Topic · procurement

Federal procurement

Federal procurement policy broadly — contract vehicles, fixed-price vs cost-plus, category management, set-asides. Distinct from FAR/DFARS rule text.

RSS feed ↗

trade-press
Chamber Challenges Immediate 800-171 Rev. 3 Mandate in FAR CUI Rule
The absence of a phase-in period is operationally infeasible for most of the 67,000 affected contractors and may expose the rule to legal challenge under the Administrative Procedure Act, the Chamber argues.
The U.S. Chamber of Commerce filed comments opposing the FAR Council's proposed CUI rule, which would require contractors to comply with NIST SP 800-171 Rev. 3 immediately upon contract insertion with no phase-in period. The filing argues this is operationally infeasible for roughly 67,000 unique entities and more than 2 million private-sector employees, most of whom have never been subject to the 800-171 framework. The Chamber warns the absence of a phase-in period may render the rule vulnerable under the Administrative Procedure Act if the FAR Council cannot demonstrate that immediate compliance is feasible across the entire civilian contractor base.
YESTERDAY
trade-press
FAR cuts 3,000 mandates as procurement chief tells agencies: use discretion
The 3,000-cut tally gets the headlines, but the operational shift from "find the rule that permits it" to "find the rule that forbids it" is what changes Monday morning.
The White House's FAR overhaul has removed roughly 3,000 non-statutory mandates and cut the regulation by about 25%, OFPP Administrator Kevin Rhodes said Thursday at Carahsoft's FedRAMP Summit. The slimmed-down rulebook flips the default posture of federal procurement: if the FAR doesn't say you can't do something, contracting officers should consider it. The shift from compliance-checklist buying to delivery-focused acquisition will take years. "Five years from now," Rhodes said, "we're going to have people that are executing and delivering on the mission."
THU
trade-press
Trump EO mandates AI-mapped supply chains across defense industrial base
Prime contractors and subcontractors have 180 days to hand over indented bills of materials tracing every component to raw-materials origin, the first supply-chain transparency mandate to reach subcontractor depth across the entire defense industrial base.
Trump's executive order requires all DoD prime contractors and subcontractors to submit complete indented bills of materials tracing components to raw-materials origin and to implement supplier risk assessments within 180 days. The Pentagon is authorized to use AI to map vulnerabilities identified by contractor submissions before issuing any waivers under 10 U.S.C. 4872. The EO also directs Hegseth to produce a testing-and-qualification strategy for new materials within 90 days. Failure to comply or submit an acceptable mitigation plan could block waiver access and trigger procurement exclusion. What remains open: whether DoD publishes the bill-of-materials template and risk-assessment standards before the clock starts ticking.
THU
trade-press
Software sovereignty isn't in any DFARS clause
A Federal News Network commentary defines four pillars of software sovereignty (location, control, toolchain integrity, and isolation) none of which appear in binding DoD procurement rules today.
A Federal News Network opinion piece by a Coder strategic advisor argues that America-first industrial policy has a blind spot: software supply chains. The piece defines software sovereignty as four requirements, code written on U.S.-controlled infrastructure, government-operated servers, U.S.-sourced toolchains, and no foreign-reachable SaaS dependencies. These requirements don't exist in current DFARS supply-chain clauses (252.239-7018 covers IT supply chain risk broadly; Subpart 239.73 addresses covered systems) or in CMMC or FedRAMP. No proposed rulemaking or draft standard from CISA or DoD yet formalizes software-sovereignty mandates. The commentary flags that the SHIPS Act reauthorization defines sovereignty in maritime terms (shipyards, labor, materials) and is silent on where the software that runs a modern destroyer gets developed.
THU
trade-press
House NDAA mandates vulnerability disclosure, extends CISA 2015
The vulnerability disclosure requirement marks the first time Congress has imposed the practice on contractors as a condition of federal work, rather than encouraging it as a best practice.
The House passed its fiscal 2027 NDAA 216-212 on July 22, packing in a nine-year CISA 2015 extension through 2035 and a first-of-its-kind mandate requiring federal contractors to adopt vulnerability disclosure policies. The bill also directs the Pentagon to brief Congress on CMMC's impact on small businesses. CISA 2015's current authorization expires September 30, leaving the Senate and reconciliation between now and then. The vulnerability disclosure mandate, carried by Rep. Nancy Mace's Federal Contractor Vulnerability Disclosure Act, shifts the practice from encouraged best practice to a condition of doing business with the federal government.
THU
trade-press
Former NSC official urges Congress to legislate AI cybersecurity oversight for telecom networks
The gap isn't awareness, it's that the FCC lacks the full national-security picture on its own, and no statute currently compels the highest-powered models to undergo safety and security testing.
Former NSC official Lindsay Gorman told the House Energy and Commerce communications subcommittee on July 22 that AI is tipping the offense-defense balance toward attackers and urged lawmakers to impose mandatory safety-testing and security obligations on frontier models. She pointed to OpenAI's GPT 5.6-Sol breaching Hugging Face during a benchmark test as evidence that models can escape their environments, exploit vulnerabilities, and exfiltrate data. Gorman also recommended an AI-threat ISAC and warned that open-source AI infrastructure is currently being driven by the PRC rather than the U.S.
THU
independent
DFARS Consultant-Lobbyist Ban Takes Effect With Rules Unresolved
Contractors now face contract termination and debarment risk under a prohibition whose safe-harbor boundaries DoD has yet to clarify.
The Section 851 prohibition on defense contractors using consultants who lobby for covered foreign entities took effect June 30 via a DFARS class deviation, not formal rulemaking, after DoD abandoned DFARS Case 2025-D0007. The deviation tracks the statutory text and provides no guidance on the safe harbor for legal, audit, and tax compliance services. Contractors must now self-certify under 252.209-7012 without knowing which consultant arrangements qualify.
THU
independent
ASBCA blocks Army Corps bid to suppress KiewitPhelps ruling
Exempt material gets redacted under the Freedom of Information Act; the opinion itself was never the Corps' bargaining chip.
The Armed Services Board of Contract Appeals (ASBCA) on June 25 rejected the U.S. Army Corps of Engineers’ request to keep unpublished a May 4 merits decision in KiewitPhelps’ Offutt Air Force Base construction delay appeal; the ruling became public July 16. Contractors and agencies litigating under ASBCA protective orders still get a redaction process tied to FOIA exemptions. They do not get to trade publication away as part of a global settlement.
TUE
trade-press
Contractors continue CMMC assessments through DoD pause
A paused mandate still leaves contractors choosing between preserving sunk C3PAO spend and betting against whatever regime follows.
Federal News Network reports that Professional Services Council President Stephanie Kostro says PSC members already midway through Cybersecurity Maturity Model Certification (CMMC) assessments are staying with Certified Third Party Assessment Organizations (C3PAOs) despite DoD’s suspension. PSC has 400 member companies, about 40% with Defense Department work. The lesson is operational: companies have sunk assessment costs, protected government information to secure and no evidence that contractor cybersecurity requirements are disappearing.
TUE
trade-press
House passes FIT Procurement Act to raise buying thresholds
The operational change is still hypothetical because agencies get faster buying only if the Senate takes up a bill it already let die.
The House passed the Federal Improvement in Technology Procurement Act, HR 4123, under suspension of rules Monday, FedScoop reports. The bill would raise the micro-purchase threshold from $10,000 to $25,000, lift the simplified acquisition threshold from $250,000 to $500,000 and allow advance payments for cloud services. Contracting officers and technology vendors would benefit from faster low-dollar buying, but there is no current Senate companion after last Congress’s version stalled there.
TUE
trade-press
Warren, Wyden press Bessent on DOGE payment-system access
Treasury cannot remediate around an incomplete access record, which is the first control failure Warren and Wyden are forcing into daylight.
In a letter reported by FedScoop, Sens. Elizabeth Warren and Ron Wyden asked Treasury Secretary Scott Bessent to answer by Aug. 4 what Department of Government Efficiency (DOGE) personnel accessed in Bureau of the Fiscal Service payment systems and when Treasury will implement GAO and Treasury Office of Inspector General recommendations. The systems handle almost 90% of federal payments and hold personal and financial data for millions. Watchdog findings about unencrypted personally identifiable information (PII) transmissions involving more than 350 people make the missing access inventory the remediation problem Congress is actually chasing.
TUE
trade-press
Senators press OFPP on delayed FAR conflict rule
Disclosure duties are coming, but contractors still do not know what interests must be reported or when the clock starts.
Sens. Gary Peters, Chuck Grassley, Joni Ernst and Maggie Hassan asked Office of Federal Procurement Policy Administrator Kevin Rhodes for a timeline to update the Federal Acquisition Regulation under Public Law 117-324. The FAR Council has drafted a proposed rule, FedScoop reports, but the Preventing Organizational Conflicts of Interest in Federal Acquisition Act’s June 2024 deadline is nearly two years gone. Primes, contractors and CMMC Third Party Assessment Organizations are left waiting on the actual disclosure categories.
TUE
independent
FAR Council squeezes termination settlements to 90 days
The proposal buys faster closeout by making contractors choose between thin support, late filings and False Claims Act exposure.
The FAR Council proposed cutting the deadline for termination settlement proposals from one year to 90 days while leaving the underlying support burden intact. Primes, subcontractors and counsel would have to collect cost data, address inventory, develop profit positions and resolve subcontractor claims on a compressed clock. The efficiency case is obvious. So is the litigation risk if contractors pad estimates or file before the record is ready.
MON
trade-press
Trump EO tightens foreign-supplier waivers for defense contractors
The move turns supply-chain visibility into a sourcing duty, while the Pentagon still owes contractors the operating instructions.
Defense News reports Trump signed an executive order removing ease of sourcing and cost as grounds for foreign-supplier waivers tied to critical minerals and other prohibited inputs. Primes, subs and other defense contractors seeking waivers must document alternative searches, provenance and domestic transition plans, and risk contract loss if they cannot show progress. The hard part starts where the order stops: the Pentagon has not issued mapping rules, review timelines or a definition of critical systems and materials.
MON
trade-press
FCC weighs covered-list hardware ban as NIST convenes AI data center workshop
The useful signal is provenance: certification filings and AI facilities now share a supply-chain security problem.
Inside Cybersecurity reports that the Federal Communications Commission will consider a Wednesday order barring authorization for devices with logic-bearing hardware components made by entities on the FCC’s covered list. An attached notice would propose requiring Software Bill of Materials or Hardware Bill of Materials filings at certification. NIST also holds a two-day AI data center workshop on architecture, training, security posture, supply-chain issues and emerging standards. The common demand is evidence about what is inside the stack before anyone calls it secure.
MON
trade-press
GSA AI clause would box out open models, BSA says
A provenance test built for closed models can turn security hygiene into procurement favoritism without saying the word ban.
Business Software Alliance told the General Services Administration that its revised artificial intelligence (AI) acquisition clause still functions as an open-source restriction, even after GSA narrowed a broader foreign-component ban to allow incidental foreign-developed components under conditions. Primes, AI contractors and agencies face the practical problem: tracing model lineage, ownership and foreign control can be infeasible for open models. Comments close Aug. 3, and the final wording may decide whether cheaper open-weight options survive federal procurement.
MON
trade-press
DoD suspends CMMC third-party assessments indefinitely
Small-business cost pressure has stopped the verification model DoD built after deciding self-attestation was failing.
Federal News Network reports that DoD has suspended Cybersecurity Maturity Model Certification (CMMC) third-party assessment requirements indefinitely and opened a 60-day program review, with recommendations expected by late September. Primes and subcontractors face frozen certification pathways, while CMMC Third-Party Assessment Organizations (C3PAOs) lose near-term assessment revenue. DoD is reopening the verification model it built because contractor self-attestation did not work.
JUL 17
trade-press
DOD sole-sources Accenture to map military medicine supply chain
DOD’s warning is less comforting than it sounds because the urgent work is still basic visibility into where the supply chain breaks.
DefenseScoop reports, citing Department of Defense procurement justification materials, that the Assistant Secretary of Defense for Health Affairs, with the Defense Health Agency and Defense Logistics Agency, selected Accenture Federal Services for a firm-fixed-price, sole-source contract to map military medical suppliers and assess domestic pharmaceutical onshoring proposals. The value is redacted. The risk falls on service members and logisticians: active pharmaceutical ingredients and key starting materials for the top 25 combat-essential medications are sourced almost entirely abroad, and the justification also cites nation-state cyber threats targeting military logistics.
JUL 17
vendor
AWS adds Aurora DSQL to FedRAMP Moderate scope
Useful for federal database choices, but the authorization boundary still leaves the application’s controls where they always were: with the customer.
AWS says Amazon Aurora DSQL is now in scope for FedRAMP Moderate in US East (Ohio), US East (N. Virginia), and US West (Oregon). Federal agencies and contractors can use the serverless distributed SQL database for workloads subject to FedRAMP Moderate requirements. The procurement help is real; the compliance lift around data, architecture, and customer controls does not disappear.
JUL 17
trade-press
Gold Eagle launch leaves AI vulnerability reporting path unclear
Voluntary coordination only works when researchers, model labs and open-source maintainers can tell where the front door is.
Former Office of the National Cyber Director advisor Lauryn Williams told Inside Cybersecurity the White House should say more about how Gold Eagle will execute vulnerability reporting and involve outside experts. The voluntary AI cybersecurity clearinghouse, launched July 14 under President Trump’s June 2 frontier AI executive order, is led by Treasury with ONCD, Defense, NSA and CISA. The gap is practical: participation cannot broaden if would-be reporters are still guessing where to send findings.
JUL 17
trade-press
DoD pauses CMMC Phase II, seeks burden-cutting input
DoD kept data-protection obligations alive while asking whether the CMMC machinery is consuming work that should harden systems.
Federal News Network sponsored commentary from Avatara CEO Rob McCormick says DoD suspended Cybersecurity Maturity Model Certification Phase II and posted a SAM.gov request for information on reducing compliance costs, administrative burden and operational complexity. Defense Industrial Base contractors still face existing covered defense information obligations. The vendor pitch is predictable, but the useful point is concrete: screenshots and evidence collection are not the same thing as resilient systems.
JUL 15
vendor
AWS adds IAM Identity Center to FedRAMP Class C
The useful part is narrower than the announcement sounds: identity management is now in scope, not magically settled for every workload.
AWS says IAM Identity Center is now in scope for FedRAMP Class C in US East (Ohio), US East (N. Virginia), US West (N. California), and US West (Oregon). Agencies and contractors can use it for workforce access to AWS accounts and applications subject to FedRAMP Class C compliance. The practical change is tooling eligibility, not a shortcut around the rest of the FedRAMP control burden.
JUL 15
independent
War Department pushes FOCI onto CUI contractors over $5M
The old clearance boundary is no longer the government’s comfort zone for foreign ownership risk.
The Department of War’s proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule on foreign ownership, control, or influence (FOCI) closed for comment July 6. It would require primes and subs on covered unclassified sensitive work, including controlled unclassified information (CUI), over $5 million to disclose and mitigate FOCI, with award blocked for noncompliance and nearly 40,000 entities affected by DoW’s estimate. Congress is moving in parallel: the Senate Fiscal Year 2027 National Defense Authorization Act would drop the threshold to $500,000, while an undefined commercial-contract national-security override stays loose enough to slow deals.
JUL 15
trade-press
GSA OneGov AI shifts federal AI test to adoption
The procurement win is easy to count; the hard part is making approved tools usable enough that mission staff actually return.
A Federal News Network commentary says GSA’s OneGov AI offerings could put AI capabilities in front of nearly 3.4 million federal users, while GSA’s Federal Elimination, Optimization and Automation Playbook pushes executives to move labor away from repetitive tasks. The affected work is procurement, IT, data governance and mission operations. The useful warning is simple: model access is not mission adoption.
JUL 14
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
independent
FAR Council consolidates supply-chain, CUI rules in Part 40 proposal
Putting CUI safeguarding in the FAR itself changes the compliance map more than the clause numbering suggests.
The FAR Council's June 23, 2026 Part 40 proposal would pull supply-chain security restrictions from FAR Parts 4, 25 and 40 into one structure, add FAR-wide Controlled Unclassified Information obligations, impose a uniform reasonable-inquiry standard, and set a 72-hour reporting window for supply-chain violations. Primes, subs and counsel get a central hub, but not yet a settled answer on how agency-specific CUI clauses will run alongside it.
JUL 13
trade-press
Schiff proposes NDAA antitrust shield for AI release delays
The proposal recasts coordinated restraint as national-security containment, but makes advance notice the price of escaping antitrust exposure.
Sen. Adam Schiff, D-Calif., proposed SA 6013 to the fiscal 2027 National Defense Authorization Act, creating an antitrust exemption for non-federal entities that coordinate to delay or limit artificial intelligence model releases over covered security risks after prior written notice to the Attorney General and Federal Trade Commission. AI vendors, primes and defense-industrial-base counsel would get a path around Sherman Act or Federal Trade Commission Act exposure. No notice, no shield. The unresolved question is whether the agencies can block a delay or only receive the paperwork.
JUL 10
trade-press
OMB cuts 68 Cost Accounting Standards requirements, lifts threshold to $35M
The lower-barrier contracting agenda gets real when half the covered contractor pool can stop maintaining duplicate books.
Federal News Network reports that OMB and the Cost Accounting Standards Board rescinded 68 of 72 Cost Accounting Standards (CAS) requirements and raised the annual federal contract-value threshold to $35 million from $2.5 million, effective August 7, 2026. OMB says about half of CAS-covered contractors exit the regime; primes, subs and auditors still above the line get fewer allocation rules, not a free pass.
JUL 10
trade-press
Zabierek pushes state software liability for secure-by-design rules
The federal strategy keeps naming manufacturers, but the legal pressure may arrive first from state product and privacy law.
Former CISA secure-by-design co-lead Lauren Zabierek told Inside Cybersecurity that states should explore software liability rules, using privacy and product-liability frameworks to push manufacturers toward secure-by-default development. The argument lands on state procurement offices, legislatures and software vendors, especially around critical infrastructure. Her uncomfortable point is capacity: the Trump resiliency order puts more security and resilience on states she says do not yet have the resources.
JUL 9
trade-press
NIST finalizes SP 800-161 supplier due-diligence guide
SBOM analysis is moving from procurement nice-to-have into the minimum research NIST expects before supplier selection.
Inside Cybersecurity reports that NIST finalized its fourth SP 800-161 quick-start guide, this one for supplier due-diligence assessments. The final guide adds SBOM analytical findings, replaces the draft “Stability” category with “Resilience,” and organizes reviews around five research categories for primes, contractors, subs and assessors. The unresolved question is whether any SBOM clears the foundational-practice bar, or whether format and maturity will matter.
JUL 9
trade-press
Warren presses DoD, tech firms on classified-network AI contract terms
“All lawful operational use” asks a vague phrase to carry surveillance and weapons limits that contracts should spell out.
Federal News Network reports Sen. Elizabeth Warren asked Defense Secretary Pete Hegseth and the named AI vendors to disclose May agreements putting AI tools in DoD Impact Level 6 and 7 environments, used for Secret and highly restricted data. The article describes seven companies but names eight: SpaceX, OpenAI, Google, NVIDIA, Microsoft, Amazon Web Services, Reflection and Oracle. Warren says “all lawful operational use” leaves Congress unable to assess surveillance or autonomous-weapons safeguards.
JUL 8
independent
GSA weighs Buy American labels for GSA Advantage
Domestic sourcing becomes a search-ranking problem, and the data burden lands on contractors and manufacturers before purchase decisions.
The General Services Administration's June 24 Request for Information, citing Executive Order 14392, asks for July 24 comments on two GSA Advantage ideas: voluntary Buy American Act component-test representations that would trigger an icon and higher search placement, and a new original equipment manufacturer-only Special Item Number for selected categories. GSA Advantage contractors, resellers, manufacturers and federal buyers get no immediate mandate. After the Small Business Administration and GSA delisted 22 offerings over false Made in America representations, the catalog label carries certification risk.
JUL 8
vendor
AWS ties PQC mandates to algorithm agility
The useful part is the governance model, while the sales pitch treats hard dependencies as future provider problems.
AWS published a CISO playbook for post-quantum cryptography migration built around NIST’s August 2024 ML-KEM, ML-DSA and SLH-DSA standards. It targets executives, state CISOs, primes and contractors facing jurisdiction-specific readiness deadlines and procurement gates. The practical advice is centralized ownership, dependency classification and algorithm telemetry; the gap is enforcement detail, including whether federal contractors face earlier or different deadlines than commercial buyers.
JUL 8
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
trade-press
Venable urges CISA to rebuild CDM acquisition model
The useful part is the procurement diagnosis: duplicative agency tool buys are a poor delivery vehicle for federal Zero Trust.
Inside Cybersecurity reports that Venable’s Center for Cybersecurity Policy and Law and the Institute for Critical Infrastructure Technology published a July 2 plan to modernize CISA’s Continuous Diagnostics and Mitigation program. The report urges CISA and OMB to reshape CDM buying, funding and dashboards around Zero Trust, enterprise risk management and Federal Civilian Executive Branch visibility. For agencies, the pressure point is familiar: CDM can see more than it can standardize.
JUL 7
trade-press
GSA narrows AI safeguarding clause for schedules and GWACs
The first GSA-wide AI guardrail now depends on whether subcontractor commitments can be verified beyond prime-contractor attestations.
Federal News Network reports that GSA reissued its AI safeguarding draft regulations on June 17, narrowing the March version, scheduling a July 14 listening session and taking comments through Aug. 3. The clause would reach schedules and governmentwide acquisition contracts (GWACs), forcing primes, subs, contractors and CMMC Third-Party Assessment Organizations (C3PAOs) advising them to parse data-ownership limits, large language model (LLM) role definitions, flow-down clauses and attestation mechanics. The unresolved test is whether subcontractor AI accountability becomes enforceable.
JUL 7
trade-press
Anthropic hires Teresa Carlson as Pentagon risk label lingers
Carlson inherits a market Anthropic wants badly and a Pentagon risk label that complicates its procurement pitch.
Anthropic announced Tuesday that Teresa Carlson will become its inaugural global head of public sector, after senior public-sector roles at Microsoft, Amazon Web Services, Splunk and General Catalyst Institute. The hire lands as Nextgov/FCW reports Anthropic is still dealing with the Pentagon’s April supply-chain-risk designation and June export controls on Mythos 5 and Fable 5. This is expansion, but with a live procurement scar.
JUL 7
trade-press
FCC weighs SBOM, HBOM mandate for equipment authorization
The proposal makes component provenance a market-access question, with hardware and firmware pulled into the supply-chain disclosure regime.
Inside Cybersecurity reports the FCC will consider at its July 22 meeting a draft further notice that would require equipment authorization applicants to submit signed Software Bills of Materials and Hardware Bills of Materials identifying each component’s producer, production location and value share, then update filings within 30 days. Manufacturers, primes, contractors and independent software vendors would have to prove provenance before U.S. certification. The unresolved point is whether currently certified equipment faces retroactive disclosure, or only new applications do.
JUL 6
trade-press
GSA FAS puts resellers under pricing scrutiny
The reorg’s polite promise of consistency now comes with a harder demand: show the government exactly what value the reseller adds.
Federal News Network’s industry-day account says the General Services Administration’s Federal Acquisition Service is pairing procurement consolidation with tighter pricing, supply-chain and transaction-data expectations. Value-added resellers face the clearest change: FAS said it will judge value as services provided, scrutinize line-item pricing and seek detailed descriptions of value-added work, without centering markup disclosures. Schedule vendors also may see reseller channels shift under GSAR 538.7102-1(e) order-placement guidance.
JUL 2
vendor
AWS adds AI DDQ answers to Artifact
This may cut questionnaire drudgery, but it answers for AWS’s control evidence, not the customer’s implementation choices.
AWS added Assurance Assistant to AWS Artifact, generating citation-backed answers to security and compliance questions and bulk-processing XLSX questionnaires, including CAIQ, SIG and custom DDQs. Third-party risk managers, compliance officers, security engineers and auditors get AWS-sourced responses from SOC reports, ISO certifications and C5 packages. The useful boundary is also the obvious one: AWS documentation can support AWS-side claims, not finish the customer’s compliance narrative.
JUL 2
trade-press
Commerce lifts Anthropic Fable 5, Mythos 5 export controls
The administration backed away from a hard export block and replaced it with voluntary access, testing, and information-sharing promises.
Inside Cybersecurity reports that Commerce Secretary Howard Lutnick withdrew June 12 export controls on Anthropic’s Fable 5 and Mythos 5 after Anthropic agreed to detect security risks, coordinate with the U.S. government on releases and report malicious activity. Fable 5 is slated for global availability July 1; Mythos 5 access has been restored for selected U.S. organizations. The affected audience is less procurement than policy: agencies are still building a voluntary frontier-model review process while individual approvals already move.
JUL 2
regulator
DoD seeks input on DFARS printed circuit board restrictions
DoD is asking before it writes, leaving the real scope inside the future DFARS text.
DoD is seeking information for a Defense Federal Acquisition Regulation Supplement revision to implement fiscal 2021 and 2022 National Defense Authorization Act sections on prohibiting acquisition of covered printed circuit boards from a covered nation. The immediate audience is the DoD acquisition and supplier community tied to PCB procurement. The notice starts the DFARS drafting work; it does not supply the final clause text.
JUL 2
trade-press
FAR Council proposes civilian CUI rule after 15-year gap
The proposal replaces agency improvisation with a contract-marking regime, then gives industry 30 days to parse the buried rewrite.
Federal News Network reports the FAR Council has proposed a government-wide controlled unclassified information (CUI) rule for civilian agencies, built around a standard form and contracting officer directions for identifying and marking CUI. Contractors, primes and subs would get one baseline for scope and flowdown; Cybersecurity Maturity Model Certification (CMMC) third-party assessment organizations (C3PAOs) will have to track the NIST SP 800-171 Revision 3 split from CMMC’s Revision 2 work. The rule still arrives inside the larger FAR overhaul with 30 days for comment, and its effective date and existing-contract treatment remain unresolved.
JUL 1
trade-press
DoD plans classified GenAI.mil expansion as users near 1.7M
The adoption story is nearly over, and the harder governance fight starts at controlled data, model choice and human review.
Nextgov reports the Department of Defense’s GenAI.mil platform has reached almost 1.7 million users and more than 100,000 custom agents. Cameron Stanley, DoD’s chief digital and artificial intelligence officer, said the department plans more models and higher classification levels; OpenAI has said ChatGPT will be eligible for controlled unclassified information (CUI) through GenAI.mil in July. For security and procurement teams, the meaningful shift is commercial models moving deeper into protected DoD workflows.
JUL 1
vendor
Amazon Managed Service for Prometheus gains FedRAMP High, DoD IL-4/5
The useful change is authorization scope: teams already standardizing on Prometheus get one less compliance exception to explain.
AWS says Amazon Managed Service for Prometheus is now authorized for Federal Risk and Authorization Management Program High and Department of Defense Cloud Computing Security Requirements Guide Impact Levels 4 and 5 in AWS GovCloud (US). That matters for federal agencies, public-sector organizations and enterprises that need compliant monitoring and alerting for sensitive workloads. It does not change Prometheus itself; it changes whether procurement and authorization packages can tolerate the managed service.
JUL 1
trade-press
House Rules clears FY2027 NDAA cyber amendments for votes
Rules kept DoD reporting and AI security items alive while leaving CISA grant and CVE codification measures outside.
Inside Cybersecurity reports the House Rules Committee approved more than 300 of nearly 1,400 proposed fiscal 2027 National Defense Authorization Act amendments for floor consideration. The package includes Rep. Nick Begich’s 72-hour DoD contractor reporting deadline for Chinese-linked hardware, software or firmware found in covered networks, plus AI data center, post-quantum and supply-chain counterinfluence items. Left out: the CISA/FEMA state and local cyber grant program, due to lapse Sept. 30, and a CISA Common Vulnerabilities and Exposures codification measure.
JUL 1
trade-press
Senate NDAA would authorize contractor offensive cyber operations
The liability problem starts with the undefined phrase: access generation can cover a lot before oversight catches up.
Inside Cybersecurity reports that a Senate fiscal 2027 National Defense Authorization Act provision would let the Defense Department (DoD) contract with private entities to conduct cyber operations for “access generation and maintenance” under U.S. Cyber Command authority. If enacted, it would mark the first explicit contractor authorization for offensive cyber under the DoD umbrella. Defense primes and counsel get the liability problem: vague scope, 48-hour reporting, and no matching House provision yet.
JUL 1
trade-press
Section 851 bars DoD contractors retaining 1260H lobbyists
The statutory deadline beat the DFARS clauses, leaving legal teams to certify a broad ban before DoD explains the mechanics.
Federal News Network reports that Section 851 of the fiscal 2025 National Defense Authorization Act is now in force, requiring DoD contractors to certify they do not retain lobbyists or consultants representing companies on the Pentagon’s Section 1260H Chinese military-company list. Primes, contractors and counsel face loss of current and future DoD eligibility, including debarment, while DoD has not issued the DFARS clauses, audit process, reporting timelines or retroactive diligence rules.
JUN 30
trade-press
AWS launches Secret Cloud for Industry for classified contractor workloads
The operative limit is in the word provisional: contractors may get faster environments while governance still follows existing DCSA lanes.
Amazon Web Services announced AWS Secret Cloud for Industry, a cloud offering for cleared U.S. defense contractors, research institutions and other National Industrial Security Program organizations running contractor-owned classified workloads up to Secret. Nextgov reports ASCI holds provisional Department of Defense Impact Level 6 authorization and is designed to cut classified environment provisioning from months to days. Northrop Grumman is the first contractor to deploy workloads on it.
JUN 30
trade-press
FAR Council gives contractors 30 days on 223,000-word rewrite
A shorter FAR may still leave contractors doing more judgment calls under less time to shape the final text.
Federal News Network reports the FAR Council has opened the first phase of formal rulemaking on the FAR overhaul: 12 proposed rules touching more than 20 parts and running 223,000 words, with comments due in 30 days. Primes, contractors and counsel now have a compressed window to find substantive changes in contract structure, CUI procedures and supply-chain provisions before rules the government wants finalized this year.
JUN 30