On July 13, 2026, the Department of Defense (DoD) announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Level 2 third-party assessment requirements, which were originally scheduled to come into effect on November 10, 2026.  The announcement clarified that all CMMC Level 1 and CMMC Level 2 self-assessment requirements, which have been in effect since November 10, 2025, will remain in place.  The Pentagon intends to conduct a comprehensive review of the CMMC program, raising fresh uncertainty about…More

Contractors tracking the government’s growing reliance on Blanket Purchase Agreements (BPAs) and the rollout of the Revolutionary Federal Acquisition Regulation Overhaul (RFO) should take note of Government Accountability Office (GAO) bid protest decisions interpreting the new rules. A recent GAO decision addressed whether the consolidation analysis that agencies must complete before bundling under RFO Section 7.107-2 applies when the resulting vehicle is a BPA. In FedWriters, Inc., B-424376 (June 23, 2026), the GAO dismissed a protest challenging the National Science Foundation…More

In Rick Aviation, Inc. v. United States, the Court of Federal Claims (COFC) tackled a novel application of the Federal Acquisition Regulation (FAR) “late is late” rule. The question the court squared up against is what happens when an otherwise timely bid or proposal is caught in a government firewall or email filter and does not reach the procuring agency’s email server? According to COFC, unless the bid or proposal is received by the designated government office in the solicitation before…More

The Revolutionary FAR Overhaul (RFO) finally has moved into formal rulemaking, and it comes with a few surprises. The FAR Council completed the first phase of the RFO in September 2025, publishing model deviations to the FAR that agencies then had to adopt by issuing their own deviations and guidance. We digested the changes, organized by FAR part, here.  To begin making the FAR changes official, the FAR Council published four proposed rules[1] on June 23, 2026, covering Parts 1, 2, 3,…More

Contractors have begun receiving modifications to existing contracts implementing the new DEI clause mandated by Executive Order 14398 “Addressing DEI Discrimination by Federal Contractors.”  Shortly after the executive order, the FAR Council issued a Memorandum[1] establishing a new implementing clause, FAR 52.222-90.  The Memorandum also established mandatory deadlines for agencies to begin including FAR 52.222-90 in federal procurements: April 24, 2026: Agencies were required to begin inserting FAR 52.222-90 in new solicitations and resulting contracts.  They were also required to amend any…More

A recent decision by the Court of Appeals for the Federal Circuit provides clear guidance for contract awardees: violations of redaction requirements by protesters or other parties will not save a non-intervening awardee from its failure to protect its contract award. An awardee that chooses not to intervene in a bid protest needs to carefully monitor the docket and take prompt action to obtain information and seek relief when necessary to protect its contract award and other rights. In early February,…More

In J&J Maintenance, Inc., B-423821.2; B-423821.3 (April 20, 2026), the Government Accountability Office (“GAO”) issued a decision that provides a helpful reminder for government contractors pursuing bid protests. In particular, the decision reinforces the principle that mere identification of a waived or relaxed material solicitation requirement is insufficient for GAO to sustain a protest. The decision warns that, to prevail in such a challenge, a protester must also demonstrate that it was competitively prejudiced by the agency’s actions. Background The U.S. Army…More

The federal government’s most sweeping cyber incident reporting mandate is approaching its final stages, and government contractors across a wide range of industries should be paying close attention. The Cyber Incident Reporting for Critical Infrastructure Act of 2022, known as CIRCIA, will require hundreds of thousands of organizations to report significant cyber incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA) on tight timelines. The new requirements are likely to disproportionately impact government contractors because of the…More

President Trump’s administration has brought, and continues to bring, sweeping changes to the government contracting landscape. From the Revolutionary FAR Overhaul to promoting commercial purchasing and use of non-traditional contracting vehicles such as Other Transaction Agreements and Commercial Solutions Openings, contractors have been required to rapidly make changes and adjust to a significantly changing environment. This week brought additional change—though it is not “revolutionary.” In an April 30, 2026 executive order (EO) titled “Promoting Efficiency, Accountability, and Performance in Federal Contracting,”…More

In Life Science Logistics, LLC v. United States,[1] the U.S. Court of Appeals for the Federal Circuit (“Federal Circuit”) affirmed that a disappointed bidder challenging an agency’s override of a Competition in Contracting Act (“CICA”) stay must only show the override was arbitrary and capricious. The court rejected the government’s argument that the plaintiff must also satisfy the traditional four-factor test for preliminary injunctions—likelihood of success on the merits, irreparable harm, balance of equities, and benefit to the public. The…More