Regulatory & Statutory Developments

Subscribe to Regulatory & Statutory Developments via RSS

For those who grew up gripping a joystick and dodging alien fire in Defender, riding ostriches through floating platforms in Joust, or crossing a hectic freeway in Frogger, winning wasn’t about memorizing rules; it was about adapting fast, reading the patterns, and leveling up. That same urgency now applies to federal information and communication technology (ICT) contractors. A sweeping overhaul of FAR Part 39 has just been released, and while it may not blink and beep like a cabinet in a darkened arcade, it’s just as demanding. There’s no attract mode here. The game has already started.

Continue Reading FAR 2.0 Part 39 in Arcade Mode—How Federal IT Acquisition Just Hit Reset

The U.S. Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) Program will become operational at some point in fiscal year 2025. In October, the DOD issued a Final Rule to address evolving cybersecurity requirements and cyber threats while defining the security controls that DOD intends defense contractors and subcontractors to implement. The program will require…

Alex Major, Franklin Turner, and Philip Lee co-authored the article “Surviving And Thriving In The Small Business Administration’s 8(a) Program: Maximizing Opportunities For NHOs, ANCs, And Tribes” for Briefing Papers. The article provides an overview of the Small Business Administration’s 8(a) Business Development Program, which provides socially and economically disadvantaged small business owners with federal…

Over the course of the past few years, gallons of ink have been spilled addressing the seemingly ever-pending US Department of Defense’s (DoD) Cybersecurity Maturity Model Certification (CMMC) Program. After keeping us waiting for years, it finally arrived when, on October 15, 2024, DoD published its Final Rule to establish the CMMC Program. See 89 Fed. Reg. 83092 (Oct. 15, 2024). Effective December 16, 2024, the Rule will require certain defense contractors to have implemented security measures to achieve a particular CMMC level necessary to safeguard Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as a condition of contract award. Codified at 34 C.F.R. Part 170, the CMMC Program will be augmented by a separate proposed acquisition rule to add a new 48 C.F.R. Part 204, amending the Defense Federal Acquisition Regulation Supplement (DFARS) to address procurement considerations related to the CMMC Program, including allowing DoD to require a specific CMMC level in a solicitation or contract. See 89 Fed. Reg. 66327 (Aug. 15, 2024) or our analyses here and here. The date when that DFARS clause will become final is still unclear, but most suspect it will be soon.

Continue Reading A Standard on Many Levels: A Look at CMMC 2.0 in Final

On April 29, 2024, the Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) released guidance to federal contractors regarding the use of artificial intelligence (AI) in their employment practices. See https://www.dol.gov/agencies/ofccp/ai/ai-eeo-guide. The guidance reminds federal contractors of their existing legal obligations, the potentially harmful effects of AI on employment decisions if used improperly, and best practices. Arriving early, the guidance puts contractors on notice of their responsibilities when using AI in their employment decisions.

Continue Reading Department of Labor Issues New Guidance on the Use of Artificial Intelligence and Employment Decision-Making

In what is quickly becoming an epic saga centered around the repercussions from the Ultima Servs. case, 8(a) program participants should have received a direct communication from the Small Business Administration (SBA) on Monday (August 21), providing direction on next steps regarding social disadvantage eligibility determinations. As that communication stated, if your firm’s 8(a) eligibility was based on an individual or individual(s) who relied upon the rebuttable presumption of social disadvantage, the firm will now be required to submit a social disadvantage narrative. (Entity-owned firms, such as firms owned by Indian tribes, Alaska Native Corporations, or Native Hawaiian Organizations, will not need to submit narratives; nor will 8(a) participants who previously established their social disadvantage through submission of a social disadvantage narrative.) Each owner claiming disadvantaged status must submit a narrative. This is all consistent with our previous coverage on this topic. What is new, however, is that there is now some more specific guidance on timing and how this process is going to play out.

Continue Reading The Continuing Saga of 8(a) Social Disadvantage Eligibility

On June 2, 2023, the FAR Council issued an Interim Rule to implement the prohibition on having or using TikTok or any successor application or service developed or provided by ByteDance Limited (covered application). Importantly, the prohibition applies not only to Government-issued devices but encompasses contractor and contractor employee-owned devices (e.g., employee devices used as part of a bring-your-own-device program) as well. The Interim Rule took immediate effect and requires new FAR clause FAR 52.204-27, Prohibition on a ByteDance Covered Application, to be included in solicitations issued on or after June 2, 2023. In addition, solicitations issued before the effective date were required to be amended by July 3, 2023, provided that award of the resulting contract(s) occurs on or after the effective date. Existing indefinite-delivery, indefinite-quantity contracts were required to be modified to include the new clause by July 3, 2023, to apply to future orders. Finally, if exercising an option or modifying an existing contract to extend the period of performance, contracting officers must include the clause. In short, this clause will soon be in most if not all Federal government contracts. Contractors should take action now to ensure that they are prepared to comply with these requirements and that employees are familiar with and trained regarding the prohibition.

Continue Reading TikTok Dances Off of Contractor IT Devices—Interim Rule Prohibits ByteDance Limited Applications

In a previous post, we mentioned the April 27, 2023 Small Business Administration (SBA) Final Rule, which made a number of revisions to the Small Business Regulations. A few of those revisions relate to the Ostensible Subcontractor Rule, a topic that has confused contractors for years. The Final Rule seeks to clear up that confusion, or at least some of it. Specifically, the Final Rule revises 13 CFR 121.103(h) to (1) clarify how the Ostensible Subcontractor Rule applies to general construction contracts and (2) provide guidance on the utilization of the DoverStaffing factors in determining whether a subcontractor is an “ostensible subcontractor.”

Continue Reading Ostensible Clarity: SBA Rule Addresses Ostensible Subcontractor Rule in General Construction Contracts and DoverStaffing Factors

On April 27, 2023, the Small Business Administration (SBA) issued a final rule, finalizing a September 9, 2022 proposed rule, and making a myriad of changes to the Small Business Regulations. Those changes are effective at the end of this month, on May 30, 2023. We will be covering a number of those changes in upcoming posts. But for now, we’re focusing on a change that will make some contractors very happy and other contractors very worried: real, negative consequences for small businesses that fail to comply with 13 CFR 125.6, which governs subcontracting limitations for small business set-aside contracts over the simplified acquisition threshold (presently defined in FAR 2.101 as $250,000).

Continue Reading Small Business Contractors Rejoice or Repent: Final SBA Rule Adds Teeth to 13 CFR 125.6 Subcontracting Limitations