The government is rewriting the rulebook for how it buys and the changes are coming fast

Terry Gerton Various big news in the government contracting world. Exciting times. The FAR rules have finally dropped, or at least the first tranche of them. Tell me what the headlines are, what you’re looking at.

Dan Ramish So The Revolutionary Far Overhaul, of course, has been going on since last year. The first phase of that project involved various deviations to implement a rewrite of the FAR. Now we’re moving into the second phase, which is phase two, which notice and comment rulemaking on all the proposed rules. And so there are 12 total rules planned that will be probably published over the course of the summer. And we have now the first four sets of proposed rules that include on the order of 20 FAR parts, 19 plus the corresponding clauses of the FAR, I think the first thing that was striking about these proposed rules is that the FAR Council only gave 30 days for public comment, which is a very aggressive time schedule, and of course part of this is motivated by the desire to finalize the rules as soon as possible, potentially by sometime this year.

Terry Gerton Definitely the FAR Council Summer Reading Program.

Dan Ramish Absolutely. As far as the other impressions of the proposed rules, you know, the proposed rules range from 22,000 to 85,000 words. There is a lot of summer reading here. That’s a total of 223,000 words, about as long as Moby Dick or Atlas Shrugged. So truly, government contracts aficionados will have some serious beach reading on their hands. One of the questions that people had about phase two was whether they would really be significant substantive changes, because the first phase, some people have found underwhelming when it came to sort of being a revolutionary FAR overhaul, not all that many substantive changes. But I think from the initial indications from these first four proposed rules, there are some real substantive changes.

Terry Gerton The talk on the street is that this is a big shift from compliance to judgment, that it opens up a lot of flexibility for contracting officers. How are you reading that?

Dan Ramish I think there is some support for that, and certainly the effort within the Revolutionary FAR Overhaul to remove some of the verbiage and put it in the Far Companion supported that. These proposed rules make some organizational changes, kind of building on the changes we saw in the first phase, and they also include some real substantive changes, including interestingly, some open FAR cases that were not part of the RFO that had just been pending. The most significant of these is the FAR CUI rule, which has been in play for a long time. The open FAR case dates back to 2017, and there was a proposed rule in 2025. There are a number of other supply chain type rules that the FAR council kind of batched in with the RFO changes in the proposed rules. So some of the action is on those areas.

Terry Gerton They also provided a couple of extra resources that might be of interest to government contractors.

Dan Ramish Yes. So one of those resources, as part of the lead up to RFO phase two, the FAR council invited sort of crowdsourced suggestions, like a virtual suggestion box for changes to the FAR. And the FAR overhaul website now has a feedback matrix they refer to as ‘you said we did,’ which indicates for each of the kind of crowdsourced suggestions, what people suggested, how the government reacted and what the impact is or why it matters. So that’s an interesting resource, particularly for those who participated in that crowdsourcing campaign. Another item that they added to the four proposed rules is a matrix showing which provisions and clauses associated with the revised parts should be included or excluded from solicitations and contracts, specifically for commercial products, commercial services, and commercially available off-the-shelf items. And they also addressed, in a second matrix, flowdown requirements in commercial and subcontracts. So that’s a useful resource and add-on. In these proposed rules.

Terry Gerton Dan Ramish is a partner at Haynes Boone. Dan, what are then the headline changes in these first four proposed rules? Walk us through the big ticket items.

Dan Ramish Sure. So I think one of the headlines surely will be the FAR-CUI rule. I won’t go into too much detail about it because I know you’ll have other coverage of it. It could be a conversation entirely on its own, but this is a major development that’s been a long time in coming. The rule will create a standard form and procedures for agencies to communicate controlled unclassified information that must be managed and safeguarded during performance. And the proposed rule clarifies that prime contractors will have discretion about how to flow down the requirements and subcontracts. It makes a number of significant changes from the previous version of the rule, including narrowing the definition of CUI incidents so that it doesn’t include improper handling that doesn’t result in unauthorized disclosure or improper modification or destruction. It also removes contractor liability language. It makes changes removing prescriptive training requirements that are one size fit all to a little more flexibility in that area. It aligns cyber incident reporting timeframes with the DoD cybersecurity time frame at 72 hours. All changes that seem like they’re responses to feedback provided during the comment process. One issue that will certainly be looked at closely is that the rule would make NIST Special Publication 800-171 Revision 3 the baseline for not federal information systems with CUI, whereas DoD is actually still applying revision 2. So I’m sure that there will be detailed analysis of that, and particularly considering how this rule will interact with the rollout of the CMMC program. The next thing of interest, there’s consolidation within these proposed rules of a range of different supply chain security regimes. One of those is the Federal Acquisition Supply Chain Security Act implementation. That provides agency-specific exclusion actions called covered procurement actions based on the supply chain risk determination. This is one of the authorities that DOD used to designate anthropic as a supply chain risk in that whole dispute that’s currently being litigated before the DC Circuit Court of Appeals. And the proposed rule would add a couple of details here, defining covered procurement action and requiring agencies to establish procedures to ensure compliance. Part of that broader supply chain consolidation also will standardize some of the requirements for these supply chain exclusions and prohibitions. So, talking about covered telecommunications systems and equipment, the so-called section 889 requirements, in addition to FASC’s TikTok ban, Kaspersky Labs, all of that fun stuff had been individual requirements that kind of accumulated and now it’s all going to be in one place, but it’s not just an organizational change. There’ll also be one standard for reasonable inquiry. For assessing compliance with the security prohibitions that requires the offeror to look at information in its possession that’s accessible, but doesn’t go so far as to require an internal or third-party audit or look for information outside its possession.

Terry Gerton So those parts deal with supply chain and cybersecurity. What about protests and disputes?

Dan Ramish There are some interesting provisions in this area. One of the changes relates to agency protests. There have been efforts to kind of boost the agency protest authority and build confidence in agency protests, so there’s some changes along those lines that try to get offerors to use agency protests more frequently. These changes would require contracting officers to report protest to the head of contracting activity, allow for the disclosure of redacted copy of the agency’s final technical valuation of the protesters’ proposal and redact a copy of the source selection decision regardless of the type of procurement, would allow the protesters to raise additional protest grounds within a reasonable amount of time set by the independent review officials. So, all measures to make the agency protest mechanism look more effective and hopefully be used more frequently as a less intrusive way of resolving pre-award disputes and award disputes.

Terry Gerton And there’s more about the regulatory sunset mechanism. That’s a fascinating provision.

Dan Ramish Yes. This is one of the mechanisms that got a lot of attention with the original RFO executive order because the order itself called for a provision that would essentially require that non-statutory FAR provisions be removed, expire from the FAR four years after the effective date of the final RFO rule. So there were concerns that this would be sort of a time bomb and would blow up the FAR after four years went by. I think the actual implementation of the sunset mechanism in RFO Phase 2 will kind of allay those concerns significantly. It calls for essentially a review of the provisions and clauses and sections that are non-statutory and actually provides for public input as well. It says that removal of provisions and clauses and sections won’t happen automatically, but will have to happen through rulemaking. So, kind of an intentional paring back of requirements that aren’t required by statute, but not something that’s going to inadvertently blow up the procurement system.

Terry Gerton So as you set up at the top, this set of rules to review is roughly the size of Moby Dick, but it’s still significantly shorter than the current FAR. They’ve taken out a lot. They’ve moved a lot of provisions into associated documents. Let’s just refresh folks on the fact that they have 30 days, probably less now, to get through this reading and submit their suggestions.

Dan Ramish Yes, July 23rd, 2026 is the timeframe. So there is still time to get comments in and the FAR Council has made it clear they’re open to further changes to ensure that the revisions that are contemplated will work and won’t create conflicts and unintended consequences. So, by all means, contractors should, either on their own or get involved with industry groups and look at submitting comments if they’re going to be affected by these proposed rules.

Terry Gerton Do you think the short timeline is just so that they’re ready for the next round?

Dan Ramish I do think we’re going to see the other eight proposed rules pretty quickly in the next two, three months, and they’re looking to move forward and roll it out. I think given the breadth of the changes, it may well be that industry groups request additional time to comment. Of course, everyone wants the procurement process to be improved, but maybe taking a little bit more time to refine the streamlining of the regulations will improve how it actually works once it’s rolled out.