Morrison Foerster’s Government Contracts Insights provides our in-depth analysis of developments and trends impacting government contracting. Through Insights, our attorneys offer a real-time assessment of the statutory, regulatory, legal, and business-related developments and trends that are shaping the industry. We also examine a full array of non-U.S. public procurement issues, mindful that our clients compete in a global marketplace.Morrison Foerster’s nationally recognized Government Contracts and Public Procurement practice represents the world’s leading companies in the aerospace and defense, intelligence, cybersecurity, information technology, financial and professional services, education, healthcare, infrastructure, and logistics support sectors. We are enlisted to address our clients’ most complex and important legal issues. Our work includes contract and subcontract negotiation and other transactional matters, business and regulatory compliance counseling, internal investigations, bid protests, and a wide array of enforcement and litigation matters. Our clients range from Fortune 50 companies to small and medium-sized companies just entering the public sector. We advise both U.S. and non-U.S. companies involved in municipal, state, federal, and non-U.S. procurement matters.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

GAO Protest Timeline

govcon-gao-protest-timeline-thumb.jpg

Govcon GAO Post Award Protest Timeline Article

Contract Disputes Act Claim Timeline

govcon-contract-disputes-timeline-thumb.jpg

The Bayh-Dole Act

govcon-bayhdole-thumb.jpg

Anatomy of a Protest

govcon-federalclaimsprotest-thumb.jpg

Allowability of Legal Costs

govcon-allowabilityoflegalcosts-thumb.jpg

Procurement Integrity Act

240715-procurement-integrity-act-resized.jpg

Govcon-Resources

Tina is Co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She represents a wide variety of government contractors including information technology, defense, biotechnology, and pharmaceutical companies, with a focus on general contract counseling and compliance, particularly concerning intellectual property, and cybersecurity matters and federal grant funding.Tina counsels contractors on compliance with federal, state and local acquisition and ethics regulations and with the evolving myriad of requirements pertaining to data security and cybersecurity. She has been involved with numerous internal investigations and compliance reviews, and with mandatory and voluntary disclosures to agencies, and litigation of False Claims Act matters.Tina routinely advises clients concerning:<ul><li>Prime-subcontractor relationships</li><li>Sources of supply and country of origin requirements</li><li>Price reductions and price reporting issues</li><li>Organizational conflicts of interest</li><li>Safeguarding of intellectual property and other proprietary interests</li><li>Licensing and data rights issues</li><li>Handling of classified materials and controlled unclassified information</li><li>Agency suspension and debarment proceedings</li></ul>She also assists clients with due diligence and other activities related to the acquisition of government contracting concerns, and with the drafting and negotiation of teaming agreements, subcontracts, licensing agreements, and cooperative research and development agreements. She also assists clients applying for federal grants (including SBIR and STTR agreements), and those who seek to obtain other transactional authority agreements, as well as those competing for state and local government work.Tina’s litigation experience includes government contracts claims litigation in federal courts and before boards of contract appeals, bid protests before the Government Accountability Office and the Court of Federal Claims, and complex disputes in federal courts, including civil fraud and False Claims Act litigation and reverse Freedom of Information Act litigation.Prior to joining Morrison Foerster, Tina worked at another large national firm and as a trial attorney in the Office of the General Counsel of the Navy, Navy Litigation Office.<h4>Representative Experience</h4><ul><li>Negotiation of largest CHIPS Act federal funding agreement between multinational semiconductor corporation and U.S. Department of Commerce.</li><li>Negotiated prime contract and major subcontracts related to the Department of Energy’s next generation supercomputer program, including extensive IP rights negotiations and negotiation of associated patent rights waivers.</li><li>Negotiated series of other transaction authority agreements with DARPA and associated subcontracts with more than a dozen research universities on behalf of a firm biotech client, including complex IP rights allocations and material transfer agreements.</li><li>Assist clients with FedRAMP authorization process and with development of license agreements for software products sold to federal, state and local government agencies.</li><li>Cyber incident response counseling to some of the largest companies and organizations impacted by security incidents.</li><li>Advises clients on Bayh-Dole reporting of inventions and IP strategies for contracts and grants.</li><li>Conducts due diligence for major government contract mergers and acquisitions.</li></ul>

reynolds_tina_blog_150x150.png

reynolds_tina_common_640x280.jpg

reynolds_tina_heroretina_2700x1160.jpg

reynolds_tina_mobileretina_750x1040.jpg

reynolds_tina_social_600x600.jpg

Partner

Our government contracts and procurement attorneys counsel businesses on legal and compliance issues encountered when doing business with government entities.

Government Contracts + Public Procurement

Government Contracts and Procurement Attorneys

Band 1: National: Government Contracts

Tier 1: Government Contracts

Readers Choice Award: Government Contracting

Tina is co-chair of Morrison Foerster’s Government Contracts & Public Procurement practice. She counsels a wide variety of government contractors on compliance with federal acquisition and ethics regulations. She drafts and negotiates contracts on their behalf and has been involved with numerous internal investigations and compliance reviews, and with bid protest, contract claims, and False Claims Act litigation. She also advises on M&A transactions involving government contractors.

Tina D. Reynolds

Jim Tucker is of counsel in Morrison Foerster’s Government Contracts and Public Procurement Practice Group and is based in the firm’s Washington, D.C. office.Jim’s practice runs the gamut of litigation and counseling in federal procurement matters, with an emphasis on bid protests, Cost Accounting Standards disputes, and small business matters. He has represented both protesters and awardees in scores of protests before the Government Accountability Office, the Court of Federal Claims, and procuring agencies, in acquisitions ranging from small business procurements to multibillion-dollar contracts of global significance. His representative protest matters span the aerospace sector, the Intelligence Community, base operations and logistics, healthcare, nuclear and environmental work, and information technology and software acquisitions. His protests have included both classified and unclassified programs. In addition to prevailing in published decisions, Jim has also secured favorable corrective action on behalf of clients in a wide variety of protests that were resolved without a published decision.Jim’s work also focuses on disputes over cost allowability and compliance with the Cost Accounting Standards, and he has appeared before the Armed Services and Civilian Boards of Contract Appeals, in size and status protests before Small Business Administration (SBA) area offices, and appeals before the SBA Office of Hearings and Appeals. Jim regularly counsels clients on contract interpretation, organizational conflicts of interest, and small business compliance.Jim graduated with high honors from the George Washington University Law School, where he focused his studies on federal procurement law, was a member of the Law Review, and interned with the General Services Administration’s suspension and debarment office. Jim also holds a degree in theology magna cum laude from the Pontifical Gregorian University in Rome and a bachelor’s degree in classical languages and literature summa cum laude from the University of Kentucky, where he graduated Phi Beta Kappa.

tucker_james_blog_150x150.png

tucker_james_common_640x280.jpg

tucker_james_heroretina_2700x1160.jpg

tucker_james_mobileretina_750x1040.jpg

tucker_james_social_600x600.jpg

Of Counsel

Jim maintains an active practice in bid protests before the Government Accountability Office and contracting agencies and counsels clients in contract disputes and compliance obligations.

Jim Tucker is of counsel in Morrison Foerster’s Government Contracts and Public Procurement Practice Group and is based in the firm’s Washington, D.C. office. Jim’s practice runs the gamut of litigation and counseling in federal procurement matters, with an emphasis on bid protests, Cost Accounting Standards disputes, and small business matters.

James Tucker

<div style="margin-bottom: 15px;" class="videoWrapper"><iframe class="sticky-video" title="Meet Alex Ward, Government Contracts Practice Co-Chair" src="https://www.youtube-nocookie.com/embed/TkliwdSlTaQ?rel=0" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen="1" title="iframe"></iframe></div>J. Alex Ward is co-chair of Morrison Foerster’s Government Contracts and Public Procurement group. His practice covers a full range of government contracts matters, including investigations, bid protests, claims, general litigation, corporate transactions, and counseling. Alex strives in all matters is to provide his clients the highest level of efficient and effective representation.Alex represents contractors in internal and external investigations, disclosures to the government, and qui tam litigation, with great success in reducing or eliminating his clients’ exposure through active engagement with the government. His work in this area includes obtaining numerous declinations and dismissals of False Claims Act cases in their earliest stages, sparing his clients the cost, risk, and exposure of litigation.He has also served as lead counsel in dozens of bid protests involving military and civilian agency procurements of a wide range of products and services, including all manner of pre- and post-award protests in the GAO, the U.S. Court of Federal Claims, and state tribunals, as well as appeals to the U.S. Court of Appeals for the Federal Circuit and size protest appeals before the SBA’s Office of Hearings and Appeals.Alex handles all aspects of the claims process, from the initial assessment and drafting of requests for equitable adjustment through litigation in the Boards of Contract Appeals and the Court of Federal Claims. Alex’s practice also covers the full gamut of other controversies confronting government contractors, including prime-sub, teaming partner, employer-employee, competitor, and indemnification disputes. His litigation work also includes a wide variety of pro bono engagements, in which he has represented both individual and institutional clients in matters ranging from immigration and criminal defense to sustainable procurement and protection of the environment.Prior to joining the firm, Alex served in the U.S. Army as a commissioned officer and an Assistant to the General Counsel of the Army responsible for civil works and international matters, and as a clerk for judges on the U.S. Courts of Appeals for the Armed Forces and the D.C. Circuit. He is a member of the Boards of the Morrison & Foerster Foundation and the Chesapeake Bay Foundation and of Law360’s Government Contracts Editorial Board.

ward_alex_blog_150x150.png

ward_alex_common_640x280.jpg

ward_alex_heroretina_2700x1160.jpg

ward_alex_mobileretina_750x1040.jpg

ward_alex_social_600x600.jpg

Alex is co-chair of Morrison Foerster’s Government Contracts and Public Procurement practice. His practice covers a full range of government contracts matters, including bid protests, claims, investigations, corporate transactions, and counseling.

J. Alex Ward

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Government Contracts Insights blog provides an in-depth analysis of news, developments, and trends impacting government contracting and procurement. Through Insights, attorneys from our nationally recognized Government Contracts and Public Procurement practice will offer a real-time assessment of the statutory, regulatory, legal, and business-related developments that are shaping the industry. This blog will also examine a full array of U.S. and non-U.S. public procurement issues, mindful that our clients compete in a global marketplace.Read about our <a href="http://govcon.mofo.com/editors/">Authors</a>.Never miss a post. Subscribe to get real-time updates.

gov-con-feature-image-thumb1.jpg

Welcome to the Government Contracts Insights Blog

Welcome to the Government Contracts Insights Blog

gov-con-feature-image_(1)1.jpg

The United States Capitol building

Morrison Foerster’s Government Contracts Insights blog provides an in-depth analysis of news, developments, and trends impacting government contracting and proc

Announcements & Press

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Provides insights and reports on the most current class actions lawsuits and product liability issues that affect consumer-facing companies.

Class Dismissed Blog

Class Dismissed

Looks behind the headlines to explore the trends, identify the opportunities, analyze the issues, and provide guidance for science and technology-based companies.

MoFo Tech

Mofo Tech

News and thought leadership from lawyers who are adding value to the legal profession and the communities we call home.

  External-Link

MoFo + Blog

Mofo+

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

Our Government Contracts Insights blog provides in-depth analysis of developments and trends impacting U.S. government contracting and non-U.S. public procureme

Government Contracts Insights

  Linkedin

MoFo LinkedIN

Blog - Govcon RSS

Stay Connected

Never miss a post from Government Contracts Insights. Enter your email below to stay up-to-date.

Subscribe

The latest updates and analysis from Morrison Foerster

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

Acquisition Regulations

Artificial Intelligence + Robotics

Compliance

Coronavirus

Cybersecurity & Data Privacy

Data Rights

Defense

Domestic Preferences

False Claims Act

Federal Procurement

Foreign Corrupt Practices Act

Grants

Health Care

Intellectual Property

International Public Procurement

Labor & Employment

Mergers & Acquisitions

National Security

Protests & Litigation

Resources

Schedule Contracting

Small Business

Topics

Blog - Editors

Editors

Blog - About

About

Blog - Subscribe

More

James A. Tucker

Telesto: Another Call For Clarity In Other Transactions Protest Jurisdiction

Strengthening the American Drone Industrial Base

Bid Protest Spotlight: Jurisdiction, Price Range, Late-Is-Late

Trump Issues Executive Order on Cybersecurity Rolling Back Some Prior Policies and Introducing New Ones

GAO Reaffirms Agencies’ Discretion to Award Sole-Source SBIR Phase III Contracts (Even to a Successor-in-Interest)

LinkedIN

Amidst the ongoing flurry of executive actions targeting Diversity, Equity, and Inclusion (“DEI”) programs and policies, causing confusion and disruption across the federal government and private sectors, companies are struggling to understand the impact of those actions on their organizations. To help companies understand and navigate these actions, we have provided answers to frequently asked questions and proactive steps to mitigate risks.Read the <a href="https://www.mofo.com/resources/insights/250219-unpacking-the-trump-administration-s-dei-orders" target="_self">full client alert</a>.

turnbull_andrew_blog_150x150.png

turnbull_andrew_common_640x280.jpg

turnbull_andrew_heroretina_2700x1160.jpg

turnbull_andrew_mobileretina_750x1040.jpg

turnbull_andrew_social_600x600.jpg

Co-Chair, Global Employment and Labor Practice

Andrew co-chairs the firm’s Global Employment and Labor Group. He represents companies on a broad range of labor and employment litigation and counseling matters, successfully defending clients in number complex matters before federal and state courts and administrative agencies.

Andrew R. Turnbull

Andrew Turnbull represents companies on a broad range of labor and employment litigation and counseling matters. He has successfully defended clients in complex employment litigation before federal and state courts and administrative agencies. A primary focus of his practice involves helping companies navigate the unique employment issues that arise when doing business with the federal government, including advising on all aspects of OFCCP compliance, creating and implementing affirmative action plans, defending OFCCP audits and onsite investigations, conducting mock pay equity audits, drafting and developing business ethics policies and programs, and complying with the Service Contract Act, E-Verify, and the Drug Free Workplace Act.

Andrew Turnbull

nandivada_sandeep_blog_150x150.png

nandivada_sandeep_common_640x280.jpg

nandivada_sandeep_heroretina_2700x1160.jpg

nandivada_sandeep_mobileretina_750x1040.jpg

nandivada_sandeep_social_600x600.jpg

Sandeep Nandivada is a partner in the Litigation Department of Morrison Foerster’s Washington, D.C. office.

Sandeep N. Nandivada

Sandeep Nandivada

shutterstock_1043656987_small.jpg

SBA Issues Final Rule on Appeals Process for PPP Loan Review Decisions

Unpacking the Trump Administration’s DEI Orders and Actions – FAQs and Action Plans

The Federal Acquisition Regulation (FAR) Council issued its long awaited <a href="https://www.federalregister.gov/documents/2025/01/15/2024-30437/federal-acquisition-regulation-controlled-unclassified-information" target="_blank">proposed rule</a> on Controlled Unclassified Information (CUI) on January 15, 2025. The proposed rule establishes a common form to be used by all federal agencies at the contract formation stage to identify contract‑related CUI, prescribes requirements for contractor protection of CUI, and creates a formal reporting process for security incidents involving CUI. Below, we examine these and several other noteworthy aspects of the proposed rule and their implications for contractors.Historical ContextAs defined in the proposed FAR rule, CUI is “information that the Government creates or possesses, or that an entity creates or possess for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls.” This is consistent with the statutory definition of CUI established by the National Archives and Records Administration (NARA), which defines CUI as “[a]ll unclassified information throughout the executive branch that requires any safeguarding or dissemination control.” 32 C.F.R. § 2002.The federal government has long recognized the need to protect sensitive but unclassified information. In 2010, President Obama issued <a href="https://obamawhitehouse.archives.gov/the-press-office/2010/11/04/executive-order-13556-controlled-unclassified-information" target="_blank">Executive Order 13556</a>, establishing the CUI Program and designating NARA as its executive agent. In September 2016, NARA published a <a href="https://www.federalregister.gov/documents/2016/09/14/2016-21665/controlled-unclassified-information" target="_blank">final rule</a> codifying uniform policies for marking, safeguarding, disseminating, and disposing CUI. The FAR Council then opened FAR Case 2017-016 to develop parallel acquisition regulations and contractor clauses. It has taken until now, however, to issue the proposed regulations. In the interim, the Department of Defense (DoD) established its own CUI protection requirements in the form of <a href="https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting." target="_blank">DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting</a>. Other agencies have also issued CUI regulations or created special clauses for use in select contracts. This inconsistent and uneven approach to CUI handling has created confusion and compliance uncertainty among the contractor community, which must protect sensitive information from potential security vulnerabilities. The proposed regulation seeks to remedy this situation by standardizing the federal government’s approach to CUI.The Proposed Rule’s Framework for Identifying and Handling CUIThe proposed rule applies broadly to nearly all federal contracts, including those for commercial products and services, except those solely for the sale of commercial off-the-shelf products. We have classified these major changes into the following categories: (1) identifying requirements (in the standard form); (2) safeguarding requirements; (3) incident reporting; and (4) additional notable provisions and next steps.Identification of Requirements: Understanding Standard Form XXXAt the heart of the proposed rule is Standard Form XXX (SF XXX), which will inform contractors of their CUI protection obligations from the outset of the procurement process. The form will be included in all solicitations and contracts that may involve CUI, and contractors must prepare their own SF XXX, tailored from the prime contract version, when flowing down CUI requirements to applicable subcontractors.Each SF XXX will identify what information under the contract is considered CUI and establish any contract-specific compliance requirements. For each contract, the form will specify all required privacy measures, security controls, and agency-specific security measures—dependent on whether federal or non-federal information systems will process the CUI. The form will also identify who can access CUI and under what conditions, personnel training requirements, and incident reporting procedures.Notably, even if there is no CUI identified, new FAR clause 52.204-YY, Identifying and Reporting Information That Is Potentially Controlled Unclassified Information, must be incorporated into solicitations and contracts. The clause applies when the SF XXX indicates that no CUI will be involved in contract performance. The clause requires contractors to notify the relevant contracting officer within 8 hours if potential CUI is discovered but that CUI is not listed on an SF XXX or not properly marked.In addition, the proposed rule places an obligation on contractors to mark as CUI proposal information, proprietary business information, and certain other types of information in proposal submissions and other CUI that it creates in performance of the contract.Safeguarding RequirementsThe proposed rule establishes comprehensive requirements for safeguarding CUI, introducing new obligations for contractors of civilian agencies that are similar to, but not the same as, the existing DoD requirements under DFARS clause 252.204-7012.<a href="#_ftn1" target="_self">[1] </a>Applicable safeguarding requirements vary based on whether contractors handle CUI on federal or contractor systems, the type of CUI involved, and whether the contract involves critical programs.For CUI on federal information systems, contractors must implement NIST SP 800-53 security controls and meet any additional CUI requirements listed in SF XXX. If cloud services are used, they must, at minimum, comply with FedRAMP Moderate baseline standards.For CUI on non-federal information (i.e., contractor or subcontractor) systems, contractors must implement NIST SP 800-171 Revision 2 security controls and follow any additional requirements specified in Form SF XXX for higher security levels.<a href="#_ftn2" target="_self">[2]</a> To demonstrate compliance, contractors must maintain system security plans documenting their implementation of NIST SP 800-171 controls and submit these plans to their government customers upon request. Contractors can only use cloud-based products and services for performance of contracts involving CUI that meet FedRAMP Moderate baseline standards. They must also allow government validation of security measures, according to NIST SP 800-171A standards. For certain critical programs, contractors may need to implement enhanced security requirements from NIST SP 800-172.<a href="#_ftn3" target="_self">[3]</a>As noted above, additional safeguarding and handling requirements beyond these baseline standards may be required and reflected in solicitations and contracts in the form of agency- and contract-specific security requirements.The proposed rule also requires annual CUI training for contractor employees and states that no contractor employee may handle CUI without first completing the required training and meeting any additional prerequisites for access. Contractors must maintain training documentation and provide it upon request to the contracting officer. These requirements flow down to subcontractors that will handle CUI.Incident Reporting RequirementsFor non-federal facilities and systems, the proposed rule establishes an 8-hour reporting requirement for suspected or confirmed “CUI incidents,” defined very broadly as “improper access, use, disclosure, modification, or destruction of CUI, in any form or medium.” Contractors must report to the agency website or point of contact identified in SF XXX.When a CUI incident occurs, contractors must determine what CUI was or could have been improperly accessed, construct a timeline of user activity, and assess the methods used to access the CUI. For incidents involving information systems, contractors must preserve and protect images of all affected systems and relevant monitoring data for 90 days after submitting the CUI incident report, unless the government declines interest or requests the data and media sooner.The reporting requirements apply to subcontractors at any tier that have access to CUI as well. Subcontractors must notify their prime contractor or next-higher-tier subcontractor within 8 hours of discovery of a suspected or confirmed CUI incident.<a href="#_ftn4" target="_self">[4]</a>Cloud service providers with FedRAMP authorization must follow FedRAMP-specific reporting requirements in addition to those set forth in the proposed contract clauses.Incidents occurring at federal facilities must be reported in accordance with applicable agency procedures.Importantly, the incident reporting rule specifies that, while the mere fact of a report does not create liability, “[i]f the Contractor is determined to be at fault for a CUI incident (e.g., not safeguarding CUI in accordance with the contract requirements), the Contractor may be financially liable for Government costs incurred in the course of the response and mitigation efforts in addition to any other damages at law or remedies available to the Government for noncompliance.” This provision is part of a continuing trend of the government seeking to hold contractors to account for failure to meet security and cybersecurity obligations.  Additional Notable Provisions and Next StepsIn addition to the changes described above, the proposed rule does away with the previously used term “federal contract information” (FCI) and replaces it with a revised definition of “covered Federal information” that clarifies that this category does not include CUI or classified information. As with FCI previously, “covered Federal information” is subject to the protections of the updated FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.In a helpful clarification for contractors, the new definition of CUI specifically excludes information that the contractor possesses or has on its systems that was not created for and/or is not possessed on behalf of, a federal agency. In the past, many contractors questioned how and whether CUI markings apply to their own internal information. This provision makes clear that contractors have no obligation to mark or protect internal information that, in other contexts, might be CUI.Interestingly, the procedure for completion of the SF XXX form specifies that it is the agency “requiring activity,” not the contracting officer, that is required to identify CUI and applicable requirements. It remains to be seen what guidance and training will be provided across government to prevent over-identification—a common issue currently—and encourage consistency across agencies.Also, although CUI can be identified later in the contracting process via modification, the proposed rule leaves open the possibility of a contractor request for equitable adjustment to account for newly added requirements that increase contract compliance costs.The proposed changes formally integrate CUI protection requirements into the federal procurement process and transform the previously piecemeal approach to CUI into a cohesive framework. Nonetheless, the devil is in the details, and contractors are sure to have thoughts about the proposed rule. The FAR Council has even asked interested parties to weigh in on specific questions, including how they believe they will handle competing incident reporting timelines across the federal government and how these additional requirements might impact pricing. Comments should be submitted to the Regulatory Secretariat Division on or before March 17, 2025, to be considered for the final rule.President Trump’s <a href="https://www.whitehouse.gov/presidential-actions/2025/01/regulatory-freeze-pending-review/" target="_blank">regulatory freeze</a>, announced on January 20, 2025, does not impede the FAR Council’s ability to solicit and review comments from industry on the proposed rule, but it does preclude the FAR Council from promulgating a final rule at least until approved by the cognizant appointees of the new administration.<a href="#_ftnref1" target="_self">[1]</a> It remains to be seen how (or whether) DoD will harmonize the differences between the DFARS and this proposed rule.<a href="#_ftnref2" target="_self">[2]</a> The rule notes that the current NIST SP 800-171 version, Rev. 3, is available, but purposefully declines to apply it until further study. However, the FAR Council adds that it anticipates future rulemaking to update to Rev. 3 or future versions of the NIST special publication.<a href="#_ftnref3" target="_self">[3]</a>These enhanced requirements are expected to only apply to a limited subset of contractors; FAR estimates that 160 contractors would be affected.<a href="#_ftnref4" target="_self">[4]</a> This is a notable deviation from the DFARS 252.204-7012 incident reporting process, which requires subcontractors to report directly to the government. The revised process puts the burden on prime contractors to further report subcontractor incidents.

Tina is a partner in Morrison & Foerster’s Government Contracts practice. She represents a wide variety of government contractors including information technology, defense, biotechnology, and pharmace

Tina Reynolds

iko_roke_blog_150x150.png

iko_roke_common_640x280.jpg

iko_roke_heroretina_2700x1160.jpg

iko_roke_mobileretina_750x1040.jpg

iko_roke_social_600x600.jpg

Associate

Roke Iko is an associate in the Litigation Department in Morrison & Foerster’s Washington, D.C. office.
Roke assists clients in the full range of government contracts litigation and compliance matters

Roke Iko

protests-and-litigation-600-300x148.jpg

protests-and-litigation-600-300x148

Proposed Regulation on Controlled Unclassified Information Standardizes Process for CUI Identification and Handling Across Federal Agencies

On December 4, 2024, the House passed the Strengthening Agency Management and Oversight of Software Assets (SAMOSA) Act, a bipartisan bill that is now before the Senate. Under the SAMOSA Act, federal agencies<a href="#_ftn1">[1]</a> are directed to assess their current software inventory and management of contracts and software licenses. Agencies then must develop plans to consolidate their software licenses and adopt enterprise license agreements. If the Act passes in the Senate, agencies will have to identify categories of software to prioritize for enterprise licenses and develop mitigation strategies to reduce software license restrictions. The Act also calls for agencies to train their employees in negotiating options within contracts to minimize restrictive license provisions and distinguishing between acquiring commercial software and custom software.  The SAMOSA Act also extends beyond these agency-level initiatives. If the bill becomes law, within two years after its passage, the Office of Management and Budget (OMB) will develop a strategy for the adoption of government-wide enterprise licenses for widely used software. As noted, only the House has passed the SAMOSA Act. The corresponding Senate bill remains pending since July 2023 when the Senate Committee on Homeland Security and Government Affairs approved its forwarding by unanimous vote. The Senate bill is sponsored by Senator Gary Peters (D-MI) and co-sponsored by four Republican and two Democrat Senators, indicating bipartisan support for the SAMOSA Act to become law. The SAMOSA Act leaves a number of questions open. For one, the bill does not provide specific direction on existing software contracts and procurements; it only requires development of agency-specific plans with a focus on obtaining enterprise licenses as the identified categories “come up for renewal or renegotiation.” It also does not address how contracting officials will facilitate fair negotiations to remove common commercial terms the government deems unfavorably restrictive, in light of the general directive in the Federal Acquisition Regulation (FAR) and Department of Defense FAR Supplement (DFARS) to procure commercial software on commercial terms.<a href="#_ftn2">[2]</a>The SAMOSA Act follows <a href="https://www.gao.gov/products/gao-25-107114" target="_blank">a recent Government Accountability Office (GAO) report</a> advising federal agencies to track opportunities to reduce software license costs. In January 2024, GAO recommended that agencies track software licenses and compare those licenses to their current inventory, a requirement mandated under the SAMOSA Act.<a href="#_ftn3">[3]</a> Just this past November, GAO identified restrictive software licensing practices in cloud computing across multiple agencies as an area where the government may reduce costs.<a href="#_ftn4">[4]</a> Similarly, Senator Joni Ernst recently sent a letter to Elon Musk and Vivek Ramaswamy, proposed leaders of the future Department of Government Efficiency (DOGE), indicating that cloud computing software licenses are a target area of prospective federal government cost cutting.<a href="#_ftn5">[5]</a>The SAMOSA Act and these recent GAO reports signal a potential policy shift in federal contracting for software. Contractors should thus be prepared to review their own license agreements with the government and their approach to federal sales. Thomas Lee, an associate in our Washington, D.C., office, contributed to the writing of this article.<hr class="divider"><a href="#_ftnref1">[1]</a> The SAMOSA Act applies the definition of “agency” in 44 U.S.C. § 3502, namely, “any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency,” excluding the Government Accountability Office, the Federal Election Commission, District of Columbia agencies, and government-owned contractor-operated facilities. The Act exempts elements of the intelligence community from its definition of agency and suggests those elements will conduct their own independent assessments.<a href="#_ftnref2">[2]</a> See FAR 12.212(a); DFARS 227.7202-1(a). These policies make exceptions for terms prohibited by federal law or that otherwise do not satisfy the government’s specific needs – but in such cases where “the Government has a need for rights not conveyed under the license customarily provided to the public, the Government must negotiate with the contractor to determine if there are acceptable terms for transferring such rights.” DFARS 227.7202-3(b).  <a href="#_ftnref3">[3]</a> U.S. Gov’t Accountability Off., GAO-24-105717, Federal Software Licenses: Agencies Need to Take Action to Achieve Additional Savings (2024).<a href="#_ftnref4">[4]</a> U.S. Gov’t Accountability Off., GAO-25-107114, Cloud Computing: Selected Agencies Need to Implement Updated Guidance for Managing Restrictive Licenses (2024).<a href="#_ftnref5">[5]</a> Letter from Joni K. Ernst, U.S. Senator, to Elon Musk and Vivek Ramaswamy, Co-Chairmen, Dep’t of Gov’t Efficiency (Nov. 25, 2024).

House’s Passage of the SAMOSA Act Signals Policy Shift Towards Government-Wide Enterprise Software Licensing

bell_locke_blog_150x150.png

bell_locke_common_640x280.jpg

bell_locke_heroretina_2700x1160.jpg

bell_locke_mobileretina_750x1040.jpg

bell_locke_social_600x600.jpg

Locke Bell is a partner in the firm’s Government Contracts & Public Procurement practice.

Locke Bell

lee_thomas_blog_150x150.png

lee_thomas_common_640x280.jpg

lee_thomas_heroretina_2700x1160.jpg

lee_thomas_mobileretina_750x1040.jpg

lee_thomas_social_600x600.jpg

Thomas Lee

House’s Passage of the SAMOSA Act Signals Policy Shift Towards Government-Wide Enterprise Software Licensing

A recent decision, <a href="https://ecf.cofc.uscourts.gov/cgi-bin/show_public_doc?2024cv0160-37-0" target="_blank">Independent Rough Terrain Center, LLC v. United States</a> (“IRTC”),<a href="#_ftn1" target="_self">[1]</a> confirms the U.S. Court of Federal Claims has jurisdiction over bid protests related to follow-on production contracts arising out of other transaction (“OTs”) for Department of Defense prototype projects. The court’s holding in this respect is consistent with past cases and relatively unremarkable. But the legal framework the court adopts is quite noteworthy and may even chart a path for expanded jurisdiction over protests of initial prototype OT solicitations and awards. First, a brief introduction (or reminder) on OTs. Most federally funded agreements in the United States take one of three forms: a procurement contract, where the government is acquiring goods or services for its direct benefit or use, or a grant or cooperative agreement, where the government provides funding (or something else of value) to carry out some public purpose. Congress has further authorized some agencies to enter into other types of agreements in certain circumstances. For DoD, this includes the award of OTs to carry out prototype projects that meet the statutory criteria set forth in 10 U.S.C. § 4022, and the award of sole source follow-on production OTs or contracts upon their successful completion. In many ways, DoD’s prototype OTs look and feel and act a lot like a procurement contract – they are, after all, contracts for prototypes or prototyping services – but they are, by design, not subject to most procurement laws and regulations, including the Competition in Contracting Act (CICA), the Federal Acquisition Regulation (FAR), or the DoD FAR Supplement (DFARS). This affords greater flexibility and speed in the acquisition process. It also raises questions around traditional means of oversight, including the availability of independent review through bid protests.A general rule has emerged in federal courts: If a prototype OT solicitation or award contemplates follow-on production, the Court of Federal Claims has exclusive jurisdiction to hear related bid protests. If, on the other hand, the prototype OT stands independent from any future production award, then any protest must be brought in a federal district court of general jurisdiction. We have discussed this rule in greater detail elsewhere: e.g., <a href="https://govcon.mofo.com/topics/another-piece-to-the-puzzle-court-of-federal-claims-has-jurisdiction-over-bid-protest-where-the-disputed-other-transaction-could-lead-to-a-follow-on-production-contract?_gl=1*re7ds*_ga*MTkyMTA2Mzg1OC4xNzE3MDEzODc5*_ga_3HVRG7GH76*MTcxNzUxNjI3OS40LjEuMTcxNzUxNjMwNC4wLjAuMA.." target="_blank">Another Piece to the Puzzle: Court of Federal Claims Has Jurisdiction over Bid Protest Where the Disputed Other Transaction Could Lead to a Follow-on Production Contract</a> and <a href="https://govcon.mofo.com/topics/where-can-you-protest-an-other-transaction-award-insights-from-kinemetrics" target="_blank">Where Can You Protest an Other Transaction Award? Insights from Kinemetrics</a>.<a href="#_ftn2" target="_self">[2]</a>Through this lens, the court’s decision to take jurisdiction in IRTC makes perfect sense: not only did the solicitation at issue contemplate follow-on production, it was for follow-on production. Specifically, the protester challenged actions of the U.S. Army Materiel Command in connection with determining which of two prototype OT recipients would receive a follow-on production contract. That the Court of Federal Claims has jurisdiction over such protests is a natural application of the court’s jurisdictional mandate, DoD’s OT statute, and past case law. More interesting, though, is how the court reached its conclusion. Yes, the court acknowledged the prior cases and rule, noting the Court of Federal Claims has claimed jurisdiction when a prototype OT award “initiated an acquisition process that led to, or at least contemplated, the eventual award of a follow-on production contract.” But before reaching those cases, the court pinpointed a different, higher-level question guiding its analysis. According to IRTC, “the relevant inquiry requires the Court to look at what the Government is seeking through the solicitation of proposals.” If the purpose is “acquiring property or services,” then the solicitation is a “procurement” properly within the court’s jurisdiction.<a href="#_ftn3" target="_self">[3]</a> Because in IRTC “the Solicitation at issue [was] to acquire for the benefit of the Army the goods and services proposed” by the prototype OT performers, exclusive jurisdiction properly sat with the Court of Federal Claims.The court distinguished this from its prior decision in Space Exploration Technologies Corp. v. United States (“SpaceX”),<a href="#_ftn4" target="_self">[4]</a> where it transferred a prototype OT bid protest to the Central District of California because the government had no intent to award direct follow-on production contracts. In that case, the U.S. Air Force issued prototype OTs as investments in developing the commercial space launch industry, from which the Government would procure services in the future through full-and-open commercial services competitions that were “separate and distinct” from the OTs. Thus, the OTs were not a procurement because, according to the court, they “did not involve the procurement of any goods or services” by the agency. The court concluded that, “[i]n this way, a solicitation for a follow-on production contract is materially distinguishable from a solicitation issued during the OT prototype phase.”That may arguably be true for the OTs at issue in SpaceX, but it is too broad a stroke to apply to all prototype OTs. In fact, one could reasonable estimate that most prototype OTs involve the acquisition of property or services in some form or another, whether through the delivery of prototype hardware or software or related design documents, or provision of R&D or prototyping services. Indeed, DoD has even admitted, in historical (and admittedly outdated) versions of its Other Transactions Guide, that prototype OTs are “acquisition instruments” that are “intended to provide DoD a direct benefit.”<a href="#_ftn5" target="_self">[5]</a> In that case, it seems logical to extend the court’s definition of a “procurement,” and its holding in IRTC, to give it jurisdiction over OT bid protests even where the initial prototype OT solicitation does not contemplate a follow-on production award, but nevertheless involves the acquisition of prototypes or prototyping services.There is a good public policy rationale to support this result. Keep in mind the alternative if the Court of Federal Claims declines jurisdiction: it is not a total bar to judicial review, but rather jurisdiction in one of the man federal district courts of general jurisdiction, before a judge who is unlikely to be as familiar with bid protests or government contracting as the specialized judges at the Court of Federal Claims.We will watch with interest to see whether IRTC is in fact a harbinger of expanded OT bid protest jurisdiction at the Court of Federal Claims, much like we are watching to see if GAO will expand its own jurisdiction over OT bid protests involving follow-on production awards, as we wrote about recently in <a href="https://govcon.mofo.com/topics/gao-opens-the-door-to-certain-other-transaction-bid-protests" target="_blank">Has The GAO Opened the Door to Certain Other Transaction (OT) Bid Protests?</a>. <hr class="divider"><a href="#_ftnref1" target="_self">[1]</a> No. 24-160 (Fed. Cl. July 1, 2024).<a href="#_ftnref2" target="_self">[2]</a> For discussions of GAO’s OT jurisdiction, see, e.g., <a href="https://govcon.mofo.com/topics/gao-opens-the-door-to-certain-other-transaction-bid-protests" target="_blank">Has The GAO Opened the Door to Certain Other Transaction (OT) Bid Protests?</a> and <a href="https://govcon.mofo.com/topics/gao-sharpening-its-blade-strategies-on-ota-review" target="_blank">GAO Sharpening Its Blade [Strategies] on OTA Review</a><a href="#_ftnref3" target="_self">[3]</a> Ironically, this definition, based in Federal Circuit precedent, is pulled from 41 U.S.C. § 111, a section of the U.S. Code comprising the very procurement laws from which OTs have been exempted. <a href="#_ftnref4" target="_self">[4]</a> 144 Fed. Cl. 433 (2019).<a href="#_ftnref5" target="_self">[5]</a> Dep’t of Def., Other Transactions Guide for Prototype Projects, Version 1.2.0 at 1-2 (Jan. 2017); see also USD (AT&L), “Other Transactions” (OT) Guide for Prototype Projects § C1.6 (Dec. 21, 2000) (“OT prototype authority may be used only to carry out prototype projects that are directly relevant to weapons or weapon systems proposed to be acquired or developed by the Department. As such, any resulting OT awards are acquisition instruments since the government is acquiring something for its direct benefit.”).

Court of Federal Claims Potentially Expands Its Other Transaction (OT) Bid Protest Jurisdiction

Court of Federal Claims Potentially Expands Its Other Transaction (OT) Bid Protest Jurisdiction

A recent decision, Independent Rough Terrain Center, LLC v. United States (“IRTC”),[1] confirms the U.S. Court of Federal Claims has jurisdiction over bid protests related to follow-on production contracts arising out of other transaction (“OTs”) for Department of Defense prototype projects. 

Under the Supreme Court’s decision in Chevron USA Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984), for decades courts have sometimes been required “to defer to ‘permissible’ agency interpretations of [ambiguities in] statutes those agencies administer—even when a reviewing court reads the statute differently.” This is known as “Chevron deference” or the “Chevron doctrine.” Loper Bright Enters. v. Raimondo, 603 U.S. __, 2024 WL 3208360, at *16 (June 28, 2024). Last month, the U.S. Supreme Court overruled Chevron and held that courts “may not defer to agency interpretation of the law simply because a statute is ambiguous.” Id. at *62. The Court made it clear that “[c]ourts must exercise their independent judgment in deciding whether an agency has acted within its statutory authority, as the [Administrative Procedure Act] APA requires.” Id. at *61-62. The APA was enacted “as a check upon administrators whose zeal might otherwise have carried them to excesses not contemplated in legislation creating their offices.” Id. at *32. The Court found that Chevron deference cannot be squared with the APA, which specifies that courts, not agencies, will decide all relevant questions of law and set aside agency action inconsistent with the law as the courts interpret it.  Id. at *38.A detailed overview of the Supreme Court’s decision in Loper can be found on our <a href="https://www.mofo.com/resources/insights/240703-supreme-court-strikes-down-chevron" target="_blank">website</a>, and another article discussing the potential impacts of the Supreme Court’s decision on government contractors is available on our <a href="https://govcon.mofo.com/topics/the-end-of-chevron-deference-what-it-means-for-government-contractors" target="_blank">Government Contracts Insights</a> blog. This article discusses the potential impacts the fall of the Chevron doctrine may have on False Claims Act (FCA) litigation. In short, the end of the Chevron doctrine may create situations in which it is easier to defend against FCA cases based on violation of a regulation.Last year in United States ex rel. Schutte v. SuperValu, Inc., 598 U.S. 739 (2023), the Supreme Court determined that a defendant’s contemporaneous subjective beliefs about a legal requirement matter, which made it harder to win a motion to dismiss on the ground that the requirement was unclear or open to more than one interpretation (i.e., the “objective reasonableness” or “clever lawyer” defense). The Supreme Court may now have revived a similar (though not exactly the same) defense through the back door, allowing a defendant to argue that a regulation underlying an FCA case is contrary to, or unsupported by, the governing statute.For example, if an FCA defendant is accused of a regulatory violation in which its alleged conduct does not violate the underlying statute but does violate an implementing regulation, the defendant might contend the regulation is inconsistent with the statute. In that scenario, the defendant could move to dismiss on the ground that, even if the facts are as alleged, they do not support a legal violation. Under Loper, a court would have more latitude to consider that argument. Unlike the “objective reasonableness” defense the Supreme Court rejected in Schutte, which focused on the scienter element of an FCA claim, this new avenue would focus on the falsity element, arguing that it is not false or fraudulent to violate an unlawful regulation.Before Chevron’s undoing, deference to agency interpretations of statutes may have given relators and the federal government a leg up in FCA cases, while defendants faced an uphill battle against years of agency rulemaking and a thumb on the scale in favor of agency interpretations. Now, savvy defense attorneys may look for potential daylight between a statute and the regulation a defendant is accused of violating.