Insights

On June 9, 2025, the General Services Administration (GSA) Federal Acquisition Service (FAS) quietly announced that Transactional Data Reporting (TDR) would be exiting “pilot” status; under Refresh 27 to the Multiple Award Schedule (MAS), TDR will be mandatory for all eligible Special Item Numbers (SINs), effective beginning in the next sales reporting quarter after each contractor accepts the modification, with remaining SINs to be added in future refreshes.  

On May 12, 2025, the Defense Counterintelligence and Security Agency (DCSA) released a new SF-328[1] consisting of 9 questions and 6 pages of instructions that detail the types of supporting documentation requested and identify information required by different responding entities (e.g., corporate, non-profit, academic, etc.). With this SF-328, DCSA is seeking certain frequently requested information and documents with initial SF-328 submissions rather than obtaining these documents through communications or revised SF-328 submissions. Additionally, when completed, the new SF-328 is considered Controlled Unclassified Information (CUI).

On May 7, 2025, the Defense Counterintelligence and Security Agency (DCSA or the “Agency”) announced the approval[1] of a revised and expanded Standard Form (SF) 328, Certificate Pertaining to Foreign Interests. Contractors and subcontractors engaged in work involving classified information use the SF-328 for disclosures relating to foreign ownership, control, or influence—and the form will soon be required for contractors and subcontractors in the unclassified space for certain covered contracts. Publication of the updated form has not yet occurred but is expected as soon as this weekend (May 10-11). New SF-328 forms will be required for initial and changed condition packages initiated on or after May 12 according to a National Industrial Security System (NISS) communication today.

On March 20, 2025, the White House issued Executive Order (“EO”), “Eliminating Waste and Saving Taxpayer Dollars by Consolidating Procurement,” to consolidate domestic civilian contracting for “common goods and services” within one agency—the General Services Administration (“GSA”). The EO defines “common goods and services” as those described in the Category Management system first developed as part of a previous effort, dating back to 2014, to coordinate spending across the government.

On February 21, 2025, President Trump issued a National Security Policy Memorandum (“NSPM”) announcing the Administration’s “America First Investment Policy” (the “Investment Policy”)[1] affirming the United States’ commitment to open investment while safeguarding national security. Aimed at promoting investment in the United States from allied countries while imposing stricter measures on both inbound and outbound investments from “foreign adversaries,” the Investment Policy incentivizes foreign investment in the United States by announcing a “fast track” process “to facilitate greater investment from specified allied and partner sources in United States businesses involved with United States advanced technology and other important areas.” The NSPM defines “foreign adversaries” to include the People’s Republic of China (the “PRC” or “China”), including Hong Kong and Macau, Cuba, Iran, North Korea, Russia, and the Maduro regime in Venezuela.[2]

On January 14, 2025, the U.S. Federal Highway Administration (FHWA) published a Final Rule terminating a longstanding manufactured products waiver as part of the agency’s continued implementation of the 2021 Infrastructure Act’s Build America, Buy America (BABA) provisions.  The waiver, originally established in 1983, limited application of the FHWA’s Buy America requirements to only iron and steel products, while permitting recipients of FHWA financial assistance to turn to foreign sources for more complex products.  However, in accordance with the BABA’s express direction for agencies to review and reconsider waivers of general applicability such as the manufactured products waiver, the FHWA determined that its original rationale for the waiver was no longer applicable, and it proposed revised regulations to harmonize its Buy America program with the requirements of BABA (previously discussed here).

On January 2, 2025, the U.S. Department of Defense (DoD) updated the 1260H List of entities identified as “Chinese military companies” (CMC) operating in the United States, as required by section 1260H of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2021 (Section 1260H), adding new entities and removing others.  The updated 1260H List now includes 76 entities. 

On December 23, 2024, the Servicemember Quality of Life Improvement and National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2025 (FY 2025 NDAA) (P.L. 118-159) was signed into law.  The final FY 2025 NDAA takes a narrower approach to acquisition policy and supply chain changes than watchers expected, but it still makes some consequential changes for contractors.  Read on as Crowell & Moring’s Government Contracts group discusses the FY 2025 NDAA’s new supply chain restrictions and requirements, changes to bid protest jurisdiction, cybersecurity requirements, and more.

On Monday, November 18, 2024, the Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”) announced that it had finalized the regulatory changes previewed in April that will enhance certain CFIUS procedures and sharpen its penalty and enforcement authorities.[1]  The changes go into effect on December 26, 2024 and as described in more detail below: (a) expand the types of information that CFIUS can require transaction parties and other persons (i.e., third-parties) submit when engaging with them on transactions that were not filed with CFIUS; (b) broaden the instances in which CFIUS may use its subpoena authority, including when seeking to obtain information from third persons not party to a transaction notified to CFIUS and in connection with assessing national security risk associated with non-notified transactions; and (c) substantially increase monetary penalties for violations of CFIUS regulations from a maximum of U.S. $250,000 to U.S. $5 million per violation, or the value of the transaction, whichever is greater.

On November 15, 2024, the Department of Defense (DoD) issued a Proposed Rule implementing Section 1655 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019 (P.L. 115-232), over six years after Congress enacted the requirement. 

As Crowell covered in a recent alert, the Department of Defense (DoD) on October 11, 2024 released a final rule (the “Final Program Rule”) formalizing the requirements, assessment processes, and related governance for its Cyber Maturity Model Certification Program (CMMC).

On June 20, 2024, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) announced a Final Determination, pursuant to the Securing the Information and Communications Technology and Services Supply Chain (ICTS) regulations, prohibiting Kaspersky Lab, Inc., the U.S. subsidiary of a Russia-based anti-virus software and cybersecurity company, from providing anti-virus software and cybersecurity products or services in the United States or to U.S. persons (wherever located) because it poses undue and unacceptable risk to U.S. national security. The prohibition also applies to Kaspersky Lab, Inc.’s affiliates, subsidiaries and parent companies (collectively Kaspersky). This is the first time that BIS’s Office of Information and Communications Technology and Services (OICTS) has issued a determination pursuant to the ICTS regulations.

On May 30, 2024, the Department of Defense (DoD) issued a final rule implementing Section 844 of the Fiscal Year (FY) 2021 National Defense Authorization Act (NDAA) and Section 854 of the FY 2024 NDAA by amending DFARS 225.7018-2 and accompanying DFARS clause 252.225-7052, which restrict DoD from acquiring certain metals and magnets from “covered countries” of Iran, North Korea, Russia, and China, to prohibit even earlier inputs in the supply chain from occurring in these countries.  Despite comments discussing the infancy of the domestic market for many “covered materials”—defined as samarium-cobalt magnets, tantalum metals and alloys, tungsten metal powder, and tungsten heavy alloy or any finished or semi-finished component containing tungsten heavy alloy—the final rule expands the restrictions on sourcing covered materials from covered countries.  Currently, the rule requires that covered materials not be melted or produced in covered countries but, effective January 1, 2027, the updated rule prohibits covered materials being mined, refined, separated, melted or produced in one of the covered countries. The expansion of the focus of the prohibition all the way back to where these materials were mined is consistent with the U.S. government’s effort to develop the domestic industrial base for and encourage on-shoring of critical minerals, magnets, and metals.   

On May 13, 2024, the Department of Defense (DoD) issued an instruction implementing policies and procedures that DoD will use to identify contractors (including uncleared contractors) requiring foreign ownership, control, and influence (FOCI) determinations, review related information, and address FOCI concerns.  These policies and procedures were put in place pursuant to Section 847 of the 2020 National Defense Authorization Act[1] (Section 847).  These FOCI requirements will, for the first time, subject many uncleared DoD contractors to rigorous disclosure requirements, scrutiny, and potential mitigation by the Defense Counterintelligence and Security Agency (DCSA). 

On May 3, 2024, the Federal Acquisition Regulation (FAR) Council issued an Advanced Notice of Proposed Rulemaking (ANPR) regarding the prohibition on semiconductors produced by certain Chinese manufacturers, enacted in Section 5949(a)(1) of the James M. Inhofe National Defense Authorization Act (NDAA) for Fiscal Year 2023 (Section 5949) expanding on the prohibition on covered telecommunications equipment and services produced by Huawei, ZTE, and others from Section 889 of the FY 2019 NDAA (Section 889).    

On April 11, 2024, the Committee on Foreign Investment in the United States (“CFIUS” or the “Committee”) announced proposed amendments to its enforcement and mitigation regulations, marking the first substantive update to CFIUS’s mitigation and enforcement provisions since the enactment of the Foreign Investment Risk Review Modernization Act of 2018.  The Committee issued a notice of proposed rulemaking ("NPRM”) that would modify the regulations that apply to certain investments and acquisitions, as well as real estate transactions, by foreign persons as follows:

On March 15, 2024, the General Services Administration (GSA) issued Acquisition Letter MV-2024-01 providing guidance to GSA contracting officers on the use of upfront payments for acquisitions of cloud-based Software-as-a-Service (SaaS).  Specifically, this acquisition letter clarifies that despite statutory prohibitions against the use of “advance” payments outside of narrowly-prescribed circumstances, upfront payments for SaaS licenses do not constitute an “advance” payment subject to these restrictions when made under the following conditions:

On April 1, 2024, the Department of Defense (DoD), General Services Administration (GSA), and the National Aeronautics and Space Administration (NASA) issued a final rule updating the Federal Acquisition Regulation (FAR) to add Part 40 on information security and supply chain security. This first action did not implement any new requirements; however, separate rulemakings will follow to relocate existing information security and supply chain security policies and procedures to the new Part 40. Additionally, new related regulations will be housed in Part 40. These actions suggest that the flow of information security and supply chain regulations is likely to continue unabated for at least the next few years.

Key Takeaways:

On January 31, 2024, the Department of Defense (DoD) updated the 1260H List of entities identified as “Chinese military companies” operating in the United States, as it is required to do at least annually by Section 1260H of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2021.  Section 1260H defines a “Chinese military company” as an entity that is: