The FAR Council’s Proposed Cybersecurity Overhaul: Lots of Questions, but Only Some Answers

In what can best be described as a tsunami of cybersecurity regulation, the Federal Acquisition Regulation (FAR) Council—consisting of the Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA)—issued two proposed rules on October 2, 2023. If implemented, the proposed rules would drastically alter existing cybersecurity and incident reporting obligations for Government Contractors. Even if these proposed rules are not fully implemented in their current form (as is likely), they are a harbinger of cybersecurity regulation to come. While the contours of the final rule remain uncertain, it is clear that gone are the days of agency-siloed cybersecurity requirements. Government-wide cybersecurity regulation has arrived.

As drafted, the proposed rules will apply to all contractors that use information technology in the performance of a contract, including those that sell commercial and commercial off-the-shelf (COTS) products, and will flow down to subcontractors as well. Any company whose products or services are sold to any agency of the federal Government should understand the proposed rules, how they might impact the company’s operations, what compliance obligations they impose, and the potentially serious ramifications of non-compliance.

Read the full blog post.