Insights

On August 26, 2026, President Trump issued EO 14420, prohibiting the acquisition, importation, transfer, or installation of foreign-produced bulk-power system electric equipment that meet certain criteria. The prohibitions are in response to the national emergency declared by President Trump pursuant to the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act (NEA) and based on foreign actors’ potential exploitation of vulnerabilities in U.S. energy infrastructure to harm U.S. national security, including through digital backdoors built into foreign-manufactured equipment that allow remote access and potential sabotage. According to the Order, this threat to national security has become even more acute given the rapid growth of advanced manufacturing, data centers, artificial intelligence, and defense production, which together have exponentially increased U.S. dependence on reliable electricity.

It has been an eventful summer for followers of congressional oversight, with significant implications for individuals and organizations of all stripes. As we move closer to the midterms and then the 2028 general election, private entities both in the U.S. and overseas will find themselves increasingly pulled into the middle of clashes between Republicans and Democrats — and those disputes are inevitable, regardless of election outcome.

A recent U.S. Court of Federal Claims (COFC) decision serves as an important reminder that when the Government Accountability Office (GAO) denies a protest, this is not necessarily the end of the road. Often, contractors retain the right to file a new protest at the COFC, which conducts its own de novo review of the procurement record. This so-called “second bite at the apple” protest is a powerful tool as the COFC’s recent decision in Chugach Logistics & Facility Services JV, LLC v. USA makes clear.

In Appeal of Bahadir (a C&M case), the Armed Services Board of Contract Appeals denied the government’s motion to dismiss in its entirety, ruling in favor of the contractor on both key issues raised by the government. The case arises from a contract for construction work at Al Udeid Air Base in Qatar, under which Appellant alleged government-caused delay and filed certified prolongation claims using a “windows analysis” methodology. The government moved to dismiss, arguing that Appellant failed to state a sum certain for each of what the government characterized as 38 distinct claims, and separately that four claims had not been properly presented to the Contracting Officer. 

GAO’s recent dismissal of the protest in Tyonek Technical Innovations, LLC, B-424364, B-424364.2, June 30, 2026, carries an important lesson for government contractors: if you believe solicitation terms conflict with a statute or regulation, you must raise that challenge before proposals are due—not during discussions or afterwards.

It is well established that “[c]ompetitive prejudice is an essential element of every viable protest.” Yet, for decades, the U.S. Government Accountability Office (GAO) has tempered this requirement with two critical corollaries: protesters need only demonstrate a “reasonable possibility” that they were prejudiced by an agency’s actions, and GAO “will resolve doubts regarding prejudice in favor of the protester.” These principles have been consistent features of GAO’s bid protest jurisprudence for more than 30 years. See, e.g., United Int’l Eng'g, Inc., B-245448, Jan. 29, 1992, 71 CPD ¶ 177.

The FAR Council recently released an updated draft of the much-anticipated “FAR CUI Rule” that would apply to contractors government-wide.

As discussed in more detail here, the U.S. Department of War (DoW) recently issued a memorandum (Memo 26-P-1023, dated July 13, 2026) directing the immediate suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements (Level I and II self assessments are still permitted). Significantly, the memo directs that “all pending and future CMMC implementation milestones across DoW solicitations and contracts are held in abeyance until further notice.” Moreover, the DoW issued a memorandum on implementing these requirements (available here), directing agencies to issue amendments removing CMMC Level 2 and 3 requirements from active solicitations “as soon as practicable.” Contractors should monitor the government’s compliance with this requirement and should be prepared, if needed, to file a bid protest to protect their rights.

The Department of War (DoW) is immediately suspending Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026.

In Utech, Inc. v. United States, No. 24-1586 (Fed. Cir. June 24, 2026), the U.S. Court of Appeals for the Federal Circuit clarified that in most cases, a pre-award protest must be filed before the proposal submission deadline to avoid the Blue & Gold waiver rule.  This decision, while nonprecedential, is in line with U.S. Government Accountability Office (GAO) precedent, which has long held that pre-award protests must be filed before the proposal submission deadline.

On June 25, 2026, the Federal Risk & Authorization Management Program (FedRAMP) launched its Consolidated Rules for 2026, marking a significant turning point in how the U.S. government administers security authorizations of private sector cloud offerings. The Consolidated Rules apply to all variants of the FedRAMP ecosystem, including legacy "Rev5" authorization holders, as well as future certifications under the new 20x program. Importantly, the Rules are intended in part to transition Rev5 authorizations over to 20x, with the Rev5 authorization status expected to terminate by the end of 2028. 

On June 18, 2026, the U.S. Department of Justice (DOJ) announced that LOGZONE Inc., a defense contractor based in Huntsville, Alabama, agreed to pay $507,144 to resolve allegations that it violated the False Claims Act (FCA) by knowingly failing to satisfy cybersecurity requirements in its contracts with the U.S. Department of the Navy. The resolution is the latest action under DOJ’s Civil Cyber-Fraud Initiative and the first publicly reported settlement this fiscal year. It underscores a continued enforcement posture in which noncompliance with contractual cybersecurity obligations serves as the basis for potential FCA liability. Notably, this settlement did not arise from a whistleblower complaint but from a government-initiated assessment, signaling to contractors that proactive government assessments can pose enforcement consequences.

A recent U.S. Government Accountability Office (GAO) decision dismissing three pre-award protests as untimely highlights an important procedural trap for would-be protesters. In Oready, LLC, GAO dismissed three protests filed one business day too late, even though they were submitted prior to the solicitation closing date and time. 

The General Services Administration (GSA) is seeking public comment on a new GSA Regulation clause, 552.239-7001, Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems (LLMs), governing data safeguards and requirements prime contractors must comply with when providing or using LLMs under federal contracts. This updated clause (Revised Clause) reflects substantial revisions from an earlier version released in March 2026 (Original Clause) that faced substantial pushback from industry. Where the Original Clause cast a wide net — imposing obligations broadly across AI systems with little differentiation among supply-chain participants — the Revised Clause is more narrowly tailored. The Revised Clause:

On June 5, 2026, President Trump issued National Security Presidential Memorandum (NSPM) 11 (NSPM-11) to accelerate AI adoption by the U.S. military and intelligence agencies. It directs updated AI management, acquisition, and use policies and seeks to compel AI companies to comply with Trump administration policies.  It calls for expanded training and enhanced security in collaboration with the private sector and orders the “termination for default or for convenience” of government contracts with AI companies that wish to limit how the government uses their products. NSPM-11 could also herald a major change in autonomous warfighting policy by directing the update of the Pentagon’s primary directive on autonomous weapon systems.

On April 8, 2026, the Small Business Administration’s (SBA) Office of Hearings and Appeals (OHA) denied an appeal arguing that a concern’s early submission of its proposal with pricing was an attempt to “end-run the regulations” for when size is determined. In Size Appeal of DecisionPoint Corporation, SBA No. SIZ-6379, OHA confirmed that a company’s size is determined on the date it submits its initial offer which includes price, even if the proposal is submitted in advance of the proposal submission deadline and the offeror becomes large before the provided deadline.

On May 14, 2026, the U.S. Court of Appeals for the Federal Circuit issued a stark warning to government contractors: when a bid protest is filed involving your contract, failing to timely intervene can cost you the ability to defend your award.  In Global K9 Protection Group, LLC v. United States, the Federal Circuit upheld the denial of K2 Solutions, Inc.’s motion to intervene, finding that K2 had waited too long to act despite having sufficient reason to do so.

The Department of Justice (DOJ) and the cross-agency Trade Fraud Task Force have upped the ante by an order of magnitude in the government’s pursuit of customs fraud. On May 1, 2026—only a few months after setting its previous record-high customs-related False Claims Act (FCA) settlement of $54.4 million with Ceratizit USA, LLC—the DOJ shattered that record with a $549.5 million settlement with Perfectus Aluminum Inc., its subsidiary Perfectus Aluminum Acquisitions LLC, and a set of four affiliated warehousing companies. The Perfectus settlement resolves allegations that the defendants violated the FCA by evading antidumping and countervailing duties (AD/CVD). The settlement resolves three separate qui tam complaints filed by two individual relators and the Aluminum Extruders Council, an international industry association. Defendants were previously criminally convicted on charges related to the same scheme, and those convictions were affirmed by the Ninth Circuit in 2024.

On May 7, 2026, the Department of War issued the long-awaited Proposed Rule to implement Section 847 of the FY 2020 National Defense Authorization Act (NDAA) regarding Foreign Ownership, Control or Influence (FOCI) requirements for contractors. The proposed rule would expand the applicability of FOCI reviews, requiring contractors and subcontractors on unclassified “covered contracts” — defense contracts and subcontracts valued in excess of $5 million that are not for commercial products and services — to submit FOCI disclosures to the Defense Counterintelligence and Security Agency (DCSA) for FOCI risk assessment (and as applicable, mitigation) as part of contract award. This would effectively require DCSA assessment and adjudication of FOCI considerations prior to contract award. Thus, both cleared and uncleared defense contractors would be subject to the rigorous DCSA disclosure requirements, scrutiny, and FOCI mitigation. Crowell discussed the Section 847 requirements in a prior alert.

On April 13, 2026, President Trump signed into law the Small Business Innovation and Economic Security Act, which reauthorized the Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs.  These programs are Small Business Administration-sponsored initiatives intended to encourage small business contractors to conduct early-stage research and development (R&D) and help foster technological innovation related to U.S. government needs across several federal agencies, including the Department of War, Department of Energy, National Aeronautics and Space Administration, and National Institutes of Health.  SBIR/STTR are sometimes referred to as “America’s Seed Fund.”  Consistent with that characterization, SBIR contractors performing in the defense and technology space are often the focus of venture capital and private equity interest and investment.