Morrison Foerster’s Government Contracts Insights provides our in-depth analysis of developments and trends impacting government contracting. Through Insights, our attorneys offer a real-time assessment of the statutory, regulatory, legal, and business-related developments and trends that are shaping the industry. We also examine a full array of non-U.S. public procurement issues, mindful that our clients compete in a global marketplace.Morrison Foerster’s nationally recognized Government Contracts and Public Procurement practice represents the world’s leading companies in the aerospace and defense, intelligence, cybersecurity, information technology, financial and professional services, education, healthcare, infrastructure, and logistics support sectors. We are enlisted to address our clients’ most complex and important legal issues. Our work includes contract and subcontract negotiation and other transactional matters, business and regulatory compliance counseling, internal investigations, bid protests, and a wide array of enforcement and litigation matters. Our clients range from Fortune 50 companies to small and medium-sized companies just entering the public sector. We advise both U.S. and non-U.S. companies involved in municipal, state, federal, and non-U.S. procurement matters.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

GAO Protest Timeline

govcon-gao-protest-timeline-thumb.jpg

Govcon GAO Post Award Protest Timeline Article

Contract Disputes Act Claim Timeline

govcon-contract-disputes-timeline-thumb.jpg

The Bayh-Dole Act

govcon-bayhdole-thumb.jpg

Anatomy of a Protest

govcon-federalclaimsprotest-thumb.jpg

Allowability of Legal Costs

govcon-allowabilityoflegalcosts-thumb.jpg

Procurement Integrity Act

240715-procurement-integrity-act-resized.jpg

Govcon-Resources

Tina is Co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She represents a wide variety of government contractors including information technology, defense, biotechnology, and pharmaceutical companies, with a focus on general contract counseling and compliance, particularly concerning intellectual property, and cybersecurity matters and federal grant funding.Tina counsels contractors on compliance with federal, state and local acquisition and ethics regulations and with the evolving myriad of requirements pertaining to data security and cybersecurity. She has been involved with numerous internal investigations and compliance reviews, and with mandatory and voluntary disclosures to agencies, and litigation of False Claims Act matters.Tina routinely advises clients concerning:<ul><li>Prime-subcontractor relationships</li><li>Sources of supply and country of origin requirements</li><li>Price reductions and price reporting issues</li><li>Organizational conflicts of interest</li><li>Safeguarding of intellectual property and other proprietary interests</li><li>Licensing and data rights issues</li><li>Handling of classified materials and controlled unclassified information</li><li>Agency suspension and debarment proceedings</li></ul>She also assists clients with due diligence and other activities related to the acquisition of government contracting concerns, and with the drafting and negotiation of teaming agreements, subcontracts, licensing agreements, and cooperative research and development agreements. She also assists clients applying for federal grants (including SBIR and STTR agreements), and those who seek to obtain other transactional authority agreements, as well as those competing for state and local government work.Tina’s litigation experience includes government contracts claims litigation in federal courts and before boards of contract appeals, bid protests before the Government Accountability Office and the Court of Federal Claims, and complex disputes in federal courts, including civil fraud and False Claims Act litigation and reverse Freedom of Information Act litigation.Prior to joining Morrison Foerster, Tina worked at another large national firm and as a trial attorney in the Office of the General Counsel of the Navy, Navy Litigation Office.<h4>Representative Experience</h4><ul><li>Negotiation of largest CHIPS Act federal funding agreement between multinational semiconductor corporation and U.S. Department of Commerce.</li><li>Negotiated prime contract and major subcontracts related to the Department of Energy’s next generation supercomputer program, including extensive IP rights negotiations and negotiation of associated patent rights waivers.</li><li>Negotiated series of other transaction authority agreements with DARPA and associated subcontracts with more than a dozen research universities on behalf of a firm biotech client, including complex IP rights allocations and material transfer agreements.</li><li>Assist clients with FedRAMP authorization process and with development of license agreements for software products sold to federal, state and local government agencies.</li><li>Cyber incident response counseling to some of the largest companies and organizations impacted by security incidents.</li><li>Advises clients on Bayh-Dole reporting of inventions and IP strategies for contracts and grants.</li><li>Conducts due diligence for major government contract mergers and acquisitions.</li></ul>

reynolds_tina_blog_150x150.png

reynolds_tina_common_640x280.jpg

reynolds_tina_heroretina_2700x1160.jpg

reynolds_tina_mobileretina_750x1040.jpg

reynolds_tina_social_600x600.jpg

Partner

Tina is co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She counsels a wide variety of government contractors on compliance with federal acquisition and ethics regulations. She drafts and negotiates contracts on their behalf and has been involved with numerous internal investigations and compliance reviews, and with bid protest, contract claims, and False Claims Act litigation. She also advises on M&A transactions involving government contractors.

Tina D. Reynolds

Jim Tucker is of counsel in Morrison Foerster’s Government Contracts and Public Procurement Practice Group and is based in the firm’s Washington, D.C. office.Jim’s practice runs the gamut of litigation and counseling in federal procurement matters, with an emphasis on bid protests, Cost Accounting Standards disputes, and small business matters. He has represented both protesters and awardees in scores of protests before the Government Accountability Office, the Court of Federal Claims, and procuring agencies, in acquisitions ranging from small business procurements to multibillion-dollar contracts of global significance. His representative protest matters span the aerospace sector, the Intelligence Community, base operations and logistics, healthcare, nuclear and environmental work, and information technology and software acquisitions. His protests have included both classified and unclassified programs. In addition to prevailing in published decisions, Jim has also secured favorable corrective action on behalf of clients in a wide variety of protests that were resolved without a published decision.Jim’s work also focuses on disputes over cost allowability and compliance with the Cost Accounting Standards, and he has appeared before the Armed Services and Civilian Boards of Contract Appeals, in size and status protests before Small Business Administration (SBA) area offices, and appeals before the SBA Office of Hearings and Appeals. Jim regularly counsels clients on contract interpretation, organizational conflicts of interest, and small business compliance.Jim graduated with high honors from the George Washington University Law School, where he focused his studies on federal procurement law, was a member of the Law Review, and interned with the General Services Administration’s suspension and debarment office. Jim also holds a degree in theology magna cum laude from the Pontifical Gregorian University in Rome and a bachelor’s degree in classical languages and literature summa cum laude from the University of Kentucky, where he graduated Phi Beta Kappa.

tucker_james_blog_150x150.png

tucker_james_common_640x280.jpg

tucker_james_heroretina_2700x1160.jpg

tucker_james_mobileretina_750x1040.jpg

tucker_james_social_600x600.jpg

Of Counsel

Jim maintains an active practice in bid protests before the Government Accountability Office and contracting agencies and counsels clients in contract disputes and compliance obligations.

Jim Tucker is of counsel in Morrison Foerster’s Government Contracts and Public Procurement Practice Group and is based in the firm’s Washington, D.C. office. Jim’s practice runs the gamut of litigation and counseling in federal procurement matters, with an emphasis on bid protests, Cost Accounting Standards disputes, and small business matters.

James Tucker

<div style="margin-bottom: 15px;" class="videoWrapper"><iframe class="sticky-video" title="Meet Alex Ward, Government Contracts Practice Co-Chair" src="https://www.youtube-nocookie.com/embed/TkliwdSlTaQ?rel=0" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen="1" title="iframe"></iframe></div>J. Alex Ward is co-chair of Morrison Foerster’s Government Contracts and Public Procurement group. His practice covers a full range of government contracts matters, including investigations, bid protests, claims, general litigation, corporate transactions, and counseling. Alex strives in all matters is to provide his clients the highest level of efficient and effective representation.Alex represents contractors in internal and external investigations, disclosures to the government, and qui tam litigation, with great success in reducing or eliminating his clients’ exposure through active engagement with the government. His work in this area includes obtaining numerous declinations and dismissals of False Claims Act cases in their earliest stages, sparing his clients the cost, risk, and exposure of litigation.He has also served as lead counsel in dozens of bid protests involving military and civilian agency procurements of a wide range of products and services, including all manner of pre- and post-award protests in the GAO, the U.S. Court of Federal Claims, and state tribunals, as well as appeals to the U.S. Court of Appeals for the Federal Circuit and size protest appeals before the SBA’s Office of Hearings and Appeals.Alex handles all aspects of the claims process, from the initial assessment and drafting of requests for equitable adjustment through litigation in the Boards of Contract Appeals and the Court of Federal Claims. Alex’s practice also covers the full gamut of other controversies confronting government contractors, including prime-sub, teaming partner, employer-employee, competitor, and indemnification disputes. His litigation work also includes a wide variety of pro bono engagements, in which he has represented both individual and institutional clients in matters ranging from immigration and criminal defense to sustainable procurement and protection of the environment.Prior to joining the firm, Alex served in the U.S. Army as a commissioned officer and an Assistant to the General Counsel of the Army responsible for civil works and international matters, and as a clerk for judges on the U.S. Courts of Appeals for the Armed Forces and the D.C. Circuit. He is a member of the Boards of the Morrison & Foerster Foundation and the Chesapeake Bay Foundation and of Law360’s Government Contracts Editorial Board.

ward_alex_blog_150x150.png

ward_alex_common_640x280.jpg

ward_alex_heroretina_2700x1160.jpg

ward_alex_mobileretina_750x1040.jpg

ward_alex_social_600x600.jpg

Alex is co-chair of Morrison Foerster’s Government Contracts and Public Procurement practice. His practice covers a full range of government contracts matters, including bid protests, claims, investigations, corporate transactions, and counseling.

J. Alex Ward

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Government Contracts Insights blog provides an in-depth analysis of news, developments, and trends impacting government contracting and procurement. Through Insights, attorneys from our nationally recognized Government Contracts and Public Procurement practice will offer a real-time assessment of the statutory, regulatory, legal, and business-related developments that are shaping the industry. This blog will also examine a full array of U.S. and non-U.S. public procurement issues, mindful that our clients compete in a global marketplace.Read about our <a href="http://govcon.mofo.com/editors/">Authors</a>.Never miss a post. Subscribe to get real-time updates.

Brad is a partner in Morrison Foerster’s Litigation Department, Managing Partner of the Austin office, and Chair of the firm’s Israel practice. He is the former Co-Chair of the firm’s Global Litigation Practice and the Government Contracts + Public Procurement Practice.

Bradley Wine

gov-con-feature-image-thumb1.jpg

Welcome to the Government Contracts Insights Blog

Welcome to the Government Contracts Insights Blog

gov-con-feature-image_(1)1.jpg

The United States Capitol building

Morrison Foerster’s Government Contracts Insights blog provides an in-depth analysis of news, developments, and trends impacting government contracting and proc

Announcements & Press

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

Looks behind the headlines to explore the trends, identify the opportunities, analyze the issues, and provide guidance for science and technology-based companies.

MoFo Tech

Mofo Tech

News and thought leadership from lawyers who are adding value to the legal profession and the communities we call home.

  External-Link

MoFo + Blog

Mofo+

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

Our Government Contracts Insights blog provides in-depth analysis of developments and trends impacting U.S. government contracting and non-U.S. public procureme

Government Contracts Insights

  Linkedin

MoFo LinkedIN

Blog - Govcon RSS

Stay Connected

Never miss a post from Government Contracts Insights. Enter your email below to stay up-to-date.

Subscribe

The latest updates and analysis from Morrison Foerster

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Acquisition Regulations

Artificial Intelligence + Robotics

Compliance

Coronavirus

Cybersecurity & Data Privacy

Data Rights

Defense

Domestic Preferences

False Claims Act

Federal Procurement

Foreign Corrupt Practices Act

Grants

Health Care

Intellectual Property

International Public Procurement

Labor & Employment

Mergers & Acquisitions

National Security

Protests & Litigation

Resources

Schedule Contracting

Small Business

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

James A. Tucker

SHARE IT Act Requires Agencies to Share Custom-Developed Source Code Throughout the Government

FAR Council Withdraws “Pay Equity and Transparency” Proposed Rule

FY25 NDAA: Promoting Nontraditional Acquisition While Securing the Supply Chain, and More

Enforcing New Recertification Rules: Changes to SBA’s Size Protest Regulations

Shoot First, Ask Questions Later: Final Rule Keeps FAR’s Inconsistent Treatment of Proposed Debarments

We have received questions from a number of clients about whether SBA’s consent is required for a change of control involving a Paycheck Protection Program borrower.  On October 2, SBA provided additional guidance that clarifies:1. No consent is required (unless loan documents indicate otherwise):a. Transfer of less than 20 percent of the common stock or other ownership interest of a PPP borrower.b. Transfer of less than 50 percent of the assets of a PPP borrower  (measured by fair market value).c. The PPP note is repaid in full.d. The loan forgiveness process has been completed and (i) SBA has remitted funds to the PPP lender or (ii) the borrower has repaid any remaining balance.2. Lender consent only  (unless loan documents indicate otherwise) is required for either of the following situations:a. Stock Sale: the sale or other transfer of 50% or less of the common stock or other ownership interest of the PPP borrower.b. Stock or Asset Sale: The PPP borrower submits its forgiveness application to the PPP Lender and establishes an interest bearing escrow account controlled by the PPP lender for the outstanding loan balance.Even where only lender consent is required, additional information must be submitted to SBA within five business days of closing, including:  identity of the new owners and their ownership percentages, tax identification numbers for any owner(s) with 20 percent or more of equity, and the  location and amount of funds in escrow, if an escrow account is needed.3. In all other circumstances, both lender consent and SBA consent is required prior to transaction close.4. SBA approval requests (which will be reviewed in 60 calendar days) are submitted to the appropriate SBA Loan Servicing Center and include:a. The reason that the PPP borrower cannot fully satisfy the PPP Note or escrow funds.b. The details of the transactionc. A copy of the PPP noted. Any letter of intent and the purchase or sale agreement setting forth the responsibilities of the PPP borrower, seller (if different from the PPP borrower), and buyer.  If the agreement is for a sale of 50% or more of the borrower’s assets, the purchase or sale agreement must include appropriate language regarding the assumption of the PPP borrower’s obligations under the PPP loan by the purchasing person or entity, or a separate assumption agreement must be submitted to SBA.e. Disclosure of whether the buyer has an existing PPP loan and, if so, the SBA loan number; andf. A list of all owners of 20 percent or more of the purchasing entity.If any of the new owners or the successor arising from such a transaction has a separate PPP loan, the two loans must be segregated.<a rel="noopener noreferrer" target="_blank" href="https://www.sba.gov/sites/default/files/2020-10/5000-20057-508.pdf">https://www.sba.gov/sites/default/files/2020-10/5000-20057-508.pdf</a>

Tina is a partner in Morrison & Foerster’s Government Contracts practice. She represents a wide variety of government contractors including information technology, defense, biotechnology, and pharmace

Tina Reynolds

Anser Advisory

ARKA

Arlington Capital

Battle Investment Group

Behrman Capital

Cadmus

Chainalysis

CollabraLink

Definitive Logic

Emmes

Enlightenment Capital

Grant Thornton

Griffon Corporation

eTelligent

L3Harris

Jacobs

LinQuest Corporation

Micross

Sagewind

Sedgwick

Sigma Defense

teKnoluxion

The Building People

VariQ

specht_damien_blog_150x150.png

specht_damien_common_640x280.jpg

specht_damien_heroretina_2700x1160.jpg

specht_damien_mobileretina_750x1040.jpg

specht_damien_social_600x600.jpg

Damien is a partner in the firm’s Government Contracts & Public Procurement practice. He represents clients in all facets of government contracts transactions, as well as regulatory counseling, subcon

Damien Specht

Damien C. Specht

young_alissandra_blog_150x150.png

young_alissandra_common_640x280.jpg

young_alissandra_heroretina_2700x1160.jpg

young_alissandra_mobileretina_750x1040.jpg

young_alissandra_social_600x600.jpg

Associate

Ali Young is an associate in the Government Contracts practice in Morrison Foerster’s Washington, D.C. office.

Alissandra Young McCann

Ali Young is an associate in the Government Contracts practice in Morrison Foerster’s Washington, D.C. office.

Alissandra McCann

shutterstock_1043656987_small.jpg

SBA Issues Additional Guidance on PPP Loans and Change of Ownership

SBA Issues Final Rule on Appeals Process for PPP Loan Review Decisions

We have received questions from a number of clients about whether SBA’s consent is required for a change of control involving a Paycheck Protection Program borr

SBA Issues Additional Guidance on PPP Loans and Change of Ownership

Please join us for our annual MoForward event, which will be presented this year as a series of 10 live webinars starting Monday, October 5 and ending Friday, October 9. In order to register, <a rel="noopener noreferrer" target="_blank" href="https://www.veracast.com/webcasts/mofo/mcle_programs/library/index.cfm">click here</a> and then click on the program titles to register. Once you register for one, you will have access to the entire program.Continuing Legal Education Credits: We will be pursuing approximately 1 hour of CA, NY and VA MCLE credit per webinar.Our program this year, while presented virtually, will still offer practical, real-world insights into key developments and issues confronting businesses in today’s environment. MoForward is a collaboration between our deep government contracts bench and our colleagues who have led the government’s and industry’s most significant enforcement and response teams. The comprehensive agenda will cover topics that are at the forefront of the government contracting industry, including COVID-19 enforcement trends, the current bid protest landscape, CMMC, PPP and CARES Act compliance, and much more.We will hold two webinars per day for five days, grouped by similar theme. Register for one session for access to the entire series.<a rel="noopener noreferrer" target="_blank" href="https://www.veracast.com/webcasts/mofo/mcle_programs/library/index.cfm">REGISTER HERE</a>Day 1, Monday, October 5 Enforcement Trends<ul><li>1PM: False Claims 2020: Law in the Time of COVID-19 and Much More: <a href="https://protect-us.mimecast.com/s/1NQTC9rLGjHB2Wg9s3uiRs?domain=www2.mofo.com">Alex Ward</a> & <a href="https://protect-us.mimecast.com/s/3_F-C0RXEMi3mXDZUW487O?domain=www2.mofo.com">Rachael Plymale</a></li><li>2:30PM: The Antitrust Focus on Government Procurement: What It Really Means For Contractors: <a href="https://protect-us.mimecast.com/s/BZ4_CgJQ8yH2G1xpfEpF2V?domain=www2.mofo.com">Lisa Phelan</a> & <a href="https://protect-us.mimecast.com/s/XJJgCjRO5BiqR4MPCncmck?domain=www2.mofo.com">Rob Manoso</a></li></ul>Day 2, Tuesday, October 6 Government Contracts Transactions<ul><li>1PM: M&A and Supplier Bankruptcy: Significant Transactional Issues In The COVID-19 Era: <a href="https://protect-us.mimecast.com/s/GphbCkROBgiQ5y61tkHGpj?domain=www2.mofo.com">Damien Specht</a> & <a href="https://protect-us.mimecast.com/s/xVQsClYMX0hZXw5pHg3WA1?domain=www2.mofo.com">Mark Lightner</a></li><li>2:30: Small Business Issues & Their Effect on Large Contractors: Changes In Control, Size & Socioeconomics, and JVs: <a href="https://protect-us.mimecast.com/s/1lvbCmZM8kinWoKDf499rT?domain=www2.mofo.com">Caitlin Crujido</a> & <a href="https://protect-us.mimecast.com/s/rf36Cn5N7lHomZqjHP4cTi?domain=www2.mofo.com">Ali Young</a></li></ul>Day 3, Wednesday, October 7 Regulatory Compliance Issues<ul><li>1PM: Cybersecurity, CMMC, and FedRAMP: Keeping Up With Evolving Cyber Requirements: <a href="https://protect-us.mimecast.com/s/dwFSCo268mtzvVLZsEvDlS?domain=www2.mofo.com">Tina Reynolds</a>, <a href="https://protect-us.mimecast.com/s/ZiU3CpYXBnh8A0NKC3hj2z?domain=www2.mofo.com">Sandeep Nandivada</a> & Victoria Angle</li><li>2:30: Maintaining a Workplace In This New World: Regulatory and Practical Challenges: <a href="https://protect-us.mimecast.com/s/pU2yCqxM6of5XyPliWFp1t?domain=www2.mofo.com">Andrew Turnbull</a> & <a href="https://protect-us.mimecast.com/s/PIETCrkMBpUv2R0oh0n8TT?domain=www2.mofo.com">Lyle Hedgecock</a></li></ul>Day 4, Thursday, October 8 Government Contracts Litigation<ul><li>1PM: Bid Protests: The COFC vs The GAO: Developments & Trends: <a href="https://protect-us.mimecast.com/s/1dsoCv29Rwt6AnjKurbilU?domain=www2.mofo.com">Kevin Mullen</a> & <a href="https://protect-us.mimecast.com/s/jsjJCwpR2xS1yEz9fLT8_2?domain=www2.mofo.com">Jim Tucker</a></li><li>2:30: What the F*%#!?!: Five Steps to Take When the FCPA Hits the Fan: <a href="https://protect-us.mimecast.com/s/H8hmCxk78yUAx54wtB-0U9?domain=www2.mofo.com">Chuck Duross</a> & <a href="https://protect-us.mimecast.com/s/EFkRCyPJ7zfMLPzkU6EEcT?domain=www2.mofo.com">James Koukios</a></li></ul>Day 5, Friday, October 9 Upcoming Government Actions Affecting Business<ul><li>1PM: The U.S. Government Crackdown on Chinese Companies, Its Effects on Contractors and What’s Next: <a href="https://protect-us.mimecast.com/s/POg6CzpxQAS24Yp9fr5-4f?domain=www2.mofo.com">Charles Capito</a> & <a href="https://protect-us.mimecast.com/s/hRyyCAD9WrHWEK32i5tztZ?domain=www2.mofo.com">Joe Benkert</a></li><li>2:30: Data and IP Rights: The Pending DOD Changes To Your Rights: <a href="https://protect-us.mimecast.com/s/W7bSCBBROvi48X9BH0wfch?domain=www2.mofo.com" style="font-size: 1rem;">Jay DeVecchio</a> & <a href="https://protect-us.mimecast.com/s/S0fICDkJ6xUV3LK0fp751x?domain=www2.mofo.com" style="font-size: 1rem;">Locke Bell</a></li></ul>

10_05_mofoward_zoombackground.jpg

MoForward 2021 — Annual Government Contracts Program

MoForward 2021 — Annual Government Contracts Program

Please join us for our annual MoForward event, which will be presented this year as a series of 10 live webinars starting Monday, October 5 and ending Friday, O

On September 29, 2020, the Department of Defense (DoD) issued a long-anticipated <a rel="noopener noreferrer" target="_blank" href="https://www.govinfo.gov/content/pkg/FR-2020-09-29/pdf/2020-21123.pdf">interim rule</a> implementing its Cybersecurity Maturity Model Certification (CMMC) program.  The rule introduces a new mandatory construct, the DoD Assessment Methodology, to serve as an interim certification process before contractors undergo a full CMMC review.  A full description of the interim rule and what it means for DoD contractors follows.  The interim rule becomes effective November 30, 2020, although full implementation of CMMC will not be achieved until 2025.******The interim rule amends the Defense Federal Acquisition Regulation Supplement (DFARS) to achieve phased implementation of both the newly required assessment methodology and the CMMC framework.  The NIST SP 800-171 DoD Assessment Methodology, is a standard approach to assess contractor implementation of the cybersecurity requirements in the National Institutes of Standards and Technology (NIST) Special Publication (SP) 800-171.  The Cybersecurity Maturity Model Certificate (CMMC) Framework is a DoD certification process that measures a company’s further implementation of cybersecurity processes and practices beyond NIST SP 800-171.DoD Assessment MethodologyThe current DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is required in all DoD contracts except those solely for commercial off-the shelf (COTS) items. Under the -7012 clause, contractors must apply the cybersecurity requirements of NIST SP 800-171 to “covered contractor information systems,” which are generally those that store, process, generate, transmit or access DoD-related controlled unclassified information (CUI), which DoD terms “covered defense information.”  Presently, contractors and any of their subcontractors with access to “covered defense information” self-certify as to compliance with the clause through acceptance of the clause in contracts and subcontracts.The DoD Assessment Methodology requirement was developed to address perceived flaws in this self-assessment process.  The Methodology involves three levels – Basic, Medium, and High – which reflect the level of confidence DoD has in the assessment, and uses a scoring methodology that takes into account how many of the 110 NIST SP 800-171 controls a contractor has fully implemented.Basic assessments are to be performed by the contractor, using the specified DoD Assessment Methodology.  The results are reported to a Defense Information Systems Agency-run database, the <a rel="noopener noreferrer" target="_blank" href="https://www.sprs.csd.disa.mil/">Supplier Performance Risk System (SPRS)</a>.  Medium and High assessments will be performed by various DoD components (including the Defense Contract Management Agency) under specific circumstances. These DoD components will also report results of the Medium and High reviews to SPRS.The SPRS database will be accessible throughout DoD.  Beginning November 30, 2020, contracting officers will be required to check the database to confirm that an entity that is required to implement NIST SP 800-171 has an active SPRS Assessment prior to the award of a new contract or exercise of an option under an existing contract.  SPRS Assessments are good for three years, and must be renewed prior to expiration in order for DoD contractors to maintain eligibility for contract awards.  Assessments must be completed for each contractor IT system used in connection with a DoD contract.The new contract clauses DFARS 252.204-7019, Notice of NIST SP 800-171 DoD Assessment Requirements, and 252.204-7020, NIST SP 800-171 DoD Assessment Requirements, describe the assessment process, and the latter clause requires contractors to provide the government access to its facilities, systems, and personnel when higher-level reviews are required.  Both clauses are to be included in all solicitations and contracts after November 30, 2020, including those for commercial items, unless solely COTS products are involved.The DFARS 252.204-7019 clause walks contractors through the logistics for performing and reporting a Basic DoD Assessment.  As part of the process, each contractor must supply the following information with respect to each system being assessed:  system security plan name, CAGE code, brief description of plan architecture, date of assessment, total score, and date that a score of 110 will be achieved.  Contractors that have fully implemented all 110 NIST SP 800-171 security requirements will be able to report the highest possible score of 110.  Others will merit a lower score depending how many and which requirements are unimplemented.  DoD has indicated that it is requesting this detail so that contractors can no longer leave security controls unaddressed indefinitely.  Now contractors and subcontractors that store, process, generate, transmit or access covered defense information must establish enforceable timelines to address any compliance gaps.DoD will select contractors for Medium and High review post-award, based on the critical nature of the program involved or particular sensitivity of information being handled by the contractor.  The interim rule states that DoD expects to assess 200 entities a year at the Medium level of review and 110 at the High level.With the SPRS information, DoD components will have visibility into contractors’ current levels of compliance without having to undertake contract- or program-specific reviews.  There will also be a single source for information, which will eliminate duplicative, and possibly conflicting, assessments by different DoD components.DFARS 252.204-7019 does not contain a flowdown provision, but the substance of DFARS 252.204-7020 must be flowed down to all subcontractors (except COTS suppliers).  The clause further directs that prime contractors are required to ensure that applicable subcontractors (i.e., those that must meet NIST SP 800-171 requirements) have a current DoD Assessment posted in SPRS.CMMC ImplementationWith the interim rule, DoD is phasing in the rollout of CMMC.  All contracts over the micropurchase threshold (except for COTS) will require CMMC certification beginning September 30, 2025.  Until then, the DoD, specifically, the Office of the Under Secretary of Defense for Acquisition and Sustainment, will decide which solicitations will include the CMMC requirement and the new associated DFARS clause at 252.204-7021, Cybersecurity Maturity Model Certification Requirements.CMMC assessments will be conducted by designated and specially trained CMMC Third Party Assessment Organizations (C3PAOs).  Once the C3PAO has completed an assessment, the contractor is awarded a certification at the appropriate certification level by the CMMC Accreditation Body (AB).  These certifications will be included in the same SPRS database as the DoD Assessment Methodology reviews.  Also as with the DoD Assessment reviews, CMMC certifications will be good for three years.  Once CMMC is in effect, contracting officers cannot make contract awards, or exercise an option on a contract, if the offeror or contractor does not have a current certification at the CMMC level required under the applicable solicitation or contract.The various CMMC levels build upon one another.  Level 1, the most basic level, is the equivalent of the current FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.  Level 2 has more requirements, but is not as robust as Level 3, which includes all 110 NIST SP 800-171 requirements, plus an additional 20 CMMC practices and three CMMC processes.  Levels 4 and 5 represent a significant increase in complexity, with far more practices and processes, which are designed to reduce the risk of Advanced Persistent Threats or attacks by adversaries using multiple, sophisticated techniques.  The requirements for each level are described in the CMMC model.CMMC review can pertain to a contractor’s entire enterprise network or the contractor can elect to have particular network segments or enclaves that will store, process, generate or transmit contract-related information to be evaluated separately (and potentially each at different levels).Where it appears in current contracts, and in all cases after October 1, 2025, the DFARS 252.204-7021 clause is a mandatory flowdown to subcontractors at all tiers.  The level of CMMC certification that will apply to any given subcontractor, however, will be based on the sensitivity of the information provided to that subcontractor.  The interim rule does not specify whether the government or the contractor will make this determination, but implies that this will be the contractor’s responsibility.Open Questions and Other Interesting Aspects of the Interim RuleSubject to the caveat that the final rule may alter the new clause requirements, our preliminary review of the interim rule leads to a few observations:<ul><li>Although this rule has been years in the making, DoD issued it as an interim rule, rather than in draft form, because it made a determination that urgent and compelling circumstances so required. Although DoD has solicited comments, contractors should not expect the final rule to vary significantly from the current interim posture.  Minor clarifications are far more likely than any major policy shift.</li><li>Beginning November 30, 2020, contracting officers will need to confirm that an entity has an active SPRS Assessment in order to award a new contract or exercise an option under an existing contract where the offeror or contractor is required to implement NIST SP 800-171. Previously, contracting officers have not had to determine whether or not contracts require implementation of NIST SP 800-171, because the -7012 clause was simply inserted into every contract.  How are contracting officers going to make this determination?  In some instances, where extensive covered defense information is involved in contract performance, this may be obvious.  Less obvious, however, may be where the contractor performs its work, and whether covered defense information actually passes through the contractor’s systems.</li><li>The purpose of the DoD Assessment rating number and level is unclear. As drafted, the interim rule and new regulations only require contracting officers to make sure that an offeror has a current DoD Assessment prior to making award.  Yet what happens if the Assessment score is very low?  Can this be a basis for rejection of an offer?  Can a contracting officer assign more risk and therefore give less evaluation credit to a company with a Basic score below 110?  Or can the contracting officer rate more highly a company with a Medium or High posture even though companies cannot control whether they will be subjected to Medium or High Assessments?  Review will be done post-award in the first instance, but results will be in SPRS thereafter for use with other programs.</li><li>Because the DoD Assessment Methodology applies not only to new awards but also to the exercise of options, will existing contracts be modified to include DFARS 252.204-7019 and 252.204-7020, or will the clauses only appear in solicitations, and resultant contracts, after the November 30, 2020 effective date for the rule?</li><li>DoD indicates in the interim rule that it expects 129,810 unique entities will receive a CMMC assessment in the next five years, until CMMC is required for all contractors and subcontractors. This is a highly specific number; it would be informative to the contracting community to know how this estimate was derived so that companies can estimate the timing of their CMMC reviews.</li><li>DoD states that CMMC will conduct an onsite assessment for every level of review, including Level 1. The possibility of a virtual review for Level 1 assessments had been discussed, but ultimately DoD has concluded that an onsite assessment would be useful to verify implementation of security practices and also to officially identify contractors and subcontractors in the DoD supply chain.  It is not clear how this onsite review will work for contractors and subcontractors outside the U.S.; presumably, C3PAOs will be available worldwide.</li><li>DoD states that it considered requiring CMMC certification prior to submission of an offer, or after contract award, but ultimately settled on the interim position that an offeror must be certified to the requisite CMMC level at the time of contract award. DoD has invited comment on its decision, perhaps suggesting that it is not wed to this position.</li><li>At one point, DoD had taken the position that CMMC certification requirements would apply to all DoD contracts, including those involving COTS items. This interim rule indicates that the agency has been persuaded that application to COTS contractors is unnecessary and unduly burdensome.</li><li>DoD has stated that it does not intend to issue any contracts that require CMMC Level 2 certification, leaving Level 2 as merely a meaningless way station between Levels 1 and 3. So seemingly the only contractors that will be certified at Level 2 will be those that fail to meet the Level 3 requirements.</li><li>Speaking of CMMC levels, prime contractors are apparently supposed to select the appropriate level for their subcontractors (which may differ from the prime contract level), yet the interim rule and applicable DFARS clauses provide no guidance as to how this is to be accomplished.</li><li>Likewise, primes must verify that their subcontractors have DoD Assessments and, later, CMMC certifications, yet primes will not have access to the SPRS database, except to review their own submissions. Prime contractors will need to create certification requirements for their subcontractors, and/or ask for copies of subcontractors’ SPRS entries in order to meet this verification requirement.</li><li>Despite the lack of public access, the security of the information in the SPRS database is unclear. DFARS 252.204-7019(d)(3)(iii) states that documentation related to a High Assessment will be considered CUI and protected against unauthorized release, with specific reference to FOIA Exemption 4 for confidential and trade secret information.  However, information pertaining to other assessment levels need only be protected in accordance with a DoD Instruction on sharing supplier information.  DFARS 252.204-7019(d)(3)(i); DFARS 252.204-7020(f)(1).  DoD does not state it will treat this information as CUI.</li></ul>What do you contractors and subcontractors need to do now?As with any major regulatory change, contractors need some clear and immediate direction in terms of next steps and timing.  We therefore would offer, in roughly descending order of priority, the following recommendations:<ul><li>Familiarize yourself with the DoD Assessment and prepare to perform a Basic self-assessment. At least based on the language of the interim rule, assessment results must be reported to SPRS in order for your company to receive an award after November 30, 2020.</li><li>If you are not required to implement NIST SP 800-171 security controls because your company does not store, process, generate, transmit or access covered defense information on its systems, be prepared to document why you do not need to conduct a DoD Assessment.</li><li>Plans of Action and Milestones are now risky, as they will lower your Basic DoD Assessment Score and will not be permissible at all under CMMC. Where possible, cybersecurity compliance gaps should be addressed and resolved in the next 60 days.</li><li>Speak with the program and contracting leadership for upcoming procurements (consistent with Procurement Integrity rules, of course) to get a sense of whether the opportunities may include CMMC requirements.</li><li>Continue to prepare for CMMC certification at the level appropriate for your work and systems, with the understanding that for some contractors, the certification process may be several years away.</li></ul>

12_30_cybersecurity_07.jpg

Department of Defense Issues CMMC Interim Rule, Setting up a Two-Part Process for Review of Contractor IT Systems

DOJ Cyber-Fraud Initiative Highlights Potential Civil Liability for Failing to Meet Federal Cybersecurity Requirements

On September 29, 2020, the Department of Defense (DoD) issued a long-anticipated interim rule implementing its Cybersecurity Maturity Model Certification (CMMC)

Department of Defense Issues CMMC Interim Rule, Setting up a Two-Part Process  for Review of Contractor IT Systems

On September 22, 2020, President Trump signed an Executive Order on Combatting Race and Sex Stereotyping (the “EO”), prohibiting federal contractors and certain federal grant recipients from holding diversity and EEO training for their workforce that includes “divisive concepts,” such as training employees that the U.S. or an individual is “inherently racist, sexist, or oppressive, whether consciously or unconsciously.”  The EO follows a September 4, 2020 White House memorandum criticizing federal agencies for having “divisive, un-American” training sessions on “white privilege” and “critical race theory” and demanding that they end racial sensitivity trainings.  The EO also comes at a time when many contractors have been increasing their diversity and anti-bias trainings in response to racial and social justice issues brought to the forefront over the last several months.While the precise parameters of the types of training prohibited by the EO are not clear, contractors should review their diversity and anti-bias training initiatives in light of these new requirements.  If implemented, the EO requirements will be included in federal prime contracts entered on or after November 21, 2020, and will require prime contractors to flow the requirements down their subcontractors and vendors.CoverageThe EO applies to all government contracts, except for contractors qualifying for certain limited exemptions under Section 204 of Executive Order 11246, which are the same exemptions that apply to federal contractors’ Equal Employment Opportunity requirements.  There are no limits in the EO for commercial or commercial-off-the-shelf item contracts.  The EO also appears to apply to trainings for all employees of covered contractors, regardless of whether those employees support a federal contract.RequirementsThe EO includes a new contractual provision that must be included in covered contracts entered after November 21, 2020.  The provision requires contractors to prohibit “any workplace training that inculcates in its employees any form of race or sex stereotyping or any form of race or sex scapegoating, including the concepts that:<ul><li>one race or sex is inherently superior to another race or sex;</li><li>an individual, by virtue of his or her race or sex, is inherently racist, sexist, or oppressive, whether consciously or unconsciously;</li><li>an individual should be discriminated against or receive adverse treatment solely or partly because of his or her race or sex;</li><li>members of one race or sex cannot and should not attempt to treat others without respect to race or sex;</li><li>an individual’s moral character is necessarily determined by his or her race or sex;</li><li>an individual, by virtue of his or her race or sex, bears responsibility for actions committed in the past by other members of the same race or sex;</li><li>any individual should feel discomfort, guilt, anguish, or any other form of psychological distress on account of his or her race or sex; or</li><li>meritocracy or traits such as a hard work ethic are racist or sexist, or were created by a particular race to oppress another race.”</li></ul>The EO defines “race or sex stereotyping” broadly to mean “ascribing character traits, values, moral and ethical codes, privileges, status, or beliefs to a race or sex, or to an individual because of his race or sex.”  The term “race or sex scapegoating” is defined in the EO as “assigning fault, blame, or bias to race or sex, or to members of a race or sex because of their race or sex.”Contractors will also be required to send each labor union or representative of its employees a notice, provided by the applicable agency’s contracting officer, advising the labor union or representative of the contractor’s obligations under the EO.  Copies of those notices must be posted for employees and applicants of covered contractors.  The EO also requires contractors to flow these obligations down to their covered subcontractors and vendors, unless they are exempted under the rules, regulations, or orders of the Secretary of Labor.Enforcement and RemediesOFCCP will play a significant role in enforcing the EO requirements on federal contractors.  OFCCP is required by the EO to establish a hotline to investigate complaints about contractors using training practices prohibited by the EO.  It also requires OFCCP to publish on or before October 22, 2020, a request for information from federal prime and subcontractors as well as their employees regarding training, workshops, or similar programming provided to employees.The U.S. Attorney General is also tasked with determining if training banned by the EO may contribute to a hostile work environment and give rise to claims under Title VII of the Civil Rights Act.  The EO instructs the U.S. Attorney General and EEOC to issue guidance, if appropriate, to assist employers “in better promoting diversity and inclusive workplaces consistent with Title VII.”Contractors that violate the EO can face harsh consequences, including termination, suspension, or debarment from federal contracting.Effective DateBy its own terms, the EO is effective immediately, but the requirements applicable to federal contractors will only be included in contracts awarded after November 21, 2020.  The EO does not specifically require that regulations be issued to implement the EO.ImplicationsWhile the EO states it does not prevent contractors “from promoting racial, cultural, or ethnic diversity or inclusiveness,” contractors should review their diversity and anti-bias training programs for areas that could be considered “divisive concepts” under the EO.  Many contractors use some form of unconscious bias training in their programs and have recently increased their diversity and anti-bias training efforts in wake of the racial and social justice issues over the last several months.  While the precise bounds of the EO training requirements, especially in relation to existing federal and state EEO training requirements, are not clear, it is very possible contractor diversity and anti-bias trainings stray into areas that could be characterized as suggesting an individual is unconsciously racist or sexist or making an employee feel discomfort or guilt by association on account of his or her race or gender.Given the politicized posture of the EO, contractors may face investigations of their diversity and anti-bias training as some employees may be more inclined to lodge complaints with the OFCCP, even if the contractor’s training complies with the EO.  While OFCCP will be required to enforce the EO, bureaucratic inertia may slow some enforcement efforts, as OFCCP staff generally favor promoting diversity and anti-bias training, not curtailing them.The EO will almost certainly be challenged by various political or interest groups on statutory and constitutional grounds.  Whether those challenges will be successful remains to be seen.  Regardless, the upcoming election could determine the fate of the EO.  If Trump is reelected, the Trump administration will push forward with implementation of the EO and fight any legal challenges.  If former Vice President Joe Biden is elected, however, the EO will likely be rescinded at some point, even if implemented briefly by a lame duck Trump administration.

turnbull_andrew_blog_150x150.png

turnbull_andrew_common_640x280.jpg

turnbull_andrew_heroretina_2700x1160.jpg

turnbull_andrew_mobileretina_750x1040.jpg

turnbull_andrew_social_600x600.jpg

Co-Chair, Global Employment and Labor Practice

Andrew co-chairs the firm’s Global Employment and Labor Group. He represents companies on a broad range of labor and employment litigation and counseling matters, successfully defending clients in number complex matters before federal and state courts and administrative agencies.

Andrew R. Turnbull

Andrew Turnbull represents companies on a broad range of labor and employment litigation and counseling matters. He has successfully defended clients in complex employment litigation before federal and state courts and administrative agencies. A primary focus of his practice involves helping companies navigate the unique employment issues that arise when doing business with the federal government, including advising on all aspects of OFCCP compliance, creating and implementing affirmative action plans, defending OFCCP audits and onsite investigations, conducting mock pay equity audits, drafting and developing business ethics policies and programs, and complying with the Service Contract Act, E-Verify, and the Drug Free Workplace Act.

Andrew Turnbull

bell_locke_blog_150x150.png

bell_locke_common_640x280.jpg

bell_locke_heroretina_2700x1160.jpg

bell_locke_mobileretina_750x1040.jpg

Locke Bell

President Trump Issues Executive Order Banning Federal Contractors from Race and Sex Stereotyping Training