The recently enacted coronavirus COVID-19 Coronavirus Aid, Relief, and Economic Security Act stimulus package (the “CARES Act” or “the Act”) includes billions of dollars earmarked for the Department of Defense (“DoD”) and defense industry contractors. It does this in two ways:
- By providing billions of dollars in loans, loan guarantees, and other financial assistance to businesses through the Department of the Treasury, including up to $17 billion specifically for businesses “critical to maintaining national security;” and
- By providing $10.5 billion in supplemental appropriations to DoD, much of which is likely to go to procuring goods and services from federal contractors, including in areas ranging from healthcare to information technology. The Act also contains provisions intended to streamline DoD contracting during the present emergency.
Although the procedures to obtain these loans were not established by the Act, the Secretary of the Treasury is required to publish procedures for applying for these loans within 10 days of enactment. It is expected that DoD will issue solicitations very soon to meet these pressing needs. We expect many contractors in the defense industry will be eligible for these loans, or for the parallel loan program for small businesses being administered by the Small Business Administration under the Act. Continue reading “CARES Act: Significant Funds for Defense Department and Defense Contractors”
Michael Joseph Montalbano
In January, the Department of Defense (“DoD”) released more information on its much-anticipated Cybersecurity Maturity Model Certification (“CMMC”) framework. While a final rule is not expected until the fall, contractors need to begin preparing now so they do not miss out on DoD contract opportunities.
What Is the CMMC?
The CMMC is a certification system that all DoD prime and subcontractors must comply with to be eligible to compete for and perform future DoD contracts. Under the new CMMC requirements, an accreditation body tapped by DoD will begin training third-party assessors in the spring of 2020, who will in turn certify defense contractors under the CMMC. There will be five CMMC certification levels, of ascending sophistication:
- Level 1 – Basic Cyber Hygiene
- Level 2 – Intermediate Cyber Hygiene
- Level 3 – Good Cyber Hygiene
- Level 4 – Proactive
- Level 5 – Advanced / Progressive
The contractor must comply with a combination of the following cybersecurity safeguards, depending on the certification level a contractor wants to achieve: (1) FAR 52.204 (Basic Safeguarding of Covered Contractor Information Systems); (2) NIST Special Publication 800-171 Revision 1 (“NIST Requirements”); (3) select subsets of a supplement to the NIST Requirements called NIST SP 800-171B; and (4) up to 171 “practices” identified in the CMMC. Though this may sound like a lot for contractors to process, DoD has released helpful appendices that put many of the requirements in easy-to-understand terms. Continue reading “New DoD Cybersecurity Regulations Are Coming—Is Your Company Ready?”
Justin A. Chiarodo and Robyn N. Burrows
A very Happy New Year to our GovCon Navigator readers! Further expanding recent supply chain restrictions across federal procurement, the Department of Defense (“DoD”) issued an interim rule prohibiting DoD from procuring equipment or services from certain Chinese entities (and possibly Russian) if used to carry out DoD nuclear deterrence or homeland defense missions. The rule builds on the Section 889 supply chain restrictions we previously covered in a prior blog post.
What should contractors do now given the interim rule is already in effect? Contractors should first evaluate their existing contract portfolios for covered missions and take immediate steps to eliminate all covered products from their supply chain (and find alternate sources of supply). If the rule might impact contract performance, you should be prepared to address this with the appropriate counterparty. And given the requirement for compliance certifications that mirror Section 889, contractors should also harmonize monitoring and compliance with their existing supply chain compliance programs. Among other things, this should address the requirement to obtain compliance certifications from downstream subcontractors and suppliers.
Read on for the specifics. Continue reading “A DoD New Year’s Resolution: No More Chinese (and Possibly Russian) Products and Services in Support of Key Missions”
Merle M. DeLancey Jr.
On August 15, 2019, the Defense Health Agency (“DHA”) and Defense Logistics Agency (“DLA”) agreed upon a joint approach to healthcare logistics. Under the Memorandum of Agreement (“MOA”), DLA will be responsible for materiel acquisitions, while DHA will take the lead on medical services acquisitions. The MOA clarifies the agencies’ complementary roles and responsibilities and avoids duplication of effort. The MOA covers all aspects of medical logistics support provided by DLA to DHA, and DHA’s consideration for that support in performance areas including pharmaceuticals, medical-surgical supplies, healthcare technology equipment, cataloging, and Class VIII surge and sustainment materiel required by the services to meet the demands of the national military support strategy.
The uninformed might question the need for DHA and DLA to formally enter into a MOA. After all, DHA and DLA are both under the Department of Defense (‘DoD”) umbrella. Why is an agreement required to coordinate the two agencies’ efforts? Why wasn’t such coordination and avoidance of duplication of effort simply ordered by DoD senior command? Good questions perhaps, but the MOA was necessary to ensure the agencies stay in their respective lanes. Continue reading “Defense Health Agency and Defense Logistics Agency Memorandum of Agreement: A Good First Step, but What about Coordination with the Department of Veterans Affairs?”
Carolyn R. Cody-Jones
A recent decision in the federal district court for the Eastern District of California is one of the first to recognize application of the False Claims Act (“FCA”) to Department of Defense (“DoD”) cybersecurity requirements, and will likely encourage future lawsuits alleging noncompliance with federal cybersecurity procurement regulations. In United States ex rel. Markus v. Aerojet Rocketdyne Holdings, Inc., No. 2:15-cv-2245 WBS AC, 2019 WL 2024595 (E.D. Cal. May 8, 2019), the court denied the defendant contractor’s motion to dismiss qui tam complaint fraud allegations against the company. The complaint—brought by a former employee from the company’s cybersecurity department a month after his termination from the company—alleged the defendant fraudulently entered into DoD and National Aeronautics and Space Administration (“NASA”) contracts despite knowing that it did not meet the minimum standards required to receive the awards. The court permitted the case to move forward despite the government declining to intervene.
The primary regulations at issue in the case are DFARS 252.204-7012, which recently required, as of December 31, 2017, that contractors have a cybersecurity plan in place complying with 110 recommended security control standards set forth in NIST SP 800-171. However, the court’s decision in Aerojet Rocketdyne focused on the previous 2013 final rule and the two interim rules in 2015 implementing DFARS 252.204-7012, and also a NASA cybersecurity regulation at 48 C.F.R. § 1852.204-76 involving contractor security controls for sensitive but unclassified government information. Continue reading “Eastern District of California Allows False Claims Act Allegations Based on Noncompliance with DoD Cybersecurity Requirements to Go Forward”