Beyond the Balance Sheet: The Continued Importance of Cybersecurity in M&A

Merle M. DeLancey Jr., Samarth Barot, and Michael Joseph Montalbano 

In our August 1 post, we discussed how companies that acquire government contractors can inherit the False Claims Act (“FCA”) exposure based on their targets’ cybersecurity violations. Now, the Department of Justice (“DOJ”) delivered another vivid real-world example: a $1.75 million settlement in which a private equity (“PE”) firm, Gallant Capital Partners LLC, was named jointly and severally liable for its portfolio company’s cybersecurity violations on a U.S. Air Force contract.

The outcome underscores two critical truths. First, DOJ will pursue financial sponsors when a contractor in their portfolio fails to comply with its contractual cybersecurity requirements. Second, investors that fail to ask about, document, and remediate a target’s security shortcomings can find themselves financing both the acquisition and the government’s recovery.

Continue reading “Beyond the Balance Sheet: The Continued Importance of Cybersecurity in M&A”

Blank Rome Attorneys Appointed to American Bar Association’s Public Contract Law Section Leadership for the 2025–2026 Term

We are pleased to announce that a record nine attorneys from Blank Rome’s nationally recognized Government Contracts group have been appointed to leadership roles in the American Bar Association’s (“ABA”) Public Contract Law Section for the 2025–2026 term.

Visit our website to learn more about their roles and ABA’s Section of Public Contract Law.

Buyer Beware: Cybersecurity Compliance in M&A

Merle M. DeLancey Jr. and Samarth Barot 

A recent Department of Justice (“DOJ”) settlement highlights the importance of assessing cybersecurity compliance for government contractors during mergers and acquisitions (“M&A”). In April 2025, DOJ announced an $8.4 million settlement with a defense contractor resolving alleged cybersecurity noncompliance by a company it acquired. Notably, under the settlement, the acquiring company was liable for cybersecurity noncompliance that occurred prior to the acquisition.

In the M&A context, successor liability arises when an acquiring company becomes responsible for liabilities, obligations, or wrongful acts committed by the company to be acquired prior to the acquisition. Fundamentally, successor liability ensures that a corporate acquisition does not allow the acquired entity to escape accountability. In the settlement, DOJ explicitly named the acquiring company as the “successor in liability” for the acquired company’s alleged violations, even though the conduct at issue occurred years before the acquisition. This underscores the importance for acquirers to add cybersecurity compliance to the issues vetted during due diligence.

Continue reading “Buyer Beware: Cybersecurity Compliance in M&A”

Other Transactions: A Flexible and Efficient Acquisition Tool for the Department of Defense

Scott Arnold and Samarth Barot 

On March 6, 2025, the Defense Secretary released a memorandum directing the Department of Defense (“DoD”) to adopt the Software Acquisition Pathway (“SWP”) to speed up the development, procurement, and delivery of software needed for weapons and business systems. Specifically, the memorandum directed DoD to use Commercial Solutions Openings and Other Transactions (“OTs”) as the default solicitation and award approaches for acquiring capabilities under the SWP. As a result, we are likely to see an expansion in DoD’s use of OTs. Thus, contractors should be aware of the rules and regulations regarding OTs.

Background

While OTs have been in the news a lot these days, they are not a new concept. OTs date back to 1958, when Congress granted the National Aeronautics and Space Administration (“NASA”) the authority to enter into transactions other than contracts, grants, or cooperative agreements in order to foster innovation and speed in the space race.

Continue reading “Other Transactions: A Flexible and Efficient Acquisition Tool for the Department of Defense”

Time for Compliance with DOD’s Cybersecurity Regulations is NOW

Michael Joseph Montalbano and Samarth Barot 

On February 19, 2024, the Department of Justice (“DOJ”) notified the U.S. District Court for the Northern District of Georgia that it would intervene in a False Claims Act (“FCA”) case filed against Georgia Tech Research Corporation and Georgia Institute of Technology (collectively “Georgia Tech”) for not complying with the requirements of DFARS 252.204-7012 and National Institute of Standards and Technology Special Publication 800-171 (“NIST 800-171”).

All Department of Defense (“DOD”) solicitations and contracts contain DFARS clause 252.204-7012. DFARS 252.204-7012 requires a contractor to assess its compliance with 110 cybersecurity controls set out in the NIST 800-171 if the Company has controlled unclassified information. Specifically, pursuant to DFARS 252.204-7012, contractors must implement all of the NIST 800-171 requirements and upload the results of that assessment to the Department of Defense’s Supplier Performance Risk System (“SPRS”), or have a plan of action and milestones in place for any requirement the contractor has not yet implemented.

Continue reading “Time for Compliance with DOD’s Cybersecurity Regulations is NOW”

DOD Finalizes Rule Concerning Domestic Content Preference

Samarth Barot and Shane M. Hannon 

On February 15, the Department of Defense (“DOD”) finalized a rule amending the Defense Federal Acquisition Regulation Supplement (“DFARS”) to supplement the Federal Acquisition Regulation (“FAR”) implementation of Executive Order 14005, addressing domestic preferences in DOD procurement. Defense contractors should be aware of the specific changes and ensure their sourcing and supply chain systems incorporate the updated requirements.

Background

As we discussed in prior posts, in January 2021 President Biden issued an executive order strengthening the Buy American Act’s (“BAA”) preference for domestic products and services in federal procurements. The executive order directed the FAR Council to consider proposing a rule to increase the BAA’s domestic content threshold for domestic end products.

The FAR Council then issued a final rule that increased the domestic content threshold for domestic end products (covered here). Previously, a product was considered a domestic end product if the cost of its components mined, produced, or manufactured in the United States exceeded 55 percent of the cost of all components. The FAR Council’s final rule increased that domestic content threshold to 60 percent and implemented a phased increase to 65 percent in 2024 and 75 percent in 2029. However, the rule also included a fallback threshold of 55 percent if (1) no end products exist that meet the new domestic content threshold or (2) such end products do exist but are unreasonably expensive. This fallback threshold will persist until 2030.

Continue reading “DOD Finalizes Rule Concerning Domestic Content Preference”

3 Tips to Reduce False Claims Act Exposure in the Wake of United States ex rel. Schutte v. SuperValu, Inc.

Justin A. Chiarodo, Jennifer A. Short, Stephanie M. Harden, Samarth Barot, and Oliver E. Jury ●

2023 is shaping up to be a major year in False Claims Act (“FCA”) practice, with the Supreme Court weighing in on both FCA scienter (in SuperValu) and the reach of the government’s dismissal authority (in Polansky), and the government focusing its enforcement efforts around antitrust, cyber, and national security. We focus today on the United States ex rel. Schutte v. SuperValu, Inc. decision, in which the Supreme Court held that a contractor’s subjective belief about its compliance at the time it submitted claims for payment is relevant to whether it had the requisite scienter for FCA liability. Much has been written on this case, with most articles exploring esoteric concepts like “scienter,” “falsity,” and the “objectively reasonable person.” But assuming—as we do—that the decision will reduce the prospect of successful early dispositive motions, what practical steps can contractors take to reduce their False Claims Act exposure and avoid litigation in the first place? We offer three suggestions.

We begin with a basic refresher on the issue presented in SuperValu. A defendant is not liable under the False Claims Act unless it “knowingly” (including acting with “reckless disregard”) submits a false claim to the government. The “knowing” scienter element—particularly around reckless disregard—can be difficult to prove in the world of complex and often ambiguous laws and regulations that govern contractors’ compliance. The federal circuits had split on the issue of whether a defendant’s subjective interpretation at the time it submitted claims for payment to the government was relevant to determining FCA “knowledge” if the defendant could later show that the underlying rule was ambiguous and its conduct (regardless of its contemporaneous understanding or belief) was consistent with an objective, reasonable interpretation of the unsettled requirement. SuperValu resolved the debate by holding that whether a defendant knowingly violated the FCA—and satisfied the scienter element—must consider the defendant’s real-time “knowledge and subjective beliefs.” United States ex rel. Schutte v. SuperValu, Inc., 143 S. Ct. 1391 (2023).

Continue reading “3 Tips to Reduce False Claims Act Exposure in the Wake of United States ex rel. Schutte v. SuperValu, Inc.

Federal Contractor Vaccine Mandate to End

Merle M. DeLancey Jr. and Samarth Barot 

After several Federal District Courts issued injunctions against the federal contractor vaccine mandate in December 2021, the Federal Government issued guidance fully suspending its enforcement of the federal contractor mandate. Despite the guidance, the future of the federal contractor vaccine mandate continued to remain in a state of limbo. This was best demonstrated two weeks ago when the Ninth Circuit sided with the Federal Government by lifting the district court’s preliminary injunction of the federal contractor vaccine mandate. The Ninth Circuit’s decision created a split with the Fifth, Sixth, and Eleventh Circuits that have enjoined the mandate. This Circuit split was likely headed to the United States Supreme Court.

On May 1, 2023, all of this changed. The Biden Administration announced its plan to end its federal contractor vaccine mandate on May 11, 2023, the same day the public health emergency ends. Accordingly, the Administration plans to issue an Executive Order “rescinding the vaccination requirement for federal employees and COVID-19 safety protocols for federal contractors, effective at 12:01 am on May 12, 2023.” For Federal Contractors | Safer Federal Workforce. Until then, the guidance suspending the enforcement of the federal contractor mandate remains in effect.

This should be the end of the federal contractor vaccine mandate; however, we will know more by May 11, 2023. Stay tuned for further developments.

Blank Rome Successfully Represents KPMG LLP in GAO Bid Protest Challenging U.S. Air Force Award Decision


A Blank Rome team represented KPMG LLP in a successful bid protest before the Government Accountability Office (“GAO”), in which KPMG challenged the award decision of the United States Air Force in a procurement for visible accessible understandable linked trusted (“VAULT”) subject matter expert support.  

The team was led by Dominique L. Casimir and included Robyn N. Burrows and Samarth Barot

To learn more, please visit our website.

Federal Contractor Vaccine Mandate Still in Limbo

Merle M. DeLancey Jr. and Samarth Barot 

Since December 2021, after a Federal District Court for the Southern District of Georgia issued a nationwide injunction against the federal contractor vaccine mandate, compliance with the federal contractor vaccine mandate has been in limbo. Many hoped that, on appeal, the Eleventh Circuit would bring some clarity to vaccine requirements. Unfortunately, that is not the case. On August 26, 2022, the Eleventh Circuit agreed that a preliminary injunction was warranted, however the Court narrowed the applicability of the injunction. The court held that the injunction should only apply to the specific plaintiff-states and trade associations in the case, and should not “extend[] nationwide and without distinction to plaintiffs and non-parties alike.” Georgia v. President of the United States, No. 21-14269 (11th Cir. Aug. 26, 2022).

The Eleventh Circuit agreed with the lower court that a preliminary injunction was warranted, stating that while “Congress crafted the Procurement Act to promote economy and efficiency in federal contracting, the purpose statement does not authorize the President to supplement the statute with any administrative move that may advance that purpose.” Therefore, the Court held that “the President likely exceeded his authority under the Procurement Act when directing executive agencies to enforce” the vaccine mandate.

Continue readingFederal Contractor Vaccine Mandate Still in Limbo
Exit mobile version
%%footer%%