reflects the two-track legal reality: Judge Rita Lin struck down the supply-chain risk designation under one statute in August, but a separate designation under a different statute remains on appeal at the D.C. Circuit. Meanwhile, the FCC signed Claude delivery orders in May and July, and DOE's top IT official said recently that "everybody wants" it.
FRI
trade-press
Contractors Press DCSA for Continuous Vetting Metrics
Open CV alerts are delaying cleared employees from transitioning to new roles, and industry says it can't plan without data on how long resolution takes.
Cleared contractors are pressing the Defense Counterintelligence and Security Agency for metrics on its continuous vetting system, citing cases where open CV alerts have held up employees moving to new positions or programs. At a Sept. 2 NISPPAC meeting, ManTech's LaToya Coleman said the lack of data on alert resolution timelines leaves industry without insight into what to expect from the process. DCSA's Tom Giancoli said the agency is working to gather more data on the CV service, including the alert management issue resolution process, but offered no specifics on when industry would see it.
FRI
trade-press
Minnesota extends cybersecurity baseline to local governments
The state's whole-of-state plan layers assessments, enterprise tools, and cyber navigators onto municipalities and critical infrastructure, but adoption is voluntary, and the entities getting hit aren't using the capabilities.
Minnesota CISO John Israel's office is expanding a statewide cybersecurity baseline program to local governments and critical infrastructure. The effort, built on a 2023 plan and backed by DHS grant funding, runs on three pillars: baseline assessments to help entities build a security program, enterprise-class tools offered at no or low cost through the state's buying power, and a team of cyber navigators who build ongoing relationships with local governments. Israel said the data shows that entities hit by ransomware and other attacks are the ones that haven't adopted the capabilities. The plan doesn't mandate use of state services, the goal is baseline controls, however sourced.
THU
trade-press
Pentagon launches mobile SCIF network for small contractors
50 transportable units won't solve the accreditation bottleneck unless DCSA's process speeds up too, and the announcement names no timeline, no prime, and no per-unit cost.
The Pentagon's Office of Industrial Base Growth launched the Secure Space Network on Thursday, aiming to produce roughly 50 mobile SCIFs deployable to military installations and industry sites nationwide. The program targets a barrier that small and non-traditional defense suppliers have flagged for years: fixed classified facilities require significant investment and months-long accreditation timelines, which favors incumbents who already have them. The announcement does not name a prime contractor, a production timeline, or a per-unit cost. DCSA's facility clearance process doesn't accelerate just because the walls are on wheels.
THU
regulator
CISA and G7 Issue Joint Call for PQC Transition
The quantum threat graduates from a NIST research track to a synchronized international priority, and the framework's procurement language gives agencies cover to write PQC into RFPs before formal rulemaking.
CISA and the G7 Cyber Security Working Group jointly released a post-quantum cryptography transition framework urging organizations and governments to begin migrating cryptographic systems now. The call to action sets out five priorities: awareness, national strategies, R&D, public-private partnerships, and integrating PQC into procurement requirements. It's the first time the quantum threat has been framed as a coordinated international demand rather than a single-nation research program. The framework doesn't impose mandates, but its procurement language arrives alongside CISA's January 2026 product-category list, which says agencies should acquire only PQC-capable products in categories where they're widely available.
THU
trade-press
DoD solicits software encryption for weapons systems
The software-only requirement sidesteps hardware swaps on platforms that can't be retrofitted, but it also means DoD is accepting the gap between what's deployable now and what post-quantum readiness actually requires.
The Defense Department issued an Aug. 27 RFI for data packet-protection software that works without replacing, modifying, or augmenting existing hardware, chips, radios, the works. It's an interim layer on the way to post-quantum cryptography, with responses due Sept. 27. The solicitation requires DoD-approved multifactor authentication, exclusion of unauthorized parties, and full government control of decryption keys. The department's June 2026 PQC strategy told the military to stop using legacy platforms that can't support advanced encryption, but this software bridge suggests the sunset won't be clean.
SEP 2
independent
CAS Board Doubles Full-Coverage Threshold to $100M
The rule relieves 200-plus contractors of full CAS, but single-award IDC holders may find themselves pulled in rather than let out.
The CAS Board published two final rules September 1, effective October 1, that double the full-coverage threshold from $50M to $100M, raise the basic coverage threshold from $2.5M to $35M, and eliminate the trigger-contract framework. The Board also rescinded CAS 407, which governed standard-cost accounting for direct material and direct labor. More than 200 entities stand to shed full CAS obligations. But the rules cut both ways: single-award IDCs will now be assessed for CAS applicability at the ceiling value, not the task-order level, meaning some contractors will face full CAS on vehicles they'd structured to stay under the old threshold.
SEP 1
trade-press
The quantum attack surface is bigger than it seems
EO 14412 and M-26-15 prioritize high-value system migration, but the trust infrastructure that keeps federal networks authenticating, routing, and verifying software updates sits outside the mandate, and adversaries won't wait for separate guidance.
The White House and OMB have set hard deadlines for migrating high-value and high-impact federal systems to post-quantum cryptography, key establishment by 2030, digital signatures by 2031. But the mandates are silent on the broader trust infrastructure those systems depend on: PKI, device identity, code-signing, network routing, and forensic logs. A cryptographically relevant quantum computer wouldn't need to crack the prioritized systems directly. It could forge certificates, redirect traffic, or push malware through trusted update channels, and the agencies that followed the mandate to the letter would still be exposed. With Google, Microsoft, and Cloudflare targeting 2029 for their own PQC migrations, the gap between what's mandated and what's actually protected is a vulnerability window measured in years.
SEP 1
trade-press
NIST opens SP 800-213A comment as scope question surfaces
Third IoT guidance revision in two years, and NIST still hasn't settled whether the catalog controls devices or products.
NIST opened a pre-draft comment period on SP 800-213A, the federal IoT device cybersecurity requirement catalog, with comments due October 15. The agency's explicitly asking whether the revised catalog should expand its scope from IoT devices to IoT products, bringing it in line with SP 800-213 Rev. 1, which made the same shift in June. For contractors and integrators supplying IoT products to federal agencies, this is the window to shape how the catalog defines compliance requirements. The alternative's inheriting definitions written without them.
SEP 1
trade-press
SBA Would Classify $531M-Receipt Firms as Small
Collapsing roughly 1,000 NAICS categories into 338, the proposed rule would redraw the competitive map for set-aside contracts while mid-size contractors watch as closely as small firms.
The SBA released a proposed rule that would collapse roughly 1,000 NAICS industry categories into 338 and replace the current size-standard methodology with one based on national industry size, geographic markets, and a net import adjustment. In computer systems design, the small-business receipt ceiling would jump from $34 million in annual government receipts to $531 million, a roughly 15-fold increase. Comments are due September 21. PSC president Stephanie Kostro told Federal News Network that mid-size and large contractors are tracking the proposal as closely as small firms are.
SEP 1
regulator
OMB Raises Cost Accounting Standards Thresholds, Clarifies IDC Rules
For contractors near the line, the new numbers mean the difference between CAS-covered and exempt, and the IDC guidance answers a question that's been unsettled for years.
OMB's Cost Accounting Standards Board published a final rule increasing CAS monetary thresholds and clarifying how exemptions apply to indefinite delivery contracts. Contractors whose negotiated contract values previously triggered CAS coverage may now fall below the updated thresholds. The IDC clarification addresses whether exemptions are evaluated at the task-order level or against aggregate contract value, a distinction that determines whether a contractor faces CAS compliance obligations at all. The rule also increases agency waiver authority thresholds.
SEP 1
trade-press
OMB mandates Login.gov for public-facing federal services
After decades of fragmented identity systems, the memo gives agencies two years to consolidate onto a single platform, but the escape hatch is generous and the enforcement teeth are absent.
OMB issued a memo Monday directing agencies to deploy Login.gov as the default authentication platform for public-facing federal websites within two years, with a one-year deadline for High Impact Service Provider (HISP) services. Agencies that cannot meet either deadline may submit a notice to OMB explaining why. The mandate exempts DoD systems, national security systems, and B2B/B2G use cases. GSA must convene customer agencies within 90 days, host an industry day within six months, and explore expanded service offerings including verifiable digital credentials. From fiscal 2020 through 2023, agencies spent $209 million on commercial identity solutions against $32.5 million on Login.gov.
AUG 31
trade-press
Army MAX puts AI on solicitation drafting, not evaluation
The platform arrives months after a bid protest alleged AI hallucinations tainted a $450M Army award, but MAX stops at the RFP, leaving the evaluation question for another day.
Army Contracting Command is testing Army MAX, a platform that uses AI to turn unit requirements into standardized solicitations for services contracts. An initial pilot this summer wrote a solicitation for latrine services at Joint Base Langley-Eustis; a future version may add vendor quoting and contract execution. The tool arrives as a separate AI procurement dispute (a TRAX International suit alleging AI hallucinations weakened its bid for a $450M White Sands contract) works through the Court of Federal Claims. The Army has disputed the extent of AI's role in that evaluation.
AUG 31
trade-press
OMB Memo Mandates Login.gov as Universal Federal Sign-On
The binding memo closes the enforcement gap that let agencies maintain custom authentication stacks for decades, setting hard deadlines through 2027.
OMB Director Russell Vought issued a binding memo Monday making Login.gov the mandatory sign-on for federal public-facing websites that require authentication. Agencies have 60 days to inventory those sites, one year to adopt GSA's Login best practices, and two years to complete migration. The memo does not bar agencies from using other identity verification services alongside Login where Login can't meet specific needs, but the voluntary-adoption era is over. GSA must convene agency customers quarterly, publish implementation guidance within 180 days, and host an industry day for commercial identity providers. NIST gets 120 days to deliver a Digital Identity Risk Management resource.
AUG 31
trade-press
ONCD, CISA push agencies on post-quantum cryptography deadlines
The "trust now, forge later" threat makes PQC migration a present-day problem, not a future one, and CISA's quantum lead says if you haven't costed it yet, you're behind.
ONCD and CISA officials urged federal agencies to treat post-quantum cryptography migration as an immediate priority, not a long-range planning exercise. Trump's June 2025 executive order sets hard deadlines, PQC key establishment for high-value assets and high-impact systems by December 31, 2030, and digital signatures by December 31, 2031. CISA quantum security lead Patrick Manley told agencies that the "trust now, forge later" threat makes PQC readiness real today, and warned that organizations without a cost estimate for their most critical systems are already behind.
AUG 31
trade-press
Trump EO orders PQC migration for high-value assets by 2030, 31
Agencies face an Oct. 22 deadline for migration plans, and CISA is signaling that procurement language and cryptography bills-of-materials will become the enforcement mechanism for vendor compliance.
President Trump signed an executive order directing federal agencies to transition high-value assets and high-impact systems to post-quantum cryptographic key establishment by Dec. 31, 2030, and PQC digital signatures by Dec. 31, 2031. OMB followed with guidance requiring agencies to submit PQC migration plans by Oct. 22. The order builds on NIST's 2024 PQC standards and comes as CISA pushes agencies to write PQC requirements into acquisition documentation, a procurement lever that the prior administration's framework left largely untapped.
AUG 28
trade-press
DoD RFI seeks software-only quantum-safe encryption
The Pentagon wants PQC migration without touching hardware, compressing the timeline for primes whose legacy systems weren't built for cryptographic agility.
The Defense Department released a request for information Thursday seeking software-only post-quantum cryptography solutions that require zero hardware changes. Vendors must describe products aligned with a PQC migration strategy scheduled on or before Dec. 31, 2029, with the broader DoD mandate that every system employ PQC by Dec. 31, 2031 unless excepted. The RFI is one of the first concrete procurement signals following the June PQC strategy and the White House quantum executive orders, it asks industry to show what's possible before the department locks in acquisition paths.
AUG 28
trade-press
Judge voids DoD supply-chain blacklist of Anthropic as illegal retaliation
The ruling is the first to hold that Section 3252's national-security label cannot be weaponized to punish a vendor's public speech or contracting positions, a line the executive branch has been testing for two years.
A federal judge invalidated the Defense Department's supply-chain risk designation of Anthropic, ruling Thursday that the label was unlawful retaliation for the company's refusal to lift its restrictions on mass surveillance and lethal autonomous weapons, and for going public about the dispute. Judge Rita Lin found DoD violated both the First Amendment and due process, calling the designation "illegal and baseless." The ruling removes a tool the administration had begun using to sideline vendors whose public stances it opposed, and contractors across the defense-industrial base had been watching the case closely.
AUG 28
independent
SBA proposal would add 114,541 firms to small-business rolls
The new methodology eliminates the 1,500-employee cap for manufacturing and defense-industrial sectors while collapsing 978 NAICS codes into 338, and not a single firm gets kicked out.
SBA issued a proposed rule August 20 resetting small-business size standards across the economy. The net effect: roughly 114,541 additional firms become eligible for small-business set-asides, including an estimated 37,002 that already hold FY2025 federal contracts. Fewer than 200 firms lose eligibility (SBA blocked every proposed reduction, explicitly citing 2021) 2024 inflation and regulatory burdens. The methodology powering the rule is itself out for notice-and-comment, with both dockets closing September 21. Meanwhile, the old 1,500-employee ceiling disappears for manufacturing and defense-industrial codes, pushing shipbuilding from 1,300 to 2,300 employees and oil-and-gas drilling from 1,000 to 2,650. The expansion doesn't touch SBIR/STTR, where a separate 500-employee cap remains locked.
AUG 27
trade-press
Army all but abandons custom-built software for commercial buys
Driscoll's policy update makes commercial solutions the default acquisition path and tells cybersecurity officials to clear products faster, but the continuous ATO framework that would make that work is still in pilot.
Army Secretary Dan Driscoll's July 22 policy directive, published last week, orders the service to default to commercial solutions openings and other transaction authorities for software procurement, reserving custom development for cases where no commercial product meets operational needs. The memo also instructs cybersecurity officials to lean on continuous ATOs and reciprocity agreements to accelerate deployment. But the Army's continuous ATO framework (launched in pilot under CIO Leonel Garciga) hasn't yet reached production, leaving the security review model the policy depends on in an unfinished state.
AUG 27
trade-press
Sonu Shankar named Pentagon principal deputy CIO amid CMMC review
Shankar fills a role vacant since Leslie Beavers departed last September, arriving with weeks left in the CMMC Reform Task Force's 60-day review.
Sonu Shankar was sworn in Aug. 24 as the Pentagon's principal deputy CIO, filling a post that's been vacant since Leslie Beavers departed last September. An industry veteran whose résumé includes Phosphorus Cybersecurity and Arctic Wolf, Shankar reached the role through the Pentagon's BOND program, which embeds private-sector executives in advisory positions. He arrives with the CMMC Reform Task Force roughly two weeks from its 60-day deadline, the group's recommendations will determine whether Phase 2 requirements, suspended in July, are revived, reworked, or scrapped.
AUG 27
trade-press
Feinberg directs API supply-chain transparency for $10M+ contracts
The third industry-facing directive in three months, it deepens concerns that DoD's compliance demands are undercutting its own industrial-base expansion goals.
Deputy Defense Secretary Steve Feinberg's Aug. 18 memo directs contracting officers to obtain supply-chain cost transparency through APIs on commercial contracts over $10 million, and to establish fair profit margins by product line. Major system providers face stricter Cost and Software Data Reporting requirements. The memo is the latest in a sequence that industry says contradicts Defense Secretary Hegseth's pledge to cut bureaucracy and expand the defense industrial base. "These send a signal that DoD doesn't trust industry," said former acquisition executive David Berteau.
AUG 26
trade-press
ADI Urges DoD-Funded Enclaves to Ease CMMC Cost Burden
The trade group's filing proposes shifting assessment and infrastructure costs from thousands of individual small contractors to a single government-sponsored platform rather than leaving each firm to fund its own compliant environment.
The Alliance for Digital Innovation filed recommendations August 14 urging the Defense Department to sponsor a centrally funded, government-accredited enclave that small and nontraditional defense contractors could onboard into and inherit CMMC controls from. The filing, responding to DoD's July 13 RFI, also proposes a $500,000 contract-value threshold below which Level 2 third-party assessment costs would be recoverable. The recommendations arrive as the CMMC Reform Task Force prepares mid-September guidance that will shape the paused phase two rollout.
AUG 26
trade-press
Contractor may have used Grok to falsify VA financial records, CBCA finds
The first federal procurement tribunal finding of AI-falsified discovery documents exposes a detection gap the government has no plan to close.
The Civilian Board of Contract Appeals found that Venergy, a VA construction contractor, may have used Grok AI to alter audited financial statements during discovery, concealing contract data behind electronic white boxes on three years of filings. The board dismissed Venergy's $4.23 million claim against the VA as a sanction, while a VA OIG criminal investigation proceeds in parallel. The case is the first time a procurement tribunal has found generative AI used to manipulate discovery documents, and it lands just as GSA announced $13 billion in suspected procurement fraud, underscoring how far detection capabilities trail the tools available to bad actors.
AUG 26
trade-press
ITI pushes DOD to accept FedRAMP controls under CMMC
Reciprocity would end the wasteful re-auditing of controls FedRAMP already validated; the AI fast-track is a separate ask entirely.
ITI urged DOD to establish formal FedRAMP-CMMC reciprocity in comments filed during the Phase Two pause, arguing that re-auditing controls already validated under FedRAMP produces "duplicative cost without a proportionate increase in security." The filing proposes a "commercial solutions equivalency" pathway where contractors inherit platform-level FedRAMP assurances rather than re-certifying per project. DOD already recognized FedRAMP Moderate equivalency for cloud providers handling CUI in a January 2024 memo, ITI wants that extended to commercial software platforms broadly and codified in a common control matrix.
AUG 25
trade-press
GSA, Treasury begin quantum-safe migration as OMB deadline nears
GSA's PACS lab expansion will shape what vendors can sell to the government; Treasury's new task force is still convening.
The General Services Administration and Treasury Department launched separate post-quantum cryptography initiatives Tuesday, both flowing from President Trump's June 22 executive order on quantum cybersecurity. GSA is updating the Federal Identity, Credential and Access Management (FICAM) architecture and expanding its PACS lab to test quantum-resistant physical access control products, work that feeds directly into GSA's approved products list. Treasury stood up a Quantum-Readiness Task Force with workstreams spanning sector alignment and vendor readiness alongside digital asset risks. Agencies have about 30 days left to submit PQC Migration Plans to OMB and ONCD.
AUG 25
trade-press
GSA updates FICAM, PACS for post-quantum migration
The framework and lab updates are planning-stage moves; fielded quantum-resistant systems are still years away.
GSA announced Monday it will update the Federal Identity, Credential and Access Management framework to incorporate quantum-resilient algorithms and expand its FIPS 201 Physical Access Control System lab to test quantum-resistant solutions for federal building access. The moves follow a June executive order mandating post-quantum cryptography migration. Both announcements concern planning and testing infrastructure, not fielded systems. Agencies and contractors won't see operational changes until standards and procurement vehicles catch up.
AUG 25
trade-press
NRO presses primes to map sub-tier supply chain risks
The three-year-old NRO FAR Supplement clause asks contractors to illuminate, not eliminate, supply chain risk, and the agency grades itself a B-minus.
The NRO has been embedding a supply chain risk visibility clause in its FAR supplement for three years, Director for Systems Engineering Darwyn Banks disclosed at an INSA webinar. The clause requires prime contractors and second-tier subs to map their vendors and suppliers, not to eliminate risk, but to illuminate it. Banks gave the program a B-minus, calling the effort a long-term expectation rather than a one-off initiative.
AUG 25
trade-press
DIU Bridge Program targets cyber ATO bottleneck
Halving cyber authorization timelines would be the most significant ATO reform in a decade; the Bridge Program has twelve months to prove it's not another memo.
DIU launched the Bridge Program this week, led by Sarah Pearson, with a one-year mandate to open co-use classified facilities nationwide and "slash cyber authorization timelines by half." Multiple commercially owned sites are already contracted across nine states, with DIA, DCSA, and the military services partnering on a joint funding model. West's memo pins the problem precisely (promising technology dies in the clearance-authorization-budgeting cycle) but a memo doesn't fix the ATO pipeline; only demonstrated throughput does.
AUG 25
trade-press
Trump NSPM Directs Private-Sector Offensive Cyber Program
The 60-day deadline to stand up a framework for private-sector cyber effects operations leaves rules of engagement, liability, and escalation unanswered, questions that normally take years to resolve.
President Trump signed a National Security Presidential Memorandum on August 12 directing the government to establish a program for vetted private companies to conduct offensive cyber operations (including surveillance and "cyber effects") against foreign cybercriminal organizations. The administration has 60 days to deliver the framework. It's a sharp departure from decades of policy that reserved offensive cyber operations for intelligence agencies and the military. Companies would face vetting and oversight, but the legal and operational architecture (rules of engagement, liability, escalation protocols) doesn't exist yet. Standing it up in 60 days is the timeline; getting it right is the work of years.
AUG 25
trade-press
CUI rules keep fracturing because the government isn't a business
Former GSA Administrator Emily Murphy says the push for commercial technology runs into procurement requirements that commercial buyers simply don't have.
Former GSA Administrator Emily Murphy told Federal News Network the government's push for commercial technology keeps colliding with the reality that agencies aren't commercial buyers. The fractured CUI landscape illustrates the problem: NIST publishes one standard, but DoD spent a decade building CMMC around it while GSA issued its own procedural guide and the FAR Council's government-wide rule remains unfinished. "We always say we want the government to act more like a business, but at the end of the day, the government isn't a business," Murphy said. The protest rights, cyber requirements, and socioeconomic rules that distinguish federal procurement aren't temporary.
AUG 25
trade-press
OneGov AI deals expire Sept. 30 with no renewal plan
GSA's silence on what comes next leaves 3.4 million federal users and the agencies that depend on their work facing a cliff, not a transition.
Three marquee OneGov AI deals (OpenAI's ChatGPT Enterprise, Google's Gemini for Government, and Anthropic's Claude Enterprise) expire September 30. GSA hasn't disclosed renewal plans publicly and didn't respond to FedScoop's requests for comment. The promotional pricing, as low as $0.47 per agency, has put AI tools in front of roughly 3.4 million federal users. GWU procurement expert Jessica Tillipman warns the real cost is behavioral lock-in: unwinding months of institutional dependency is the switch cost, not the licensing fee. A Thomson Reuters study found 27% of government professionals already use unsanctioned AI tools, and experts warn that figure could climb if access disappears without a bridge.
AUG 25
trade-press
DOJ Clears TikTok for Agency Devices; FAR Hasn't Caught Up
The OLC opinion lifts the statutory ban, but FAR 52.204-27 still targets a ByteDance-controlled TikTok, and no agency has issued guidance on whether the new USDS venture is covered.
DOJ's Office of Legal Counsel issued a July 16 opinion finding the TikTok U.S. Data Security Joint Venture falls outside the No TikTok on Government Devices Act, clearing federal employees to use the app on government devices at their agency's discretion. The opinion preserves each agency's right to block TikTok, and agencies are already splitting: OPM permits it; others maintain blanket bans. For contractors, FAR 52.204-27 still defines a "covered application" as TikTok developed or provided by ByteDance or an entity ByteDance owns. ByteDance holds roughly 20 percent of the USDS venture, not a controlling stake, but the FAR hasn't been amended and no deviation has been issued.
AUG 25
trade-press
Defense PE scrutiny hinges on midterm subpoena power
DoD's Office of Strategic Capital is seeking $20.2 billion to attract the same private capital that Democratic lawmakers argue drives bankruptcy risk and supply-chain instability in the defense industrial base.
Private equity's expanding defense-sector footprint faces an inflection point after November's midterms. Democratic lawmakers have already introduced a bill requiring DoD review of any PE acquisition exceeding a 25% stake, and a recent letter to Defense Secretary Hegseth framed PE-backed contractors as more bankruptcy-prone than their peers, citing "aggressive debt-laden acquisition strategies." If Democrats flip a chamber, committee chairs with subpoena power could escalate oversight. The tension is structural: DoD's Office of Strategic Capital is simultaneously seeking $20.2 billion in FY2027 to attract private investment into priority technology areas.
AUG 25
trade-press
GSA Demands AbilityOne Audit After Finding Mislabeled Chinese Tech
The mandatory procurement program stands accused of selling foreign-made products labeled as American, leaving agencies including DoD with no choice but to buy them.
GSA Administrator Ed Forst ordered the AbilityOne Commission to audit every product sold through GSA procurement platforms by November 12, after discovering technology products labeled "country of origin: USA" that were manufactured in China, Taiwan, and Vietnam. Federal agencies (including DoD) are required by law to procure from AbilityOne, making the mislabeling both a Buy American Act violation and a national security vulnerability. GSA also flagged price markups of up to 55% and an executive-compensation gap: nonprofit CEOs earn $500,000 to $1 million while disabled workers average $33,000.
AUG 25
trade-press
White House and frontier labs hammer out voluntary AI safety testing framework
The framework ties federal funding and IP protections to pre-release model inspection, but testing standards, agency roles, and the inspection process itself remain undefined.
Top frontier AI labs (Google, OpenAI, Anthropic, and Meta) met with White House officials Tuesday to work through the details of a voluntary AI safety testing framework. Companies that participate would submit models for 30 days of government inspection before release, in exchange for access to federal funding and intellectual property protections. The Office of Science and Technology Policy has yet to settle how NIST and CISA will conduct or design those evaluations, and no one is saying publicly what was decided in the meeting. Senate Democrats, in a letter Tuesday, called the administration's approach "ad-hoc and unpredictable" and demanded an unclassified accounting of the policy.
AUG 25
trade-press
After eight years, White House revamps cyber supply chain risk data calls
The metrics agencies use to report supply chain risk haven't been updated since the SECURE Technology Act passed in 2018, leaving shared adversary threats invisible to systematic detection across government.
The White House Office of the Federal Chief Information Officer is reviewing all practices tied to NIST's cyber supply chain risk management guidelines, with a revamped data-collection process expected "in the near term." Senior advisor Cheri Benedict, speaking at an INSA webinar Tuesday, said the review will emphasize shared risk and adversarial threats, aiming for a "left of boom" posture that flags risky vendors before they're embedded in agency systems. The existing framework hasn't been updated since the SECURE Technology Act of 2018; the FASC created by that law took nearly seven years to issue its first exclusion order.
AUG 25
trade-press
PSC renews call for single cyber standard in CMMC reform comments
Seven years and multiple program pauses later, the trade group is still asking why a contractor serving both DoD and DHS faces two different sets of cybersecurity rules.
The Professional Services Council filed comments on the latest CMMC reform proposal, reiterating three longstanding concerns: inconsistent cybersecurity standards across federal agencies, the cost of demonstrating compliance versus actually improving security, and what happens to companies that already earned certifications under prior versions of the program. The consistency argument is the sharpest, a contractor serving both DoD and DHS faces different rules for fundamentally the same work, and PSC has been raising it since CMMC's inception.
AUG 25
trade-press
Trax alleges Army AI hallucinations skewed $450M award
The Army conceded an evaluation error that reads like a classic AI hallucination; proving AI misuse is nearly impossible when agencies don't disclose they're using it.
Trax International Corporation sued the Army in the U.S. Court of Federal Claims, alleging AI hallucinations produced a false weakness in its bid for a $450 million mission-support contract at White Sands Missile Range, and that no one on the evaluation board checked the output. The Army has conceded the error isn't supported by the record. The suit follows a similar protest by Salient CRGT earlier this year over undisclosed AI use in a Defense Department bid evaluation. The pattern exposes a structural gap: OMB rules require agencies to disclose high-impact AI use, but few civilian agencies are reporting procurement AI as high-impact, leaving contractors unable to prove misuse.
AUG 25
trade-press
Army shifts cloud management to Cyber Command
The move puts the organization that buys Army cloud under the command that defends it, folding procurement into the zero-trust and continuous-ATO push.
Army Secretary Dan Driscoll signed an order Monday reassigning the Enterprise Cloud Management Activity from the CIO's office to Army Cyber Command. ECMA runs the cArmy ecosystem, managing enterprise contracts, CSP relationships, and the CAMO vehicle that procures cloud for IL5 workloads and below. The move puts the organization that buys cloud under the command that defends it, folding procurement into the Army's zero-trust and continuous-ATO push. It arrives two months after former CIO Leo Garciga, who drove the continuous-ATO framework, departed.
AUG 25
independent
SBA Drops Race Presumption from 8(a) Disadvantage Rules
The final rule codifies what's been practice since the 2023 Ultima ruling: every new individually-owned applicant must now document both group discrimination and personal material harm.
On August 11, SBA issued a final rule formally removing the race-based rebuttable presumption of social disadvantage from the 8(a) Business Development Program, codifying the framework that's been in place since the 2023 Ultima Services ruling. New individually-owned applicants must now provide evidence that their racial, ethnic, or cultural group faced discrimination and self-certify they suffered "material harm", defined as lost access to or diminished economic opportunity. Current 8(a) participants are grandfathered; the rule takes effect September 10.
AUG 25
trade-press
PSC urges CMMC alignment with NIST 800-171 Rev. 3
The contracting group wants risk-tiered assessments but acknowledges that easing small-business requirements widens the supply-chain attack surface.
The Professional Services Council filed comments Aug. 14 on DoD's CMMC review, asking for alignment with NIST 800-171 Rev. 3, reciprocity with FedRAMP Moderate, and grandfathering of existing Level 2 certifications. The filing also recommends risk-tiered C3PAO assessments, then undercuts its own case, conceding that "sophisticated threat actors routinely target the least-protected organization in a supply chain" and "the sensitivity of CUI does not change based on company size."
AUG 25
independent
COFC Finds Jurisdiction Over SBIR Phase III Protests
Routing follow-on SBIR work through existing task orders instead of awarding a Phase III contract doesn't immunize the decision from bid protest review, the court held.
The Court of Federal Claims ruled in Strategi Consulting v. United States that it has jurisdiction to hear protests over SBIR Phase III awards, rejecting the Air Force's three arguments for dismissal: that no "procurement" occurred under the Tucker Act, that the FASA task order bar applied, and that the claim lacked redressability. The court applied a preponderance-of-evidence standard and found the Air Force had reviewed Strategi's Phase III proposal, declined to award the contract but requested its codebase, then routed similar TacSRT work to other contractors under existing task orders. For SBIR Phase II performers who watch their follow-on work get handed to someone else, the decision clears a path to COFC that the government argued didn't exist.
AUG 25
independent
TINA Threshold Hits $10M; FAR Still Shows $2.5M
The statutory change is self-executing, and contractors who wait for the FAR Council to catch up risk defective-pricing exposure on every action between $2.5 million and $10 million.
The Truthful Cost or Pricing Data threshold for DoD contracts rose from $2.5 million to $10 million on July 1, 2026, per FY 2026 NDAA Section 1804(c). The statute is operative on its own terms, but FAR 15.403-4 still recites $2.5 million and implementing DFARS rules haven't caught up. Because the change keys to contract date and is not retroactive, the two thresholds coexist for years. Primes and subs must segregate pre- and post-July 1 actions immediately: a modification to a legacy contract still triggers certification at $2.5 million, and misapplying the threshold on a $2.5 million to $10 million deal exposes contractors to downward price adjustment plus interest and potential False Claims Act risk.
AUG 25
trade-press
Trump Offensive Cyber Memo Silent on Contractor Liability
The program asks private companies to act as government proxies in offensive operations but leaves them exposed to civil suits, foreign prosecution, and loss of CISA 2015 protections.
President Trump's Aug. 12 national security memorandum directs DHS and DOJ to create a program letting vetted cybersecurity companies conduct offensive cyber operations against transnational criminal groups under government supervision. Participating firms must post a $1 million bond and operate under written government approval. But the memo includes no civil liability shield, and former DOJ cyber official Leonard Bailey warns companies risk losing CISA 2015 protections by acting as government proxies, buying, as he put it, "a lot of risk without much protection."
AUG 25