FAR Council gives contractors 30 days on 223,000-word rewrite

Federal News Network’s interview with Haynes Boone partner Dan Ramish puts a hard number on the first formal rulemaking tranche for the FAR overhaul: 12 proposed rules, more than 20 FAR parts, 223,000 words and a 30-day comment period. That is not a normal reading assignment for primes, subcontractors or outside counsel. It is a deadline strategy, and it shifts the practical burden from “watch the rewrite” to “find the contract-risk changes before the window closes.”

The important movement is procedural and substantive at once. The first phase of the overhaul used deviations. This phase moves into notice-and-comment rulemaking, with the FAR Council asking for public input before final rules. Federal News Network reports that an OMB official said the goal is to finalize all proposed rules by the end of the calendar year. That pace matters because a comment not filed now is not preserved for the version contractors may have to live with later.

The larger policy move is away from bright-line compliance text and toward contracting-officer judgment, with some material removed from the regulation and placed in companion guidance. Acquisition.gov describes the overhaul as an effort to return the FAR to statutory requirements, rewrite it in plain language and move practical strategies into non-regulatory buying guides outside the FAR, https://www.acquisition.gov/far-overhaul. That may make solicitations cleaner. It also means contractors will need to read clauses, matrices, buying guides and agency practice together, because fewer words in the FAR does not automatically mean fewer ways to lose an argument after award.

For cyber and supply-chain teams, the near-term work is not abstract. Ramish said the package includes the long-pending FAR controlled unclassified information rule, which would create a standard form and procedures for agencies to identify CUI that must be managed and safeguarded during performance. He also said the proposal narrows the definition of CUI incidents, removes contractor liability language, changes training requirements, aligns cyber incident reporting timeframes at 72 hours and would use NIST Special Publication 800-171 Revision 3 as the baseline for nonfederal systems with CUI, while DoD is still applying Revision 2. Those are the items contractors should validate in the text, not summarize from memory.

The supply-chain pieces deserve the same treatment. The interview describes consolidation of several regimes, including Federal Acquisition Supply Chain Security Act actions, Section 889 covered telecommunications restrictions, TikTok and Kaspersky requirements, plus a standard for “reasonable inquiry” based on information in the offeror’s possession that is accessible without requiring an internal audit, third-party audit or information outside its possession. That could reduce some interpretive clutter. It could also move fights into representations, flowdowns and contracting-officer discretion. The Monday-morning task is simple and unpleasant: map the clauses that touch your contracts, identify where the rewrite changes obligation, discretion or evidence, and comment before the 30 days expire.