Alert 06.26.26
Revolutionary FAR Overhaul Proposed Rules
The proposed rules introduce Phase 2 of the RFO, which will permanently implement much of the RFO Phase 1 deviations, while also modifying several of the Phase 1 RFO deviation requirements.
Service
Our experienced government contracts lawyers are members of Pillsbury’s national Cybersecurity, Data Protection and Privacy practice, which has been repeatedly recognized by The Legal 500 U.S. ranked as an industry leader.
We offer unique insight and guidance in connection with critical security, data protection and privacy law issues. Our team focuses on assisting government contractors and their supply chain in complying with all aspects of the cybersecurity regulations incorporated in Department of Defense (DOD) Federal Acquisition Regulation Supplement (DFARS) 252.204-7012.
Government contractors face new challenges as the federal government evolves its business practices to require cybersecurity throughout the supply chain. Contractors now must ensure that both their own systems and those of their suppliers comport with National Institute of Standards and Technology (NIST) requirements, including NIST 800-171 (“Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”). In fact, DoD intends to make cybersecurity compliance a requirement for companies performing DoD contracts or subcontracts. As part of this effort, DoD is in the process of rolling out the Cybersecurity Maturity Model (CMMC) framework. Under this framework, nearly all DoD contractors, subcontractors and suppliers at every level will be required to certify their compliance with certain cybersecurity standards before receiving new DoD contracts. A failure to plan accordingly thus may prevent unprepared contractors from receiving contract awards. In addition, the Federal Risk and Authorization Management Program (FedRAMP) requires that federal contractors providing cloud computing services to the U.S. government demonstrate compliance with cybersecurity requirements at the appropriate risk level. FedRAMP has established processes for achieving a FedRAMP authorization, which is required to provide cloud services to federal agencies.
View More
Pillsbury has counseled large prime contractors and small businesses on the nuances of this burgeoning area of law. Our team assists contractors in drafting access requirements and subcontractor flow downs, which now include the requirement to identify and limit the dissemination of Controlled Unclassified Information (CUI). We have assisted clients with privileged compliance audits, investigations and incident reporting. Also, in conjunction with our government contracts Financial Issues team, we evaluate contractor cost recovery options under various contracting types to determine whether contractors are entitled to be reimbursed for the implementation of these new requirements.
View More