The Department of Justice (DOJ) recently announced that False Claims Act (FCA) settlements and judgments exceeded $6.8 billion in fiscal year 2025. This massive haul is the largest annual recovery in the statute’s storied history. Although health care enforcement continues to account for the majority of recoveries, DOJ’s annual statistics confirm that procurement fraud, cybersecurity compliance, pandemic-program enforcement, and trade-related fraud remain core enforcement priorities that government contractors should not ignore. The FY 2025 numbers reinforce a familiar message: FCA enforcement remains one of DOJ’s most powerful tools for policing federal spending, and contractors should expect continued scrutiny of their certifications, representations, and contract compliance systems.

Continue Reading Now That’s a Lot of Money: DOJ’s Record-Setting FCA Year Reflects Intensifying Enforcement Pressure on Government Contractors

California Attorney General (AG) Rob Bonta announced the largest settlement under the California Consumer Privacy Act (CCPA) against The Walt Disney Company (Disney) for failing to honor customers’ requests to opt out of the sale or sharing of their data across all devices and streaming services linked to their Disney accounts. Essentially, Disney made it too difficult for consumers.  Businesses should evaluate their internal structure for responding to consumer requests. California has put a hefty price tag to make sure that more than appearances matter. As discussed in prior alerts, this follows the joint investigative sweep announced in September 2025 among California, Connecticut, and Colorado to investigate businesses refusing to honor consumers’ right to opt out of the sale of their personal information.

Continue Reading Opt Me Out! California Lessons on National Privacy Enforcement

For federal grant recipients across diverse sectors ranging from humanitarian assistance to the environment, the disruption of established business practices and the upending of expectations have now become the new normal, as federal agencies announce abrupt shifts in policy and spending. As we have commented previously (here, here, and here), federal agencies now regularly reinterpret terms of contracts and agreements that appeared to have been settled, so that once-stable sources of federal funding change on short notice.

Continue Reading Gateway Project Litigation Latest Salvo in Struggle over Federal Grants

Remember in Coming to America when Eddie Murphy’s Prince Akeem shows up in Queens full of charm, optimism, and big dreams and somehow it all works out? Fast-forward 38 years (yes, it’s been that long) and European companies looking to sell into the US Department of Defense (DoD) and Department of Homeland Security supply chains will need much more than charm. Instead, they’ll need real strategy, a focused structure, and readiness for regulatory scrutiny that doesn’t end with an award notification. In the current climate, with a heightened domestic preference policy, new executive directives such as the “Prioritizing the Warfighter in Defense Contracting” executive order, and renewed focus on supply chain security and performance, it is essential for foreign companies and their counsel to clearly understand the terrain before landfall.

Continue Reading Coming to America (the Government Contracting Edition): Ownership, Compliance, and Shifting Policy

The BIOSECURE Act in the FY 2026 NDAA is a quiet, sweeping shift in federal supply-chain enforcement that reaches beyond “biotech” and into the tools most companies barely think about like software, AI, data platforms, and third-party services used behind the scenes. As Alex Major and Franklin Turner write in The Government Contractor, BIOSECURE Act risk will hide several layers down and surface only when a bid, grant, or transaction is already at risk with IP, compliance, and access to federal markets can all be affected by vendors no one mapped years ago.

READ MORE

Following a tumultuous start to fiscal year 2026, including a government shutdown that lasted 43 days, the National Defense Authorization Act for fiscal year 2026 (NDAA 2026), Pub. L. 119-60, was passed by Congress and signed into law on December 18, 2025. NDAA 2026 is a critical legislative act, setting acquisition reforms and policies and authorizing appropriations and funding levels for the Department of Defense (DoD). With $900.6 billion in funding for the DoD, NDAA 2026 contains a plethora of acquisition reform provisions and critical updates impacting defense contractors. Title XVIII of NDAA 2026 significantly increased certain acquisition thresholds, including triggers for the Truthful Cost or Pricing Data Act (formerly the Truth in Negotiations Act) and Cost Accounting Standards application, which you can read about here. Additionally, NDAA 2026 increases the thresholds for noncompetitive acquisitions and when information technology requirements qualify as a major system.

Continue Reading FY2026 NDAA: Major Increases to Critical Acquisition Thresholds

The FY2026 National Defense Authorization Act (NDAA) became law on December 18, 2025, enacting a tidal wave of the Trump administration’s priorities with respect to Department of Defense (DoD) procurement. One key priority reflected in the NDAA is reducing compliance burdens so that (i) established DoD contractors are incentivized to pursue awards and (ii) more companies opt in to being a DoD contractor to grow the industrial base. Importantly, Section 1804 and Section 1806 of the NDAA take action on this priority by raising the dollar thresholds for complex domains of government contracting: the Cost Accounting Standards (CAS) and submission of certified cost or pricing data. While these changes are welcome developments, companies should be cognizant that a steady stream of compliance requirements remains even with these increased thresholds.

Continue Reading Swept Away: FY2026 NDAA Updates to CAS and Certified Cost or Pricing Data Thresholds

Congress has once again reshaped the protest landscape—this time with a narrow but consequential change targeted squarely at Department of Defense (DoD) procurements. The Fiscal Year 2026 National Defense Authorization Act (NDAA), signed into law by the president on December 18, 2025, includes a new provision designed to discourage meritless protests at the Government Accountability Office (GAO), particularly where an incumbent contractor continues performing work during the protest. Although the language is focused and does not overhaul the protest system more broadly, it introduces a real financial risk calculus that unsuccessful incumbent offerors will now need to consider before pulling the protest trigger.

Continue Reading Cracking the Kitchen Sink: FY2026 NDAA Brings Bid Protest Reforms for Defense Contractors That Lodge Meritless Protests

On December 18, 2025, the Fiscal Year 2026 National Defense Authorization Act (FY2026 NDAA) became law. True to each year’s NDAA being a sprawling piece of legislation, the FY2026 NDAA contains many priorities of the current Administration. Nestled among its myriad provisions, federal grant recipients should take note of Section 230, the “Prohibition on Modification of Indirect Cost Rates for Institutions of Higher Education and Nonprofit Organization.” This section provides a speed bump for rapid changes to indirect cost rates for Department of Defense grantees and reflects congressional sympathy to grantee concerns, particularly those of institutes of higher education (IHEs).

Continue Reading College Prep: What Colleges with DoD Grants Should Do Now Under the FY2026 NDAA

The US Department of Justice’s (DOJ) new Data Security Program (DSP), designed to protect sensitive information and national security-related data from misuse by foreign actors, took full effect on October 6, 2025. The program introduces new restrictions on how companies handle and share sensitive US personal data and government-related data, especially when certain foreign entities are involved. With enforcement underway, companies should understand who is covered, what activities are restricted, and what compliance measures are required. Failure to comply with the rules can result in civil or criminal penalties.

Continue Reading DOJ Launches New Data Security Program—What Your Company Needs to Know