Arm me with harmony.” – Treach, Naughty By Nature[1]

On May 14, 2024, the National Institute of Standards and Technology (NIST) dropped the third remix…er, revision…of its Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.” It even came with a critical sidekick in the form of the companion assessment guide, “NIST SP 800-171A, Revision 3,” which gives organizations the necessary lowdown on “assessment procedures and methodologies” to check if they’re playing by NIST SP 800-171’s rules. Over a year in the making after previous releases in May and November of 2023, NIST’s finalized revision takes inspiration from industry by laying down the cybersecurity rules that contractors should expect to follow when handling Controlled Unclassified Information (CUI) for the US Department of Defense (DoD). While DoD isn’t requiring contractors who handle CUI to roll with Rev. 3 just yet, contractors can expect that DoD will eventually bring Rev. 3 into the mix for DFARS 252.204-7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” (DFARS 7012), and will be harmonizing it with the upcoming Cyber Maturity Model Certification (CMMC) program at some point soon.Continue Reading NIST SP 800-171 Revision 3 Goes Final: Who’s Down with ODP?

If you happen to be a government contractor and are contemplating additions to your Summer reading list, consider adding the FAR Council’s May 3, 2024 advanced notice of proposed rulemaking (“ANPR”) to the mix. The ANPR, which was issued in furtherance of implementing Section 5949 of the FY 2023 National Defense Authorization Act (“NDAA”), contemplates various forthcoming changes to the FAR, all of which focus on banning agencies from purchasing certain products or services that contain or otherwise utilize semiconductors that are produced, designed, or provided by three Chinese entities and their subsidiaries, affiliates, or successors: Semiconductor Manufacturing International Corporation (“SMIC”), ChangXin Memory Technologies (“CXMT”), and Yangtze Memory Technologies Corp. (“YMTC”). In addition, the FAR will likely be amended to prohibit the acquisition of semiconductor products or services from any entity that is owned, controlled by, or otherwise connected to China, North Korea, Iran, Russia and any other “foreign country of concern” – a designation to be determined by the Secretary of Defense or the Secretary of Commerce, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation.Continue Reading Supply Chain Checkup: FAR Council Announces New Rulemaking Focused on Prohibiting Certain Semiconductor Acquisitions

The Proposed Rule behind FAR Case 2021-017 may strike fear into the hearts of many contractors, as it implements new recommendations regarding cybersecurity reporting obligations. Alex Major highlights the necessary steps and potential risks federal contractors must consider in the Government Contractor.

On June 2, 2023, the FAR Council issued an Interim Rule to implement the prohibition on having or using TikTok or any successor application or service developed or provided by ByteDance Limited (covered application). Importantly, the prohibition applies not only to Government-issued devices but encompasses contractor and contractor employee-owned devices (e.g., employee devices used as part of a bring-your-own-device program) as well. The Interim Rule took immediate effect and requires new FAR clause FAR 52.204-27, Prohibition on a ByteDance Covered Application, to be included in solicitations issued on or after June 2, 2023. In addition, solicitations issued before the effective date were required to be amended by July 3, 2023, provided that award of the resulting contract(s) occurs on or after the effective date. Existing indefinite-delivery, indefinite-quantity contracts were required to be modified to include the new clause by July 3, 2023, to apply to future orders. Finally, if exercising an option or modifying an existing contract to extend the period of performance, contracting officers must include the clause. In short, this clause will soon be in most if not all Federal government contracts. Contractors should take action now to ensure that they are prepared to comply with these requirements and that employees are familiar with and trained regarding the prohibition.Continue Reading TikTok Dances Off of Contractor IT Devices—Interim Rule Prohibits ByteDance Limited Applications

In 2006, the documentary An Inconvenient Truth chronicled former Vice President Al Gore’s efforts to educate the public on the consequences of climate change. In the sixteen years since the Academy Award-winning film was released, public interest in the impact that greenhouse gas (GHG) emissions have had, are having, and will have on our planet has increased exponentially. Most recently, at the 27th U.N. Climate Conference (COP27), countries from around the globe came together to discuss the implementation of battle plans to combat climate change. One such plan, which was discussed at COP 27 by President Biden, is a new Proposed Rule that would require “significant” and “major” federal contractors to disclose their GHG emissions and climate-related financial risk as well as set science-based targets to reduce their GHG emissions. If and when the Proposed Rule is finalized, it will have seismic implications for contractors, in that it ties contractor responsibility (i.e., a contractor’s ability to receive federal awards) to compliance with these requirements.
Continue Reading An Inconvenient Requirement: New Proposed Rule Would Require Federal Contractors to Disclose Greenhouse Gas Emissions

On January 4, 2021, the National Institute of Standards and Technology (NIST) published proposed rules for comment changing regulations promulgated under the Bayh-Dole Act (35 U.S.C. §§ 200-204), which allow businesses and nonprofit institutions, in most circumstances, to take title to inventions made under federally funded projects (subject inventions) and to freely commercialize items, and methods used to produce items, embodying subject inventions.
Continue Reading NIST on Track to Clarify Bayh-Dole to Ensure High Prices Cannot Be Used as Grounds for Exercising March-in Rights – Or Is It?

The Department of Defense (DoD) has finalized regulations prohibiting the use of telecommunications equipment or services from Chinese entities or from entities that are owned or controlled by either the People’s Republic of China or the Russian Federation. The Final Rule, which went into effect on Friday, January 15, 2021, prohibits the DoD from buying or using banned telecommunications equipment and services that are a “substantial or essential component of any system” or that constitute a “critical technology.”
Continue Reading Changes to DoD Regulations Banning Chinese Telecommunications Equipment and Services Offer Potential Opportunities for Contractors

Like the hits produced by DJ Khaled, the FAR Council offers “another one.” As covered extensively in this blog, federal contractors have been—or should have been (you have been working toward compliance, haven’t you?)—spending the closing days of summer ensuring compliance with the July 14, 2020 Interim Rule implementing Section 889(a)(1)(B) (“Section B”) of the National Defense Authorization Act for fiscal year 2019.  Section B prohibits the government from entering into a contract with an entity that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system, and requires, among other affirmative obligations, for contractors to represent—after conducting a “reasonable inquiry”—that they do/do not use covered telecommunications equipment or services in their respective business operations. In light of the Interim Rule’s broad scope and mandatory accounting of a contractor’s operations, Section B’s compliance mandate presents another significant regulatory burden for contractors to shoulder. But contractors should fear not, because the FAR Council has heard their plaintive wails and responded on August 27, 2020, with a Second Interim Rule implementing new requirements for Section B compliance.Continue Reading The FAR Council’s Second Interim Rule Implementing NDAA Section 889(a)(1)(B): And the Hits Keep Coming!

When entering a casino, professional gamblers understand that “the house doesn’t beat the player. It just gives him the opportunity to beat himself.” This axiom is precisely why in the long run casinos make money, while gamblers see their bank accounts dwindle. The same holds true in the corporate world with respect to the creation, implementation, and maintenance of compliance programs. A company gambling on its compliance obligations does so at its own peril and must understand exactly what the “House” expects. If it doesn’t, then that company may join the unfortunate few that roll the dice or spin the wheel and come up with snake eyes or double zeros. That risk is multiplied if the company betting on sufficient compliance is receiving federal dollars, where failure can lead to catastrophic civil and criminal liability. Fortunately, the United States Department of Justice (“DOJ”) has published its version of “House Rules” that it is supposed to consult when examining whether to investigate, prosecute, or settle criminal charges against a company. In this respect, DOJ prosecutors are tasked with looking at specific factors outlined in the “Principles of Federal Prosecution of Business Organizations” (“Principles”) section of the Justice Manual. Among other factors, these Principles instruct DOJ prosecutors to consider “the adequacy and effectiveness of the corporation’s compliance program at the time of the offense, as well as at the time of a charging decision.” In furtherance of this mandate, the DOJ’s Criminal Division issued revised guidance on June 1, 2020, regarding the specific factors DOJ prosecutors should consider in making that evaluation. This updated version of the DOJ’s “Evaluation of Corporate Compliance Programs” (Guidance) clarifies and modifies certain areas of the version last updated in April 2019. Among other noteworthy revisions, the Guidance underscores the need for companies to ensure their corporate compliance program is:
Continue Reading Gambling on Compliance? DOJ Updates the House Rules on Corporate Compliance Program Expectations

As we stated last month, further restrictions are afoot on the use of Chinese technology in federal acquisitions. An Interim Rule issued by the Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA) (collectively, the “FAR Council”) implements the first phase of Section 889 of the FY2019 National Defense Authorization Act (NDAA). The Interim Rule, effective August 13, 2019, broadly prohibits federal agencies, federal contractors, and grant or loan recipients from procuring “covered telecommunications equipment or services” produced by Huawei Technologies Company and ZTE Corporation and, with respect to certain public safety or surveillance applications, Hytera Communications Corporation, Dahua Technology Company, and Hangzhou Hikvision Digital Technology Company. In particular, federal suppliers are prohibited from sourcing “substantial or essential component of any system, or as critical technology as part of any system” from the foregoing companies.
Continue Reading Know Your Supplier: Effective August 13, 2019, Certain Chinese Telecoms Banned From Federal Procurement