Morrison Foerster’s Government Contracts Insights provides our in-depth analysis of developments and trends impacting government contracting. Through Insights, our attorneys offer a real-time assessment of the statutory, regulatory, legal, and business-related developments and trends that are shaping the industry. We also examine a full array of non-U.S. public procurement issues, mindful that our clients compete in a global marketplace.Morrison Foerster’s nationally recognized Government Contracts and Public Procurement practice represents the world’s leading companies in the aerospace and defense, intelligence, cybersecurity, information technology, financial and professional services, education, healthcare, infrastructure, and logistics support sectors. We are enlisted to address our clients’ most complex and important legal issues. Our work includes contract and subcontract negotiation and other transactional matters, business and regulatory compliance counseling, internal investigations, bid protests, and a wide array of enforcement and litigation matters. Our clients range from Fortune 50 companies to small and medium-sized companies just entering the public sector. We advise both U.S. and non-U.S. companies involved in municipal, state, federal, and non-U.S. procurement matters.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

GAO Protest Timeline

govcon-gao-protest-timeline-thumb.jpg

Govcon GAO Post Award Protest Timeline Article

Contract Disputes Act Claim Timeline

govcon-contract-disputes-timeline-thumb.jpg

The Bayh-Dole Act

govcon-bayhdole-thumb.jpg

Anatomy of a Protest

govcon-federalclaimsprotest-thumb.jpg

Allowability of Legal Costs

govcon-allowabilityoflegalcosts-thumb.jpg

Procurement Integrity Act

240715-procurement-integrity-act-resized.jpg

Govcon-Resources

Tina is Co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She represents a wide variety of government contractors including information technology, defense, biotechnology, and pharmaceutical companies, with a focus on general contract counseling and compliance, particularly concerning intellectual property, and cybersecurity matters and federal grant funding.Tina counsels contractors on compliance with federal, state and local acquisition and ethics regulations and with the evolving myriad of requirements pertaining to data security and cybersecurity. She has been involved with numerous internal investigations and compliance reviews, and with mandatory and voluntary disclosures to agencies, and litigation of False Claims Act matters.Tina routinely advises clients concerning:<ul><li>Prime-subcontractor relationships</li><li>Sources of supply and country of origin requirements</li><li>Price reductions and price reporting issues</li><li>Organizational conflicts of interest</li><li>Safeguarding of intellectual property and other proprietary interests</li><li>Licensing and data rights issues</li><li>Handling of classified materials and controlled unclassified information</li><li>Agency suspension and debarment proceedings</li></ul>She also assists clients with due diligence and other activities related to the acquisition of government contracting concerns, and with the drafting and negotiation of teaming agreements, subcontracts, licensing agreements, and cooperative research and development agreements. She also assists clients applying for federal grants (including SBIR and STTR agreements), and those who seek to obtain other transactional authority agreements, as well as those competing for state and local government work.Tina’s litigation experience includes government contracts claims litigation in federal courts and before boards of contract appeals, bid protests before the Government Accountability Office and the Court of Federal Claims, and complex disputes in federal courts, including civil fraud and False Claims Act litigation and reverse Freedom of Information Act litigation.Prior to joining Morrison Foerster, Tina worked at another large national firm and as a trial attorney in the Office of the General Counsel of the Navy, Navy Litigation Office.<h4>Representative Experience</h4><ul><li>Negotiation of largest CHIPS Act federal funding agreement between multinational semiconductor corporation and U.S. Department of Commerce.</li><li>Negotiated prime contract and major subcontracts related to the Department of Energy’s next generation supercomputer program, including extensive IP rights negotiations and negotiation of associated patent rights waivers.</li><li>Negotiated series of other transaction authority agreements with DARPA and associated subcontracts with more than a dozen research universities on behalf of a firm biotech client, including complex IP rights allocations and material transfer agreements.</li><li>Assist clients with FedRAMP authorization process and with development of license agreements for software products sold to federal, state and local government agencies.</li><li>Cyber incident response counseling to some of the largest companies and organizations impacted by security incidents.</li><li>Advises clients on Bayh-Dole reporting of inventions and IP strategies for contracts and grants.</li><li>Conducts due diligence for major government contract mergers and acquisitions.</li></ul>

reynolds_tina_blog_150x150.png

reynolds_tina_common_640x280.jpg

reynolds_tina_heroretina_2700x1160.jpg

reynolds_tina_mobileretina_750x1040.jpg

reynolds_tina_social_600x600.jpg

Partner

Tina is co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She counsels a wide variety of government contractors on compliance with federal acquisition and ethics regulations. She drafts and negotiates contracts on their behalf and has been involved with numerous internal investigations and compliance reviews, and with bid protest, contract claims, and False Claims Act litigation. She also advises on M&A transactions involving government contractors.

Tina D. Reynolds

Jim Tucker is of counsel in Morrison Foerster’s Government Contracts and Public Procurement Practice Group and is based in the firm’s Washington, D.C. office.Jim’s practice runs the gamut of litigation and counseling in federal procurement matters, with an emphasis on bid protests, Cost Accounting Standards disputes, and small business matters. He has represented both protesters and awardees in scores of protests before the Government Accountability Office, the Court of Federal Claims, and procuring agencies, in acquisitions ranging from small business procurements to multibillion-dollar contracts of global significance. His representative protest matters span the aerospace sector, the Intelligence Community, base operations and logistics, healthcare, nuclear and environmental work, and information technology and software acquisitions. His protests have included both classified and unclassified programs. In addition to prevailing in published decisions, Jim has also secured favorable corrective action on behalf of clients in a wide variety of protests that were resolved without a published decision.Jim’s work also focuses on disputes over cost allowability and compliance with the Cost Accounting Standards, and he has appeared before the Armed Services and Civilian Boards of Contract Appeals, in size and status protests before Small Business Administration (SBA) area offices, and appeals before the SBA Office of Hearings and Appeals. Jim regularly counsels clients on contract interpretation, organizational conflicts of interest, and small business compliance.Jim graduated with high honors from the George Washington University Law School, where he focused his studies on federal procurement law, was a member of the Law Review, and interned with the General Services Administration’s suspension and debarment office. Jim also holds a degree in theology magna cum laude from the Pontifical Gregorian University in Rome and a bachelor’s degree in classical languages and literature summa cum laude from the University of Kentucky, where he graduated Phi Beta Kappa.

tucker_james_blog_150x150.png

tucker_james_common_640x280.jpg

tucker_james_heroretina_2700x1160.jpg

tucker_james_mobileretina_750x1040.jpg

tucker_james_social_600x600.jpg

Of Counsel

Jim maintains an active practice in bid protests before the Government Accountability Office and contracting agencies and counsels clients in contract disputes and compliance obligations.

Jim Tucker is of counsel in Morrison Foerster’s Government Contracts and Public Procurement Practice Group and is based in the firm’s Washington, D.C. office. Jim’s practice runs the gamut of litigation and counseling in federal procurement matters, with an emphasis on bid protests, Cost Accounting Standards disputes, and small business matters.

James Tucker

<div style="margin-bottom: 15px;" class="videoWrapper"><iframe class="sticky-video" title="Meet Alex Ward, Government Contracts Practice Co-Chair" src="https://www.youtube-nocookie.com/embed/TkliwdSlTaQ?rel=0" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen="1" title="iframe"></iframe></div>J. Alex Ward is co-chair of Morrison Foerster’s Government Contracts and Public Procurement group. His practice covers a full range of government contracts matters, including investigations, bid protests, claims, general litigation, corporate transactions, and counseling. Alex strives in all matters is to provide his clients the highest level of efficient and effective representation.Alex represents contractors in internal and external investigations, disclosures to the government, and qui tam litigation, with great success in reducing or eliminating his clients’ exposure through active engagement with the government. His work in this area includes obtaining numerous declinations and dismissals of False Claims Act cases in their earliest stages, sparing his clients the cost, risk, and exposure of litigation.He has also served as lead counsel in dozens of bid protests involving military and civilian agency procurements of a wide range of products and services, including all manner of pre- and post-award protests in the GAO, the U.S. Court of Federal Claims, and state tribunals, as well as appeals to the U.S. Court of Appeals for the Federal Circuit and size protest appeals before the SBA’s Office of Hearings and Appeals.Alex handles all aspects of the claims process, from the initial assessment and drafting of requests for equitable adjustment through litigation in the Boards of Contract Appeals and the Court of Federal Claims. Alex’s practice also covers the full gamut of other controversies confronting government contractors, including prime-sub, teaming partner, employer-employee, competitor, and indemnification disputes. His litigation work also includes a wide variety of pro bono engagements, in which he has represented both individual and institutional clients in matters ranging from immigration and criminal defense to sustainable procurement and protection of the environment.Prior to joining the firm, Alex served in the U.S. Army as a commissioned officer and an Assistant to the General Counsel of the Army responsible for civil works and international matters, and as a clerk for judges on the U.S. Courts of Appeals for the Armed Forces and the D.C. Circuit. He is a member of the Boards of the Morrison & Foerster Foundation and the Chesapeake Bay Foundation and of Law360’s Government Contracts Editorial Board.

ward_alex_blog_150x150.png

ward_alex_common_640x280.jpg

ward_alex_heroretina_2700x1160.jpg

ward_alex_mobileretina_750x1040.jpg

ward_alex_social_600x600.jpg

Alex is co-chair of Morrison Foerster’s Government Contracts and Public Procurement practice. His practice covers a full range of government contracts matters, including bid protests, claims, investigations, corporate transactions, and counseling.

J. Alex Ward

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Government Contracts Insights blog provides an in-depth analysis of news, developments, and trends impacting government contracting and procurement. Through Insights, attorneys from our nationally recognized Government Contracts and Public Procurement practice will offer a real-time assessment of the statutory, regulatory, legal, and business-related developments that are shaping the industry. This blog will also examine a full array of U.S. and non-U.S. public procurement issues, mindful that our clients compete in a global marketplace.Read about our <a href="http://govcon.mofo.com/editors/">Authors</a>.Never miss a post. Subscribe to get real-time updates.

Brad is a partner in Morrison Foerster’s Litigation Department, Managing Partner of the Austin office, and Chair of the firm’s Israel practice. He is the former Co-Chair of the firm’s Global Litigation Practice and the Government Contracts + Public Procurement Practice.

Bradley Wine

gov-con-feature-image-thumb1.jpg

Welcome to the Government Contracts Insights Blog

Welcome to the Government Contracts Insights Blog

gov-con-feature-image_(1)1.jpg

The United States Capitol building

Morrison Foerster’s Government Contracts Insights blog provides an in-depth analysis of news, developments, and trends impacting government contracting and proc

Announcements & Press

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

Looks behind the headlines to explore the trends, identify the opportunities, analyze the issues, and provide guidance for science and technology-based companies.

MoFo Tech

Mofo Tech

News and thought leadership from lawyers who are adding value to the legal profession and the communities we call home.

  External-Link

MoFo + Blog

Mofo+

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

Our Government Contracts Insights blog provides in-depth analysis of developments and trends impacting U.S. government contracting and non-U.S. public procureme

Government Contracts Insights

  Linkedin

MoFo LinkedIN

Blog - Govcon RSS

Stay Connected

Never miss a post from Government Contracts Insights. Enter your email below to stay up-to-date.

Subscribe

The latest updates and analysis from Morrison Foerster

Morrison Foerster - Footer

On September 29, 2020, the Department of Defense (DoD) issued a long-anticipated interim rule implementing its Cybersecurity Maturity Model Certification (CMMC)

Blogs -  Home Button

Home

Blog - Topics

Acquisition Regulations

Artificial Intelligence + Robotics

Compliance

Coronavirus

Cybersecurity & Data Privacy

Data Rights

Defense

Domestic Preferences

False Claims Act

Federal Procurement

Foreign Corrupt Practices Act

Grants

Health Care

Intellectual Property

International Public Procurement

Labor & Employment

Mergers & Acquisitions

National Security

Protests & Litigation

Resources

Schedule Contracting

Small Business

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

Department of Defense Issues CMMC Interim Rule, Setting up a Two-Part Process  for Review of Contractor IT Systems

Department of Defense Issues CMMC Interim Rule, Setting up a Two-Part Process  for Review of Contractor IT Systems | Government Contracts Insights

On September 29, 2020, the Department of Defense (DoD) issued a long-anticipated <a rel="noopener noreferrer" target="_blank" href="https://www.govinfo.gov/content/pkg/FR-2020-09-29/pdf/2020-21123.pdf">interim rule</a> implementing its Cybersecurity Maturity Model Certification (CMMC) program.  The rule introduces a new mandatory construct, the DoD Assessment Methodology, to serve as an interim certification process before contractors undergo a full CMMC review.  A full description of the interim rule and what it means for DoD contractors follows.  The interim rule becomes effective November 30, 2020, although full implementation of CMMC will not be achieved until 2025.******The interim rule amends the Defense Federal Acquisition Regulation Supplement (DFARS) to achieve phased implementation of both the newly required assessment methodology and the CMMC framework.  The NIST SP 800-171 DoD Assessment Methodology, is a standard approach to assess contractor implementation of the cybersecurity requirements in the National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-171.  The Cybersecurity Maturity Model Certificate (CMMC) Framework is a DoD certification process that measures a company’s further implementation of cybersecurity processes and practices beyond NIST SP 800-171.DoD Assessment MethodologyThe current DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is required in all DoD contracts except those solely for commercial off-the shelf (COTS) items. Under the -7012 clause, contractors must apply the cybersecurity requirements of NIST SP 800-171 to “covered contractor information systems,” which are generally those that store, process, generate, transmit or access DoD-related controlled unclassified information (CUI), which DoD terms “covered defense information.”  Presently, contractors and any of their subcontractors with access to “covered defense information” self-certify as to compliance with the clause through acceptance of the clause in contracts and subcontracts.The DoD Assessment Methodology requirement was developed to address perceived flaws in this self-assessment process.  The Methodology involves three levels – Basic, Medium, and High – which reflect the level of confidence DoD has in the assessment, and uses a scoring methodology that takes into account how many of the 110 NIST SP 800-171 controls a contractor has fully implemented.Basic assessments are to be performed by the contractor, using the specified DoD Assessment Methodology.  The results are reported to a Defense Information Systems Agency-run database, the <a rel="noopener noreferrer" target="_blank" href="https://www.sprs.csd.disa.mil/">Supplier Performance Risk System (SPRS)</a>.  Medium and High assessments will be performed by various DoD components (including the Defense Contract Management Agency) under specific circumstances. These DoD components will also report results of the Medium and High reviews to SPRS.The SPRS database will be accessible throughout DoD.  Beginning November 30, 2020, contracting officers will be required to check the database to confirm that an entity that is required to implement NIST SP 800-171 has an active SPRS Assessment prior to the award of a new contract or exercise of an option under an existing contract.  SPRS Assessments are good for three years, and must be renewed prior to expiration in order for DoD contractors to maintain eligibility for contract awards.  Assessments must be completed for each contractor IT system used in connection with a DoD contract.The new contract clauses DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, and 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, describe the assessment process, and the latter clause requires contractors to provide the government access to its facilities, systems, and personnel when higher-level reviews are required.  Both clauses are to be included in all solicitations and contracts after November 30, 2020, including those for commercial items, unless solely COTS products are involved.The DFARS 252.204-7019 clause walks contractors through the logistics for performing and reporting a Basic DoD Assessment.  As part of the process, each contractor must supply the following information with respect to each system being assessed:  system security plan name, CAGE code, brief description of plan architecture, date of assessment, total score, and date that a score of 110 will be achieved.  Contractors that have fully implemented all 110 NIST SP 800-171 security requirements will be able to report the highest possible score of 110.  Others will merit a lower score depending how many and which requirements are unimplemented.  DoD has indicated that it is requesting this detail so that contractors can no longer leave security controls unaddressed indefinitely.  Now contractors and subcontractors that store, process, generate, transmit or access covered defense information must establish enforceable timelines to address any compliance gaps.DoD will select contractors for Medium and High review post-award, based on the critical nature of the program involved or particular sensitivity of information being handled by the contractor.  The interim rule states that DoD expects to assess 200 entities a year at the Medium level of review and 110 at the High level.With the SPRS information, DoD components will have visibility into contractors’ current levels of compliance without having to undertake contract- or program-specific reviews.  There will also be a single source for information, which will eliminate duplicative, and possibly conflicting, assessments by different DoD components.DFARS 252.204-7019 does not contain a flowdown provision, but the substance of DFARS 252.204-7020 must be flowed down to all subcontractors (except COTS suppliers).  The clause further directs that prime contractors are required to ensure that applicable subcontractors (i.e., those that must meet NIST SP 800-171 requirements) have a current DoD Assessment posted in SPRS.CMMC ImplementationWith the interim rule, DoD is phasing in the rollout of CMMC.  All contracts over the micropurchase threshold (except for COTS) will require CMMC certification beginning September 30, 2025.  Until then, the DoD, specifically, the Office of the Under Secretary of Defense for Acquisition and Sustainment, will decide which solicitations will include the CMMC requirement and the new associated DFARS clause at 252.204-7021, Cybersecurity Maturity Model Certification Requirements.CMMC assessments will be conducted by designated and specially trained CMMC Third Party Assessment Organizations (C3PAOs).  Once the C3PAO has completed an assessment, the contractor is awarded a certification at the appropriate certification level by the CMMC Accreditation Body (AB).  These certifications will be included in the same SPRS database as the DoD Assessment Methodology reviews.  Also as with the DoD Assessment reviews, CMMC certifications will be good for three years.  Once CMMC is in effect, contracting officers cannot make contract awards, or exercise an option on a contract, if the offeror or contractor does not have a current certification at the CMMC level required under the applicable solicitation or contract.The various CMMC levels build upon one another.  Level 1, the most basic level, is the equivalent of the current FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.  Level 2 has more requirements, but is not as robust as Level 3, which includes all 110 NIST SP 800-171 requirements, plus an additional 20 CMMC practices and three CMMC processes.  Levels 4 and 5 represent a significant increase in complexity, with far more practices and processes, which are designed to reduce the risk of Advanced Persistent Threats or attacks by adversaries using multiple, sophisticated techniques.  The requirements for each level are described in the CMMC model.CMMC review can pertain to a contractor’s entire enterprise network or the contractor can elect to have particular network segments or enclaves that will store, process, generate or transmit contract-related information to be evaluated separately (and potentially each at different levels).Where it appears in current contracts, and in all cases after October 1, 2025, the DFARS 252.204-7021 clause is a mandatory flowdown to subcontractors at all tiers.  The level of CMMC certification that will apply to any given subcontractor, however, will be based on the sensitivity of the information provided to that subcontractor.  The interim rule does not specify whether the government or the contractor will make this determination, but implies that this will be the contractor’s responsibility.Open Questions and Other Interesting Aspects of the Interim RuleSubject to the caveat that the final rule may alter the new clause requirements, our preliminary review of the interim rule leads to a few observations:<ul><li>Although this rule has been years in the making, DoD issued it as an interim rule, rather than in draft form, because it made a determination that urgent and compelling circumstances so required. Although DoD has solicited comments, contractors should not expect the final rule to vary significantly from the current interim posture.  Minor clarifications are far more likely than any major policy shift.</li><li>Beginning November 30, 2020, contracting officers will need to confirm that an entity has an active SPRS Assessment in order to award a new contract or exercise an option under an existing contract where the offeror or contractor is required to implement NIST SP 800-171. Previously, contracting officers have not had to determine whether or not contracts require implementation of NIST SP 800-171, because the -7012 clause was simply inserted into every contract.  How are contracting officers going to make this determination?  In some instances, where extensive covered defense information is involved in contract performance, this may be obvious.  Less obvious, however, may be where the contractor performs its work, and whether covered defense information actually passes through the contractor’s systems.</li><li>The purpose of the DoD Assessment rating number and level is unclear. As drafted, the interim rule and new regulations only require contracting officers to make sure that an offeror has a current DoD Assessment prior to making award.  Yet what happens if the Assessment score is very low?  Can this be a basis for rejection of an offer?  Can a contracting officer assign more risk and therefore give less evaluation credit to a company with a Basic score below 110?  Or can the contracting officer rate more highly a company with a Medium or High posture even though companies cannot control whether they will be subjected to Medium or High Assessments?  Review will be done post-award in the first instance, but results will be in SPRS thereafter for use with other programs.</li><li>Because the DoD Assessment Methodology applies not only to new awards but also to the exercise of options, will existing contracts be modified to include DFARS 252.204-7019 and 252.204-7020, or will the clauses only appear in solicitations, and resultant contracts, after the November 30, 2020 effective date for the rule?</li><li>DoD indicates in the interim rule that it expects 129,810 unique entities will receive a CMMC assessment in the next five years, until CMMC is required for all contractors and subcontractors. This is a highly specific number; it would be informative to the contracting community to know how this estimate was derived so that companies can estimate the timing of their CMMC reviews.</li><li>DoD states that CMMC will conduct an onsite assessment for every level of review, including Level 1. The possibility of a virtual review for Level 1 assessments had been discussed, but ultimately DoD has concluded that an onsite assessment would be useful to verify implementation of security practices and also to officially identify contractors and subcontractors in the DoD supply chain.  It is not clear how this onsite review will work for contractors and subcontractors outside the U.S.; presumably, C3PAOs will be available worldwide.</li><li>DoD states that it considered requiring CMMC certification prior to submission of an offer, or after contract award, but ultimately settled on the interim position that an offeror must be certified to the requisite CMMC level at the time of contract award. DoD has invited comment on its decision, perhaps suggesting that it is not wed to this position.</li><li>At one point, DoD had taken the position that CMMC certification requirements would apply to all DoD contracts, including those involving COTS items. This interim rule indicates that the agency has been persuaded that application to COTS contractors is unnecessary and unduly burdensome.</li><li>DoD has stated that it does not intend to issue any contracts that require CMMC Level 2 certification, leaving Level 2 as merely a meaningless way station between Levels 1 and 3. So seemingly the only contractors that will be certified at Level 2 will be those that fail to meet the Level 3 requirements.</li><li>Speaking of CMMC levels, prime contractors are apparently supposed to select the appropriate level for their subcontractors (which may differ from the prime contract level), yet the interim rule and applicable DFARS clauses provide no guidance as to how this is to be accomplished.</li><li>Likewise, primes must verify that their subcontractors have DoD Assessments and, later, CMMC certifications, yet primes will not have access to the SPRS database, except to review their own submissions. Prime contractors will need to create certification requirements for their subcontractors, and/or ask for copies of subcontractors’ SPRS entries in order to meet this verification requirement.</li><li>Despite the lack of public access, the security of the information in the SPRS database is unclear. DFARS 252.204-7019(d)(3)(iii) states that documentation related to a High Assessment will be considered CUI and protected against unauthorized release, with specific reference to FOIA Exemption 4 for confidential and trade secret information.  However, information pertaining to other assessment levels need only be protected in accordance with a DoD Instruction on sharing supplier information.  DFARS 252.204-7019(d)(3)(i); DFARS 252.204-7020(f)(1).  DoD does not state it will treat this information as CUI.</li></ul>What do you contractors and subcontractors need to do now?As with any major regulatory change, contractors need some clear and immediate direction in terms of next steps and timing.  We therefore would offer, in roughly descending order of priority, the following recommendations:<ul><li>Familiarize yourself with the DoD Assessment and prepare to perform a Basic self-assessment. At least based on the language of the interim rule, assessment results must be reported to SPRS in order for your company to receive an award after November 30, 2020.</li><li>If you are not required to implement NIST SP 800-171 security controls because your company does not store, process, generate, transmit or access covered defense information on its systems, be prepared to document why you do not need to conduct a DoD Assessment.</li><li>Plans of Action and Milestones are now risky, as they will lower your Basic DoD Assessment Score and will not be permissible at all under CMMC. Where possible, cybersecurity compliance gaps should be addressed and resolved in the next 60 days.</li><li>Speak with the program and contracting leadership for upcoming procurements (consistent with Procurement Integrity rules, of course) to get a sense of whether the opportunities may include CMMC requirements.</li><li>Continue to prepare for CMMC certification at the level appropriate for your work and systems, with the understanding that for some contractors, the certification process may be several years away.</li></ul>

More

The Tortured Regulations Department: SBA’s New Rule and Its Effect on Investments

Bid Protest Spotlight: Standing, Relationships, Responsibility

House’s Passage of the SAMOSA Act Signals Policy Shift Towards Government-Wide Enterprise Software Licensing

New DFARS Regulation on Small Business Affiliate Past Performance

Bid Protest Spotlight: Unclear Criteria, Data Rights, Conflicts

LinkedIN