Skip to content

Government Contracts

In August 2022, the Chips and Science Act—a massive, $280 billion bill to boost public and private sector investments in critical and emerging technologies—became law.  We followed the bill from the beginning and anticipated significant opportunities for industry to inform and influence the direction of the new law’s programs. 

One such opportunity is available now.  The U.S. Department of Commerce recently published a request for information (RFI) “to inform the planning and design of the Regional Technology and Innovation Hub (Tech Hubs) program.”  The public comment period ends March 16, 2023.

Background

The Chips and Science Act authorized $10 billion for the U.S. Department of Commerce to establish a Regional Technology and Innovation Hub (Tech Hubs) program.  Specifically, Commerce was charged with designating at least 20 Tech Hubs and awarding grants to consortia composed of one or more institutions of higher education, political subdivisions, state governments, and “industry or firms in relevant technology, innovation, or manufacturing sectors” to develop and deploy critical technologies in those hubs.  $500 million has already been made available for the program, and Commerce will administer the program through the Economic Development Administration (EDA).…

Continue Reading Commerce Seeks Comments on Regional Tech Hubs Program

This is the twenty-first in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the subsequent blogs described the actions taken by various Government agencies to implement the Cyber EO from June 2021 through December 2022.  This blog describes key actions taken to implement the Cyber EO during January 2023.

GSA Announces That It Will Require Software Vendors to Submit Letters of Attestation Beginning in June 2023.

            On January 11, 2023, the General Services Administration (“GSA”) Senior Procurement Executive and Chief Information Officer jointly issued Acquisition letter MV-23-02, “Ensuring Only Approved Software Is Acquired and Used at GSA” (the “GSA letter”).  The GSA letter establishes a June 12, 2023 effective date for implementing the secure software acquisition requirements of Office of Management and Budget (“OMB”) Memorandum M-22-18, issued pursuant to Section 4 of the Cyber EO.  That OMB memorandum directs that agencies must only use software that complies with Government-specified secure software development practices.  These practices include obtaining self-attestations of conformity with secure software development practices and in certain cases as determined by agencies, artifacts such as Software Bills of Materials (SBOMs) from software vendors to verify that the acquired software[1] was developed and produced according to NIST security guidelines and best practices.

            The GSA letter directs GSA’s IT officials to update GSA’s policies by June 12, 2023 to reflect the process for collecting, renewing, retaining, and monitoring the self-attestation information mandated by OMB M-22-18.  For existing contracts that include the use of software, the GSA letter directs GSA IT to provide an internally accessible list of the software used for each contract and to collect vendor attestations by June 12, 2023.  For new contracts that include the use of software, the GSA letter directs the relevant acquisition teams to modify the acquisition planning process to ensure that performance of such contracts begins only after the requisite attestations have been collected and considered.  Finally, with respect to GSA-administered Government-wide indefinite delivery vehicles (e.g., Federal Supply Schedule contracts, Government-Wide Acquisition Contracts, and Multi-Agency Contracts), the GSA letter directs GSA contracting activities to allow, but not require, contractors to provide attestations at the base contract level rather than the task or delivery order level, and to make those attestations available to ordering activities to the extent possible.  With this said, the GSA letter specifies that ordering agencies will ultimately be responsible for complying with OMB M-22-18.…

Continue Reading January 2023 Developments Under President Biden’s Cybersecurity Executive Order

President Biden recently signed bipartisan legislation reinforcing anti-human trafficking prohibitions. The End Human Trafficking in Government Contracts Act of 2022 builds on the existing anti-human trafficking framework at Federal Acquisition Regulation (“FAR”) § 52.222-50 (Combatting Trafficking in Persons) by requiring agencies to refer contractor reports of potential human trafficking activity directly to an agency suspension and debarment official (“SDO”).  Prior to this legislation, contractors have been required to notify their contracting officer and the agency inspector general upon receiving “[a]ny credible information” that a human trafficking violation had occurred.  See FAR § 52.222-50(d)(1).  Now agencies will be required to refer these reports to their SDOs, creating additional risk for contractors that disclose potential violations. 

This legislation – which passed Congress unanimously – demonstrates the federal government’s ongoing focus on anti-human trafficking matters – a focus that has been shared across presidential administrations.  For instance, in 2015, President Obama significantly expanded the FAR’s anti-human trafficking prohibitions, and in 2019, President Trump sought to undertake a comprehensive review of the government’s anti-trafficking efforts and released a list of “best practices” to guide contractors.  President Biden now joins this ongoing, bi-partisan effort to increase government contractors’ focus on human trafficking by signing the recently-passed legislation.

Despite the federal government’s longstanding efforts to prevent human trafficking in its supply chain, many questions remain concerning how to comply with the requirements.  Below are three of the most common questions we encounter in applying the FAR’s anti-human trafficking provision:…

Continue Reading New Law Increases Government Scrutiny of Contractor Compliance with Anti-Trafficking Provisions

This is the tenth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the second, third, fourth, fifth, sixth, seventh, eighth, and ninth blogs described the actions taken by various Government agencies to implement the EO from June 2021 through January 2022, respectively.

This blog summarizes key actions taken to implement the Cyber EO during February 2022.  As with steps taken during prior months, the actions described below reflect the implementation of the EO within the Government.  However, these activities portend further actions in March 2022 that are likely to impact government contractors, particularly those who provide software products or services to government agencies.

NIST Publishes Guidance to Federal Agencies on Practices to Enhance Supply Chain Security When Procuring Software

Section 4(e) of the Cyber EO requires the National Institute of Standards and Technology (NIST) to publish guidelines on practices for software supply security for use by U.S. Government acquisition and procurement officials.  Section 4(k) of the EO requires the Office of Management and Budget, within 30 days of the publication of this guidance (or March 4, 2022), to “take appropriate steps to require that agencies comply with such guidelines with respect to software procured after the date of the EO.  Section 4(n) of the EO states that within one year of the date of the EO (or May 12, 2023), the Secretary of Homeland Security…shall recommend to the FAR Council contract language requiring suppliers of software available for purchase by agencies to comply with, and attest to complying with, any requirements issued pursuant to subsections (g) through (k) of this section.”

NIST issued the Supply Chain Security Guidance called for by Section 4(e) of the EO on February 4, 2022.  The Supply Chain Security Guidance states that it “provides recommendations to federal agencies on ensuring that the producers of software they procure have been following a risk-based approach for secure software development throughout the software life cycle,” and that “[t]hese recommendations are intended to help federal agencies gather the information they need from software producers in a form they can use to make risk-based decisions about procuring software.”  The scope of the Supply Chain Security Guidance is expressly limited to “federal agency procurement of software, which includes firmware, operating systems, applications, and application services (e.g., cloud-based software), as well as products containing software.”  The Guidance further provides that “the location of the implemented software, such as on-premises or cloud-hosted, is irrelevant,” and also excludes open source software and software developed by federal agencies.  However, open-source software that is bundled, integrated, or otherwise used by software purchased by a federal agency is within the scope of the Guidance.

The Supply Chain Security Guidance defines minimum recommendations for federal agencies as they acquire software or a product containing software:

  1. Use the Secure Software Development Framework (SSDF) terminology and structure to organize communications about secure software development requirements.
  2. Require attestation to cover secure software development practices performed as part of processes and procedures throughout the software life cycle.
  3. Accept first-party attestation of conformity with SSDF practices unless a risk-based approach determines that second or third-party attestation is required.
  4. When requesting artifacts of conformance, request high-level artifacts.

…
Continue Reading February 2022 Developments Under President Biden’s Cybersecurity Executive Order

Last Tuesday, GAO released its Fiscal Year 2021 protest statistics, which as always contains a wealth of interesting information about GAO’s protest system.

  • Protest filings dropped by 12% from FY20.  After remaining fairly steady in FY19 and FY20, filings dropped in FY21, with the lowest number of cases filed since FY08.  It seems likely,

…

Federal government contractors face many uncertainties as they implement President Biden’s COVID-19 vaccine mandate. This includes the distinct possibility of civil lawsuits arising out of their implementation of the mandate, including potential allegations of invasion of privacy, wrongful termination, lost wages, discrimination, personal injury or other common law claims or statutory violations. At least …

This is the fifth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity”, issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the second, third, and fourth blogs described the actions taken by various…

On September 24, the Safer Federal Workforce Task Force released guidance on workplace safety protocols for federal contractors and subcontractors related to COVID-19 (“the Guidance”).  The Guidance was issued pursuant to President Biden’s Executive Order on Ensuring Adequate COVID Safety Protocols for Federal Contractors.

As expected, the Guidance covers a broad range of contract

…

…

As GSA Multiple Award Schedule contractors know all too well, Schedule contracting involves a complex web of customer-tracking, reporting, and price-adjustment requirements.  Those of us who navigate these often byzantine rules understand why many in the industry have called for the adoption of an alternative approach to verifying price reasonableness.

For the last several years, GSA has been piloting just such an alternative:  the Transactional Data Reporting (“TDR”) program, through which the government collects transaction-level data on products and services purchased through the Schedule to make data-driven decisions that save taxpayer dollars.  GSA has been running a TDR pilot program for several years to test the potential for a new regulatory regime, though the program sometimes has been the source of criticism and controversy.  Now that controversy has heightened further:  GSA’s Office of Inspector General published an audit report on June 24, 2021 that is sharply critical of the program, only to see GSA’s Federal Acquisition Service (“FAS”) Commissioner publicly reject the report’s conclusions and defend TDR’s effectiveness.
Continue Reading The End of CSP and PRC Requirements? — GSA’s TDR Pilot Program Faces Further Internal Criticism