Privacy for Everyone! New FAR Rule Imposes Mandatory Training Requirements for Employees Handling PII
Client Alert | less than 1 min read | 12.28.16
After years of consideration, DoD, GSA, and NASA have published a final rule requiring contractor employees who handle personally identifiable information (PII) or work with a system of records to complete initial and annual privacy training that addresses specified elements, including the Privacy Act, working with PII, and the contractor’s incident response plan. The final rule – effective January 19, 2017, and applicable to all contracts including those for commercial items and those below the Simplified Acquisition Threshold – also requires contractors to identify each covered employee, maintain records indicating that its employees have completed the requisite training, and to provide these records to contracting officers upon request.
Contacts
Senior Counsel
She/Her/Hers
Insights
Client Alert | 8 min read | 01.17.25
Cyber For All: Proposed Rule Introduces Government-Wide CUI Cybersecurity Requirements
On January 15, 2025, the FAR Council released a proposed rule (FAR CUI Rule) that would amend the FAR to implement federal government-wide Controlled Unclassified Information (CUI) cybersecurity, training, and incident reporting requirements for government contractors and subcontractors. The rule’s key cybersecurity requirements closely mirror the Department of Defense’s Cyber Maturity Model Certification (CMMC) program (for example, compliance with National Institute of Standards and Technology Special Publication 800-171, Revision 2), but broaden the scope to include contractors and subcontractors working across all federal agencies. The Rule is intended to standardize the handling of CUI by federal government contractors and subcontractors in accordance with Executive Order 13556, including by:
Client Alert | 2 min read | 01.17.25
End of the Road: FHWA Rescinds Longstanding Buy America Waiver for Manufactured Products
Client Alert | 3 min read | 01.17.25
