FedSubK Feature: Two Proposed FAR Rules on Cybersecurity Would Require New Offeror and Contractor Compliances
Updated: May 4, 2024
Two long-awaited proposed FAR rules on cybersecurity requirements to be published on October 3, 2023, would standardize language and processes across Government but could have far-reaching financial and administrative impacts to existing and future contractors in order to comply, particularly small businesses. We break down the proposed changes below.
FAR Case 2021-017 Cyber Threat and Incident Reporting and Information Sharing.
This 72-page proposed rule would partially implement E.O. 14028, Improving the Nation’s Cybersecurity (5/12/22) and implements OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (IPv6) (11/19/2020). Items of note in this proposed rule are:
- Changes to the definition of Information and Communication Technology (ICT) to:
- Move the definition of “Information system” from FAR 4.1901 to FAR 2.101.
- Add definitions for “internet of things (IOT) devices”, “operational technology”, “telecommunications equipment” and “telecommunications services”.
- FAR Part 39. Several changes include:
- Adds a definition of “Supplier’s declaration of conformity” derived from NIST SP 500-281B.
- Revises the title of FAR 39.106 to “Internet Protocol version 6 (IPV6)” with subsections added for policy and waiver requirements, and updates FAR 7.105, FAR 11.002, FAR 12.202, and FAR 39.101 to point to this new section.
- Adds a new FAR subpart 39.107 Response to incident reports and requests for information or access.
- Moves provisions and clauses previously found in FAR 39.106 to a new FAR 39.108 and adds the following new clause and provision.
- FAR clause 52.239-ZZ (TBD), Incident and Threat Reporting and Incident Response Requirements for Products or Services Containing Information and Communications Technology. This clause establishes new definitions and coverage for:
- Requests for security incident reporting.
- Supporting incident response, which provides CISA, the Federal Bureau of Investigation (FBI) in the Department of Justice, and the contracting agency full access to applicable contractor information and information systems, and to contractor personnel, in response to a security incident reported by the contractor or a security incident identified by the Government, as required by the E.O.
- Cyber threat indicators and defensive measures reporting.
- IPv6.
- NOTE: Requires flow down to lower tier subcontractors.
- FAR provision 52.239-AA (TBD), Security Incident Reporting Representation, for offerors to represent that they have submitted all security incident reports in a current, accurate and complete manner; and represent that they have required each lower tier subcontractor to flow down the FAR clause 52.239-ZZ in their subcontracts.
- The proposed new provision and clause would be applicable to solicitations and contracts below the simplified acquisition threshold and for commercial products (including COTS items) and commercial services.
- FAR clause 52.239-ZZ (TBD), Incident and Threat Reporting and Incident Response Requirements for Products or Services Containing Information and Communications Technology. This clause establishes new definitions and coverage for:
- Adds a new requirement for contractors to develop and maintain a software bill of materials (SBOM) for any software used in the performance of the contract regardless of whether there is any security incident. SBOMs are described at section 10(j) of E.O. 14028. This requirement is proposed to also flow down to subcontractors.
- Requires access by and cooperation with the Cybersecurity and Infrastructure Security Agency (CISA) engagement services related to threat hunting and incident response in order to provide visibility into systems to observe adversary activity, and to be taken only after consultation between the contractor and the contracting agency.
- Requires additional actions to support incident response when primes or subcontractors are operating in a foreign country.
- Updates existing FAR provision and clauses as necessary to conform and align with the proposed changes.
IMPORTANT: The Government is asking for industry input in several key areas:
- Anticipated impact of including a requirement to develop SBOMs. (pg 10)
- CISA, FBI, and/or contracting agency access to information, equipment, personnel; safeguards to access; and privacy and civil liberties. (pgs 11-12)
- Scenarios where businesses could not comply or would be prevented from complying with the FAR clause 52.239-ZZ due to a country’s laws or regulations. (pg 13)
- Security incident reporting harmonization between government and industry (including DFARS 52.204-7012, Homeland Security Acquisition Regulation (HSAR), Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), and the National Industrial Security Program Operating Manual (NISPOM)). (pgs 16-18)
The Government’s estimate of the financial impacts to the public and Government are summarized starting on page 19 of the proposed rule and the number of entities and burden hours on pages 31-34.
The Government has summarized the compliance requirements beginning on page 28 for the new clause (-ZZ) as referenced above. They include:
- providing information regarding reportable incidents to CISA and to affected agencies, and any updates until eradication or remediation activities are completed.
- conducting data preservation and protection and providing to the Government, if requested.
- developing, storing, and maintaining customization files, and providing to the Government, if requested.
- developing and maintaining a software bill of materials (SBOM) and providing or providing access to the SBOM (and its updates) to the Government.
- providing to the Government and any 3rd party authorized assessor all incident and damage assessment information identified in the clause, if the Government elects to conduct an incident or damage assessment.
- if applicable, submitting malicious code samples or artifacts to CISA within 8 hours of discovery and isolation of the malicious software.
- providing access to additional information or equipment necessary for forensic analysis, upon request by the Government, and time to cooperate with the Government on ensuring effective incident response, corrections, or fixes, and time to confirm validity of request from CISA by contacting the CISA Hotline and notifying the contracting officer.
- subscribing to the Automated Indicator Sharing (AIS) capability or successor technology during the performance of the contract and sharing cyber threat indicators and recommended defensive measures in an automated fashion using AIS.
- implementing delta capabilities required for moving to IPv6 for ICT products and services using internet protocol (capabilities in NIST SP 500-267B).
- provide a corresponding supplier’s declaration of conformity in accordance with the USGv6 Test Program (see NIST SP 500-281A).
- for which the agency CIO has approved a waiver of IPv6 requirements, to develop and provide an IPv6 Implementation Plan to the Government that details how the contractor plans to incorporate applicable mandatory capabilities recommended in the current version of NIST SP 500-267B into products and services provided to the Government.
Comments are due February 2, 2024 (see extension of comment period here). Submit comments in response to FAR Case 2021-017 to the Federal eRulemaking portal at https://www.regulations.gov by searching for “FAR Case 2021-017". Select the link “Comment Now” that corresponds with “FAR Case 2021-017”. Follow the instructions provided on the “Comment Now” screen. Include your name, company name (if any), and “FAR Case 2021-017” on your attached document. If your comment cannot be submitted using https://www.regulations.gov, call or email the points of contact in the FOR FURTHER INFORMATION CONTACT section of the proposed rule document for alternate instructions.
------------------------------------------------------------------------------------------------------------------------------
FAR Case 2021-019 Standardizing Cybersecurity Requirements for Unclassified Federal Information Systems
This 115-page proposed rule would partially implement E.O. 14028, Improving the Nation’s Cybersecurity (5/12/22) and the Internet of Things (IoT) Cybersecurity Improvement Act of 2020 (Pub. L. 116-207) Section 7, Paragraphs (a) and (b)(1). The proposed rule would standardize language and minimum cybersecurity standards across government to those derived from the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) in an effort to protect and secure cloud-based, on-premises, or hybrid Federal Information Systems (FIS) used or operated by an agency, by a contractor of an agency, or by another organization on behalf of an agency.
(NOTE: This proposed rule does not implement the Office of Management and Budget (OMB) Memorandum M-22-18, Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (dated 9/15/2022).
Items of note in this proposed rule are:
- New FAR Subpart 39.X (TBD), Federal Information Systems. This new subpart will outline policies and procedures when acquiring services to develop, implement, operate, or maintain a FIS.
- New and revised definitions in FAR Subpart 2.101 and 39.X using current language from statute, regulation, OMB memoranda and circulars, and National Institute of Standards and Technology (NIST) Special Publications (SP) guidance.
- New FAR Subpart 39.X02-1(b), Prohibited IoT devices in Federal information systems, to implement Section 7 Paragraphs (a) and (b)(1) of the Act previously referenced to ensure applicability of the rule to acquisitions valued at or below the simplified acquisition threshold, including acquisitions for commercial products (including COTS items) and commercial services.
- Two new FAR clauses to be used in contracts for services to develop, implement, operate, or maintain a FIS.
- FAR Clause 52.239-YY Federal Information Systems Using Non-Cloud Computing Services.
- FAR Clause 52.239-XX Federal Information Systems Using Cloud Computing Services
- The proposed new clauses would not be applicable to solicitations and contracts below the simplified acquisition threshold but would be applicable for commercial products (including COTS items) and commercial services.
- Conforming changes to FAR Parts 4, 7, 27, and 39 to further implement changes in appropriate acquisition phases and when taking certain actions.
The Government’s estimate of the impacts to the public and Government are summarized on page 22-48 of the proposed rule, and the number of entities and burden hours for both industry and Government are found on pages 53-54.
The Government has summarized the compliance requirements for contractors awarded a contract or subcontract to develop, implement, operate, or maintain a FIS begin on page 50. They include:
- Non-Cloud FIS:
- Read and become familiar with the rule, as well as review the applicable standards documents identified in the rule.
- Develop and maintain a detailed list of the physical location of all operational technology (OT) equipment included within the boundary of the non-cloud FIS for the duration of the contract in order to affirmatively locate the OT equipment, when necessary, and track any movement of such equipment during performance of the contract. The List must include:
- Identification and location of any controllers, relays, sensors, pumps, actuators, Open Platform Communications Unified Architecture devices, and other industrial control system devices, as well as all the IP addresses assigned to the different hardware components, used in performance of the contract.
- An explanation of whether the device is password protected and, if so, whether it can be changed.
- An explanation of whether the device is accessible remotely; and
- Whether multi-factor authentication is present and enabled.
- When requested by the Government, submit a copy of the OT equipment list to the Government.
- Submit a copy of their continuous monitoring strategy for the FIS.
- For FISs categorized as FIPS Publication 199 moderate or high security impact, submit the results of: an annual independent assessment of the security of the FIS, and an annual cyber threat hunting and vulnerability assessment.
- The assessment of the security of the FIS must be an independent assessment that is not conducted by the contractor.
- The cyber threat hunting and vulnerability assessment may be completed by the contractor.
- A small business must submit the results of both assessments, including any recommended improvements or risk mitigations identified for the FIS, to the Government.
- A small business will need at least one employee within an information system occupation series to review and submit the annual assessments to the Government, as well as implement any recommended solutions resulting from the assessments.
- If an entity chooses to conduct the cyber threat hunting and vulnerability assessment on their own, the entity will need at least one subject matter expert in cyber threat hunting and vulnerability assessment, as well as experience with system assessment, analysis, and audit.
Comments are due on February 2, 2024 (see extension of comment period here). Comments are due 60 days after the date of publication. Submit comments in response to FAR Case 2021-019 to the Federal eRulemaking portal at https://www.regulations.gov by searching for “FAR Case 2021-019". Select the link “Comment Now” that corresponds with “FAR Case 2021-019”. Follow the instructions provided on the “Comment Now” screen. Include your name, company name (if any), and “FAR Case 2021-019” on your attached document. If your comment cannot be submitted using https://www.regulations.gov, call or email the points of contact in the FOR FURTHER INFORMATION CONTACT section of the proposed rule document for alternate instructions.
.webp)
View related posts
FedSubK Feature: Be Seen! Why Your SBS Profile is So Important
UPDATED November 2025 to incorporate changes from the SBA Dynamic Small Business Search (DSBS) to the new SBA Small Business Search (SBS)
I’ve posted on LinkedIn a lot recently about ways to be seen as a little fish in the big pond that is the Federal marketplace. Every GovCon consultant has a take on the best entry points with agencies. My take is there is only one place small businesses MUST put their best foot forward to be quickly and easily seen by Federal buyers for potential opportunities and influence small business set-asides.
The Small Business Administration (SBA) Small Business Search (SBS) is THE PLACE you must be on your A-game.
The Small Business Search (SBS) is a database in which SBA houses information on the current pool of certificated small businesses. Presently, small businesses that do not have certifications or are self-certified, may also create a profile in this database. The SBS is used by contracting officers, small business specialists, large prime contractors, and other small businesses looking for teaming partners to find small businesses that can help meet Federal requirements and identify businesses that can help the Government (or a prime contractor) meet its small business goals. SBS is one of the first--and often only--sources used in market research by agencies to determine the numbers of small businesses able to provide products or services by North American Industry Classification System (NAICS) code.
You can see why this might be an important place to pay attention to, eh?
Businesses have forgotten about the SBS in the last few years because SAM.gov no longer sends small business registrants directly to SBS at the end of their registration to complete the profile like it used to. I HUGE bummer. Businesses now must wait for their SAM.gov registration to be activated, then they can establish an SBA SBS account, claim their entity record, and fill in their company profile in the SBS system. Federal buyers are looking for detailed information from SBS to use as part of their market research efforts.
SBS isn’t only for market research.
Even more importantly, the SBS shows Federal buyers the status of any pending certification applications for the purpose of determining whether you are eligible to compete for a set-aside action. For example, an Economically Disadvantaged Woman Owned Small Business (EDWOSB) can still submit an offer for an WOSB set-aside even with a pending application for certification showing in the SBS. Contracting Officers often use SBS as a source to confirm the socioeconomic certification status and 8(a) program participation along with SAM.gov.
While MySBA Certifications automatically sends socioeconomic certification status to SAM.gov and updates the requisite reps and certs to reflect the correct socioeconomic status, recently it has taken weeks for that migration to occur. WOSBs and EDWOSBs have reported not seeing their correct socioeconomic status reflected in their SAM entity record.
Businesses should always check their SAM entity record to ensure that the proper status is shown within a reasonable time after receipt of an active certification status; usually within 14 business days. If the record is not accurately reflected, you can contact answerdesk@sba.gov or the SBA socioeconomic program under which your business was certified for assistance. If a Contracting Officer says that your SAM record does not reflect the status claimed, ask the Contracting Officer to check SBS for the more accurate information because of these delays.
So now let’s talk about BEING SEEN in SBS and walk through each part of the registration.
Understanding how to maximize the fields in SBS is how you can make the best possible first impression so that Federal buyers want to learn more about YOU!
The Key Words
Often businesses pluck these from thin air and over-generalized based on what they think the Government wants to see. Key words need to reflect and incorporate aspects of your primary NAICS, secondary NAICS, and what you can provide under those NAICS. If you use key words that don’t reflect your primary NAICS, you’ll leave the Government scratching their head about you. They won’t understand the message you’re sending about your company. Be consistent and specific with key words while tying into your NAICS codes in order to leave the best impression. You have 500 characters -- use them wisely.
The Website
Be sure that you include the URL for any website you have. Make it be more than a landing page. It needs to tell your story. It needs to include information about your company, what you sell, past customers, and products or solutions you provide. And most of all, it must be polished. Scrub your site hard for formatting, typos, grammatical errors, etc. Acquisition personnel using the SBS will often quickly click on the site to see just how polished it is. When it looks good, they get the impression you know your stuff and pay attention to details.
The Capabilities Narrative
This is the written equivalent of your elevator pitch. This section should include all the things you’d include in that two-minute speech. Hit hard on what your company specialized in and its core product or service areas. Show the business’s focus and avoid being all over the map by overpromising on the breadth of work the business performs.
Near the end of the capabilities narrative, list any socioeconomic certifications Why not lead with it? Because that certification is only part of your business, and it alone does not get you interest from the Contracting Officer. End with that information so the Contracting Officer can easily see it in a quick query and get your business into their market research counts.
Lastly, identify any government contract vehicle or GSA Schedule your company may hold. If you can catch their eye that you have an existing GSA Schedule or your business participates in the 8(a) program, you’ll get counted and likely get a look in terms of the Contracting Officer wanting to know more. If they need to meet a socioeconomic goal, they can see quickly. You’re helping the Contracting Officer do their job. They LOVE that! (And made another great first impression!)
SBS now also includes a field to add a link to your online capabilities statement. Use it!
“Extras” You Should Never Skip
Performance History
I cannot say this enough…if you history doing work for any Government or quasi-Government entity at any level -- Federal, State, or Local level -- list them! Don’t play the “they’ll see that when I propose” game. Showing performance history—even if it is minimal or commercial and not Government--helps. How? It proves the viability of the business and the size and types of projects you’ve completed. Those goes a long way to determining eligibility of the business based on performance on same / similar work of a same / similar dollar value (“Rule of Two” stuff – you can read more about that here).
Review Your Profile
Go out to the SBS site and use the filters for your NAICS, business name, geographic location, and business types. Make sure your show up and see how your profile measures up to your competitors. Look at their records and see what they included that you haven’t. Use the good ideas of others, but don’t plagiarize. Contracting Officers will see that and that won’t look good for either of you.
Keep Evolving
Your SBS isn’t something that you can just set and forget either. Make reviewing your profile in SBS something you do when you renew your SAM.gov registration every year. If something major changes in your business focus, NAICS, or socioeconomic status, make associated changes in SBS.
What GovCon doesn't always talk about -- The SBS Influence
When doing market research and trying to determine if an acquisition should be set-aside for small businesses, the Government is not only counting about the numbers of small businesses that claim they can do the work under a NAICS code in SBS. They are analyzing your SBS profile to see if your business could be one of the "... two or more responsible small business concerns that are competitive in terms of fair market prices, quality, and delivery" and they have “…a reasonable expectation of obtaining an offer…” from you. (There’s that pesky “Rule of Two” again.)
In other words, based on what they see, could you submit a proposal likely to win? And how does a Contracting Officer determine that? Simply put... the your answers to everything we just covered.
Completing your profile helps tip the market research scales toward a small businesses set-aside and possibly a specific socioeconomic set-aside. If you're all over the map in your SBS narrative, the Government will not consider you viable eligible contractor towards that “Rule of Two” and could possible choose to go another way with their acquisition strategy, away from a small business set-aside. Or worse, they set it aside but remember your name from the market research as one of the businesses that didn’t make their initial market analysis cut.
Influence where you can! SBS is the place where you have a lot of influence!
Have I convinced you to get out there and create or update your SBS profile yet?
While the system is no longer got the word "Dynamic" in the title, don't forget its meaning. Life is dynamic, business is dynamic, and your SBS profile should still be dynamic, too. Get it completed ASAP. You can’t afford not to.
Remember again, SBS IS WHERE FEDERAL BUYERS GO TO FIND SMALL BUSINESSES and where other small businesses go to find teaming partners and subcontractors.
Get out there, GET NOTICED, BE SEEN, and STAY DYNAMIC!
(former title: FedSubK Feature: Be A Dynamic Small Business!)
Ask for the Meet and Greet. Make the Phone Calls.
I sat in on a session yesterday where another GovCon was talking about watching SAM for opportunities. But if you are doing that, you are going to be too late, unfortunately. Small businesses must start ahead of any opportunity announcement and connect with agency personnel early, before the opportunity is announced in order to be known and help shape future acquisition strategies. It got me thinking about my days as a Branch Chief and Chief of Contracting and the small businesses I know that are still flourishing today.
One particular company stands out. They were a new 8(a) firm that asked for a meet and greet. They had no federal work but showed a level of understanding about our mission that made an impression. While our acquisition strategies were in place already for the end of FY run of award, I told them I'd keep them in mind new projects crossed my desk. Every month, without fail, I would get a call or a quick drop in chat from this 8(a) to say hello and briefly inquiry about any possible upcoming projects. During one of the in-person chats about a year after our first meeting, our chief estimator popped his head in my office quickly to apologize for a few late government estimates. He said he was going crazy with end of FY and lack of staff. The 8(a) took the opportunity and said, "We can help with that." While it wasn't ideally the work the 8(a) was looking for, that simple pivot and flexibility, along with the relationship building done to that point, led to a small 8(a) sole source contract for cost estimating support. It was their first federal contract. That small contract quickly turned into a much larger 8(a) sole source contract for the same work that reached its max capacity 18 months earlier than anticipated. That led to 8(a) contracts for environmental the work the company ideally wanted, then graduation from the 8(a) program, and successfully competing on SB set-asides throughout the region and getting their own (successful) GSA Multiple Award Schedule contract.
Ask for the meet and greet. Make the phone calls. This former CO is here to tell you that acquisition personnel and SB Specialists EXPECT to hear from businesses. Large businesses aren't shy about calling (trust me). They may not be able to tell you much, but the relationship building and continual reminder that you know what they are looking for and can fill a niche--even when it's not your first choice of work--is KEY.
Small businesses must start ahead of any opportunity announcement and connect with agency personnel early, before the opportunity is announced in order to be known and help shape future acquisition strategies.
FedSubK Feature: What is Buying In?
"Buying in". Do you know what that is? Let's illustrate it with a little story...
Once upon a time an agency leader🤴 was looking around at things to make 🌟efficient.🌟 They got the idea that every agency should have the same widgets🔅 their agency had.
The agency leader🤴 called up a widget company👩🔧 and said, "We are interested in your widgets. 🔅What kind of discount can you give us?"
The widget company👩🔧 offers a discount 📉 because they know this agency🤴 not only buys for themselves but may buy for other agencies🫅🤴👸 where a highly trusted widget competitor👨🔧 presently has the work.
The widget company👩🔧 was "buying in" -- offering unrealistic discounts📉 that made the price unrealistically low not only for the current effort but also to influence the purchasing decisions on future buys. Then prices usually up 📈 again over time.
Depending on when "buying in" happens there could also be questions related to compliance with the Competition in Contracting Act (CICA) and possible other violations.
This is why agency announcements that management has made a deal for "$1 a license" and other such management interference is of concern. 🚨 Management plays the numbers game. I'm not saying numbers aren't important, but let's just say... there is a real reason why management typically does not hold contract signature authority. 😬😉
The Government is supposed to keep things fair and do its due diligence. But it's falling for the oldest trick in the book.
Risk, intent, compliance with statutory requirements, misunderstanding of requirements, and comparable market pricing must be evaluated when the Contracting Officer has reason to believe a proposed price is unrealistically low price. But are they?
If a contract isn't in place, there there is still a need to follow appropriate competition rules before a handshake deal. If a contract is already in place, there are things to consider when new discounts appear to be unrealistic including the risk of continued performance, depending on the type of product or service being purchased.
The Government gets a quick win to lock in a low rate, saving some money now. That's called the short game. Government buyers getting blurry-eyed over unbelieveably low prices and don't do the long-term analysis.
But I'll bet you a dollar the company is playing the long game. They are watching and waiting, getting to know your needs and asking loads of questions. "When do you use my widget most?" "Who buys the most widgets?" "When do you typically buy widgets?" And then as fast as they dropped the price, they raise it again on you when you can't afford to make a change -- like at an end of fiscal year. That's how they get locked in and receive perpetual contracts.
BTW...the fairy tale above is a true story. I've had new politicals and new leadership / commanders trot companies into my office saying "Company ABC here says they want to sell us "widgets" at a huge discount compared to what we're paying or others are paying now."
Well...okay then.
As a Contracting Officer, whether I could even begin to entertain that idea depends on several things. It's not an automatic "yes". You could replace "widgets" with just about any product or service and it's probably happened to a Contracting Officer somewhere. Especially as new Administrations come into Government.
The stories in the news that made me think -- "Huh, are they buying in?" are the Axios story "Anthropic wants to sell Claude to the Government for $1". (https://www.axios.com/pro/tech-policy/2025/08/05/ai-anthropic-government-sale-dollar) and FedScoop story "Federal agencies can buy ChatGPT for $1 through GSA deal" (https://fedscoop.com/openai-chatgpt-enterprise-federal-government-gsa-deal-general-services-administration-anthropic/).
My husband (also a retired Contracting Officer) and I look at each other often during the news now and, based on the reported discount or price alone, we know that company is likely "buying in". That's based on our combined 72 years of Fed experience and our Contracting Officer "Spidey sense" from having been around the block a few times. But these deals just the most recent in a series of deals GSA is making with companies since the new Administration came to town. OneGov is the program GSA is, in my former Contracting Officer opinion, using to tout savings under for the press releases. But it may come back later to be a big mistake. I hope I'm wrong.
Program/Project Managers and Contracting Officers AND the competition to these companies...LEARN about it and WATCH for it. It's on the rise.
(And don't get me started on having to argue with new politicals, leadership, and commanders about why I can't terminate a current contract and then turn around and give the same work to another contractor at their unrealistic lower price.🙄😱 That's a topic for another time.)
The practice of "buying in" is becoming more common now. Learn about it and how to spot it.
