FAR Council Archives - Government Contracts Navigator

The FAR Council Publishes Long-Awaited CUI Rule

On January 15, 2025, the Federal Acquisition Regulation (“FAR”) Council issued its long-awaited “CUI Rule.” CUI, or Controlled Unclassified Information, is information that the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. For nearly 15 years, contractors have struggled to determine what information meets this definition. The CUI rule is an opportunity for the federal government to finally provide contractors with the guidance needed to better identify and safeguard the CUI they receive in connection with their federal contracts.

Deadline Looms for the Submission of Comments on FAR Council’s Proposed Rule Updating Federal Debarment Procedures

Dominique L. Casimir and Patrick F. Collins ●

Introduction

The United States spends hundreds of billions of dollars annually on government contracts, grants, and other forms of federal assistance. Although most entities that receive these awards are good business partners, the government must protect itself from those that lack integrity. One of the ways the government does this is by imposing suspension or debarment, which renders an entity broadly ineligible to receive federal awards for a specified period.

The suspension and debarment regulations at Federal Acquisition Regulation (“FAR”) Subpart 9.4 (which apply to procurement contracts) and at 2 C.F.R. Part 180, known as the Nonprocurement Common Rule (“NCR”) (which apply to nonprocurement transactions such as grants) have remained relatively unchanged for many years. But change may be on the horizon, as the FAR Council recently issued a proposed rule that aims to better harmonize the two regulatory regimes. The period for public comment closes on March 11, 2024—one week from today. Rulemaking is infrequent in this area, so the final rule will be highly anticipated.

DOD Finalizes Rule Concerning Domestic Content Preference

Samarth Barot and Shane M. Hannon ●

On February 15, the Department of Defense (“DOD”) finalized a rule amending the Defense Federal Acquisition Regulation Supplement (“DFARS”) to supplement the Federal Acquisition Regulation (“FAR”) implementation of Executive Order 14005, addressing domestic preferences in DOD procurement. Defense contractors should be aware of the specific changes and ensure their sourcing and supply chain systems incorporate the updated requirements.

Background

As we discussed in prior posts, in January 2021 President Biden issued an executive order strengthening the Buy American Act’s (“BAA”) preference for domestic products and services in federal procurements. The executive order directed the FAR Council to consider proposing a rule to increase the BAA’s domestic content threshold for domestic end products.

The FAR Council then issued a final rule that increased the domestic content threshold for domestic end products (covered here). Previously, a product was considered a domestic end product if the cost of its components mined, produced, or manufactured in the United States exceeded 55 percent of the cost of all components. The FAR Council’s final rule increased that domestic content threshold to 60 percent and implemented a phased increase to 65 percent in 2024 and 75 percent in 2029. However, the rule also included a fallback threshold of 55 percent if (1) no end products exist that meet the new domestic content threshold or (2) such end products do exist but are unreasonably expensive. This fallback threshold will persist until 2030.

The FAR Council Proposes Standardizing Cybersecurity Requirements

Michael Joseph Montalbano and Oliver E. Jury ●

On October 3, 2023, the FAR Council proposed two potentially significant cybersecurity rules. We discussed FAR Case No. 2021-017, which would impose a range of new cyber incident reporting requirements on nearly all government contractors, earlier this week. This post discusses FAR Case No. 2021-019, which seeks to standardize cybersecurity contractual requirements across federal agencies.

Who Will the Standardization of Cybersecurity Contractual Requirements Affect?

Under the proposed rule, the FAR Council would promulgate two new FAR clauses, FAR 52.239-YY (Federal Information Systems Using Non-Cloud Computing Systems) and FAR 52.239-XX (Federal Information Systems Using Cloud Computing Services). As drafted, the rule would affect contracts that involve the development and maintenance of federal information systems (“FIS”).

What is an FIS? The proposed rule defines FIS as “an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization, on behalf of a government agency.”

FAR 52.239-YY would be required in contracts acquiring FIS services that include (or are anticipated to use) non-cloud computing services during contract performance. The proposed clause would require flowdown to subcontractors at all tiers (provided those subcontractors may use non-cloud computing services). There would be no exception for acquisitions below the simplified acquisition threshold or acquisitions for commercial products, including commercially available off-the-shelf (“COTS”) items and commercial services, “because Government data and systems require protection regardless of dollar value.”

The FAR 52.239-XX requirements would largely mirror those in FAR 52.239-YY, albeit for contractors using cloud-based computing services during performance. Contractors would need to comply with both proposed clauses if they use both non-cloud and cloud-based computing services in support of contract performance.

The FAR Council Proposes New Cyber Incident Reporting Requirements

Michael Joseph Montalbano and Oliver E. Jury ●

On October 3, 2023, the FAR Council issued two proposed cybersecurity rules that could have significant implications for both Government prime and subcontractors. This post discusses the first rule, FAR Case No. 2021-017, which, if implemented, will impose an array of new cyber incident reporting requirements on nearly all government contractors. The second rule, FAR Case No. 2021-019, seeks to standardize cybersecurity contractual requirements across Federal agencies. We discuss the first rule in further detail here.

Who Would Have to Comply with the New Cyber Incident Reporting Rule?

Under the proposed cyber incident rule, the FAR Council intends to promulgate a new FAR clause, FAR 52.239-ZZ. In its current form, FAR 52.239-ZZ would apply to all contracts where “information and communications technology” (“ICT”) is used or provided in the performance of the contract.

What is ICT? ICT is just about anything computer related. ICT includes computers and their peripheral equipment, telecommunications equipment, computer software, and electronic documents. In other words, if a contractor uses a computer or related device in the performance of a government contract, then FAR 52.239-ZZ would likely apply.

Buy American Act—Final Rule: What Has Changed?

Scott Arnold and Ustina M. Ibrahim*

On March 7, 2022, the FAR Council published the final rule containing changes to Buy American Act (“BAA”) domestic preference requirements.

This final rule is a significant step towards implementation of a policy to enhance domestic preferences announced by President Biden in E.O. 14005 just a few days after taking office. You may recall that the FAR Council previously issued a proposed rule that contemplated (1) phased increases in domestic content thresholds, (2) enhanced preferences for critical products and components, and (3) post-award reporting requirements for critical products and components. See our prior posts addressing President Biden’s E.O. 14005 and the proposed rule.

The final rule retained most of what the FAR Council initially proposed, but there are a few changes that we discuss below. We also point out some aspects of the new policy that remain to be fleshed out in future rulemaking.

Increased Domestic Content Thresholds

The proposed rule contemplated increasing the current domestic content threshold from 55 percent to 60 percent, with subsequent increases to 65 percent and 75 percent beginning in calendar years 2024 and 2029, respectively. The final rule retains these increases but allows for a longer period than typically provided before the first increase to 60 percent becomes effective. The 60 percent threshold will take effect October 25, 2022—over six months after publication, rather than the customary 30 or 60 days after publication. Thus, contractors and agencies have several more months to plan for the new threshold.

Buy American Act Domestic Content Requirements Likely to Increase Soon

Scott Arnold, Justin A. Chiarodo, and Robyn N. Burrows

As directed in President Biden’s January 25, 2021, Executive Order we discussed six months ago, last week the FAR Council proposed increases to the Buy American Act (“BAA”) domestic content requirements, and previewed enhanced price preferences and reporting obligations for “critical” domestic products and components under the BAA.

The proposed rule, issued on July 30, 2021, contains three key elements: (1) Phased increases in domestic content thresholds from the current 55% to 75% by 2029, (2) enhanced price preferences for critical products and components, and (3) post-award reporting requirements for critical products and components.

A virtual public meeting to discuss the proposed rule will be held on August 26, 2021, and comments are due by September 28, 2021. The DAR Council also has an open DFARS Case relating to BAA provisions (2019-D045).

We provide an overview of the rule below along with practical takeaways for contractors to consider in light of these potentially significant changes.

Share this:

Share this:

Share this:

Share this:

Share this:

Share this:

Share this: