1 00:00:00,000 --> 00:00:01,324 Here's a number to start with. 2 00:00:01,649 --> 00:00:05,991 More than a dozen separate FAR provisions and clauses on security have been merged 3 00:00:06,037 --> 00:00:06,757 into four. 4 00:00:07,140 --> 00:00:12,388 That's the Revolutionary FAR Overhaul at work, driven by Executive Order 14275 and 5 00:00:12,504 --> 00:00:15,139 OMB memo M 25 26. 6 00:00:15,650 --> 00:00:20,480 Paul, is this a relaxation of the rules, or just a tidier filing cabinet? 7 00:00:20,500 --> 00:00:24,580 Tidier filing cabinet, and I'd add that it clarifies authority. 8 00:00:24,669 --> 00:00:28,260 Consolidating clauses does not relax enforcement. 9 00:00:28,340 --> 00:00:29,540 Here's the mechanism. 10 00:00:29,620 --> 00:00:35,780 Under Class Deviation RFO 2025 40, effective November 3, 2025, 11 00:00:35,900 --> 00:00:42,900 rules that lived in FAR subparts 4.4, 4.19, 4.20, 12 00:00:42,980 --> 00:00:49,860 4.21, 4.22, 4.23 and 25.7 now sit in 13 00:00:49,960 --> 00:00:51,300 FAR Part 40. 14 00:00:51,400 --> 00:00:58,340 One provision, 52.240 90, handles the representations and certifications. 15 00:00:58,420 --> 00:01:04,740 Clause 52.240 91 covers Kaspersky, Section 889, 16 00:01:04,820 --> 00:01:10,660 TikTok, FASCSA orders, the drone prohibitions and the foreign source restrictions. 17 00:01:10,751 --> 00:01:17,620 Clause 52.240 92 replaces 52.204 2 for 18 00:01:17,678 --> 00:01:24,660 classified work, and 52.240 93 replaces 52.204 19 00:01:24,740 --> 00:01:28,900 21 for basic safeguarding of Federal Contract Information. 20 00:01:28,917 --> 00:01:33,805 And the proposed rule from June 23, 2026 adds a uniform standard for how hard a 21 00:01:33,851 --> 00:01:35,279 contractor has to look. 22 00:01:35,292 --> 00:01:38,572 Right, a uniform reasonable inquiry standard. 23 00:01:38,759 --> 00:01:43,452 My interpretation of this is that you review information in your possession that is 24 00:01:43,503 --> 00:01:44,332 accessible. 25 00:01:44,465 --> 00:01:48,092 It does not require an internal or third party audit. 26 00:01:48,156 --> 00:01:53,132 That also fixes an old gap in Section 889, where you had to inquire before 27 00:01:53,196 --> 00:01:57,772 certifying what you use, but not before certifying what you provide. 28 00:01:57,852 --> 00:02:02,252 The proposed rule also carves out commercial sales, maintenance, 29 00:02:02,322 --> 00:02:08,092 testing, warranty services and employees' personal equipment from the Section 889 30 00:02:08,172 --> 00:02:09,292 use prohibition. 31 00:02:09,356 --> 00:02:13,692 Keep in mind that this is a proposed rule, so the text can still move. 32 00:02:13,708 --> 00:02:15,833 Now the part that touches data directly. 33 00:02:16,343 --> 00:02:21,092 Subpart 40.3 and the new Controlled Unclassified Information clause. 34 00:02:21,125 --> 00:02:23,605 This is where my upstream complaint gets some relief. 35 00:02:23,712 --> 00:02:27,125 Scope has been driven by the marking, not by the information. 36 00:02:27,225 --> 00:02:30,325 The new approach narrows CUI. 37 00:02:30,432 --> 00:02:34,405 It excludes data on your own systems that never came from the government, 38 00:02:34,445 --> 00:02:38,565 federally funded basic and applied research at academic institutions, 39 00:02:38,605 --> 00:02:42,405 and information that no law or policy requires you to safeguard. 40 00:02:42,474 --> 00:02:49,285 Clause 52.240 7 and its solicitation notice, 52.240 6, come with a Standard 41 00:02:49,381 --> 00:02:52,805 Form, currently called SF XXX. 42 00:02:52,869 --> 00:02:56,085 Part A says whether you handle CUI at all. 43 00:02:56,165 --> 00:02:59,925 Part B says whether it sits in a federally controlled facility. 44 00:03:00,005 --> 00:03:06,485 Part C covers non federal facilities, CUI Basic versus CUI Specified, 45 00:03:06,525 --> 00:03:08,325 and who is responsible for marking. 46 00:03:08,437 --> 00:03:15,125 Part D says whether NIST SP 800 172 enhanced controls apply to a 47 00:03:15,169 --> 00:03:17,605 critical program or high value asset. 48 00:03:17,625 --> 00:03:20,504 So the contractor gets a written boundary instead of guessing. 49 00:03:20,542 --> 00:03:21,262 Exactly. 50 00:03:21,342 --> 00:03:26,622 And a contractor that spots unmarked or mismarked government information has to tell 51 00:03:26,662 --> 00:03:30,142 the contracting officer within 72 hours. 52 00:03:30,178 --> 00:03:34,942 Incident reporting uses the same 72 hours, counted from discovery. 53 00:03:34,962 --> 00:03:40,462 The 2025 proposal said 8 hours, which was unworkable for a small shop. 54 00:03:40,512 --> 00:03:45,262 Reports go to CISA for civilian work and to DIBnet for DoD. 55 00:03:45,322 --> 00:03:49,822 FedRAMP Moderate cloud providers that follow FedRAMP incident procedures don't 56 00:03:49,891 --> 00:03:50,862 report twice. 57 00:03:50,955 --> 00:03:55,822 Contractors also have to preserve forensic images for at least 90 days. 58 00:03:55,833 --> 00:03:56,797 But here's the wrinkle. 59 00:03:57,238 --> 00:04:01,592 The civilian clause points at NIST SP 800 171 Revision 3. 60 00:04:01,625 --> 00:04:08,505 And defense contracts still enforce Revision 2 under DFARS 252.204 7012 and 61 00:04:08,625 --> 00:04:09,665 CMMC. 62 00:04:09,721 --> 00:04:11,225 That's the revision split. 63 00:04:11,345 --> 00:04:14,985 A company serving both markets maintains two baselines. 64 00:04:15,045 --> 00:04:20,185 The proposed rule's move to Revision 3 may signal where DoD heads later, 65 00:04:20,205 --> 00:04:21,465 but that's interpretation. 66 00:04:21,545 --> 00:04:24,665 The deviation text today says Revision 2. 67 00:04:24,667 --> 00:04:26,234 Let's move to the defense side. 68 00:04:26,408 --> 00:04:31,958 Class Deviation 2026 O0025, now at Revision 3, signed September 3, 69 00:04:32,016 --> 00:04:33,119 2026. 70 00:04:33,363 --> 00:04:35,162 What did that revision actually add? 71 00:04:35,167 --> 00:04:38,687 Mostly statutory material you can't negotiate away. 72 00:04:38,777 --> 00:04:45,727 Section 853 of the FY25 NDAA bars buying covered semiconductor products 73 00:04:45,787 --> 00:04:50,607 and services from any entity that knowingly supplies them to Huawei. 74 00:04:50,727 --> 00:04:57,327 Section 803 of the FY24 NDAA and Section 836 of 75 00:04:57,487 --> 00:05:03,887 FY25 bar contractors from selling, licensing or transferring covered 76 00:05:03,936 --> 00:05:10,127 individually identifiable DoD employee data to anyone but the federal government. 77 00:05:10,307 --> 00:05:15,247 The exceptions are what's needed to perform the contract, a waiver, 78 00:05:15,300 --> 00:05:18,287 or where law otherwise authorizes the transfer. 79 00:05:18,447 --> 00:05:24,927 The drone prohibitions under FY20 Section 848 and FY23 Section 80 00:05:25,087 --> 00:05:27,087 817 are in there too. 81 00:05:27,220 --> 00:05:32,287 There's also a court order involving Alibaba Group, dated July 5, 82 00:05:32,367 --> 00:05:38,127 2026, that temporarily waives one lobbying prohibition under 10 83 00:05:38,287 --> 00:05:39,407 U.S.C. 84 00:05:39,487 --> 00:05:40,927 4663. 85 00:05:41,107 --> 00:05:46,687 For every other purpose, contracting officers still treat Alibaba as a Chinese 86 00:05:46,740 --> 00:05:47,887 military company. 87 00:05:47,917 --> 00:05:49,020 And CMMC. 88 00:05:49,078 --> 00:05:51,214 People hear suspension and think cancellation. 89 00:05:51,250 --> 00:05:53,650 A suspension is not a repeal. 90 00:05:53,710 --> 00:05:59,970 The DoD CIO memo of July 13, 2026 suspended the November 91 00:06:00,210 --> 00:06:04,130 2026 move to Phase 2, the third party assessments. 92 00:06:04,228 --> 00:06:06,850 Revision 3 carries that forward. 93 00:06:06,921 --> 00:06:12,330 Contracting officers must amend solicitations and modify existing contracts, 94 00:06:12,381 --> 00:06:17,170 before the next option exercise or at the next scheduled administrative 95 00:06:17,232 --> 00:06:20,450 modification, to remove those requirements. 96 00:06:20,530 --> 00:06:24,690 Level 1 Self and Level 2 Self assessments are permitted. 97 00:06:24,790 --> 00:06:30,450 But the baseline of NIST SP 800 171 Revision 2 under 98 00:06:30,610 --> 00:06:36,370 252.204 7012 stays fully in force. 99 00:06:36,430 --> 00:06:41,090 Analysts like Pivot Point Security point out that the revision doesn't say whether 100 00:06:41,143 --> 00:06:45,890 Phase 2 returns, so avoid conclusions the text doesn't support. 101 00:06:45,917 --> 00:06:48,889 What about the self assessment score everyone has been posting? 102 00:06:48,917 --> 00:06:51,077 This is an area with issues for sure. 103 00:06:51,210 --> 00:06:57,877 Clauses 252.204 7019 and 7020 104 00:06:57,977 --> 00:07:04,917 are replaced by 252.240 7997, and the new 105 00:07:04,974 --> 00:07:10,277 clause defines only Medium and High assessments, both government performed using 106 00:07:10,317 --> 00:07:14,517 NIST SP 800 171A. 107 00:07:14,577 --> 00:07:18,757 The contractor only basic assessment isn't in the clause text. 108 00:07:18,917 --> 00:07:24,597 A commentary from CMMC Compliance describes the clause as built around validation 109 00:07:24,677 --> 00:07:26,197 rather than attestation. 110 00:07:26,357 --> 00:07:32,917 So even if CMMC lets you self assess, a contract with 7997 lets the government test 111 00:07:32,949 --> 00:07:33,957 your claims. 112 00:07:34,021 --> 00:07:37,477 Brilliant basics matter, but so does proof. 113 00:07:37,539 --> 00:07:41,157 Policies, audit logs, system configurations. 114 00:07:41,290 --> 00:07:45,957 An aspirational plan of action and milestones is not evidence. 115 00:07:45,958 --> 00:07:47,351 What about subcontractors? 116 00:07:47,734 --> 00:07:50,230 Flowdown is where small suppliers get squeezed. 117 00:07:50,250 --> 00:07:57,210 Clause 52.240 7 flows down without substantive change, other than party names and 118 00:07:57,230 --> 00:08:02,810 the relevant SF XXX details, to any subcontractor handling CUI. 119 00:08:03,010 --> 00:08:08,410 Subs report incidents directly to CISA or DIBnet, then notify the contracting 120 00:08:08,470 --> 00:08:09,930 officer and the prime. 121 00:08:10,150 --> 00:08:16,810 One more practical point from the GSA and DoD implementation materials: SAM.gov 122 00:08:16,910 --> 00:08:18,490 may lag the policy. 123 00:08:18,770 --> 00:08:24,730 Rely on the actual solicitation and contract clauses, not an outdated representation 124 00:08:24,810 --> 00:08:26,250 in an external portal. 125 00:08:26,250 --> 00:08:28,479 And the last piece, Subpart 40.1. 126 00:08:28,500 --> 00:08:34,820 FAR 40.102 requires executive agencies to share relevant supply chain risk 127 00:08:34,880 --> 00:08:39,700 information with the Federal Acquisition Security Council when there's a reasonable 128 00:08:39,780 --> 00:08:43,100 basis to conclude a substantial risk exists. 129 00:08:43,193 --> 00:08:44,900 So the practical step is simple. 130 00:08:45,040 --> 00:08:51,460 Map your data, confirm your scope against the SF XXX, keep evidence current, 131 00:08:51,500 --> 00:08:54,100 and read every clause in your contract.