Understanding Cybersecurity Maturity Model Certification (CMMC)
[ZOOM EVENT] Wednesday, June 23, 2021 @ 11AM-12PM ET


Federal Acquisition Regulation Goes Into Effect Today

Prime contractors should take heed

Today is the big day the Federal Acquisition Regulation (FAR) takes effect. Prime contractors need to ensure they are meeting the regulatory requirements in order to retain their aerospace, military, and other contracts or they could face real financial consequences.

In August of 2019, the United States Department of Defense (DoD), the General Services Administration (GSA), and the National Aeronautics and Space Administration (NASA) set an interim rule amending the FAR to prohibit the use of telecom and surveillance equipment from Chinese companies due to an “unacceptable level of risk for the government,” according to a notice posted on the Office of The Federal Register website Aug. 13, 2019.

Government Contracts Could Be Impacted
Effective today, Aug. 13, 2020, businesses contracting with the DoD, GSA, or NASA must manage their supply chain when it comes to fulfilling their product and service orders with the U.S. government. Additionally, Chinese companies can no longer be used as suppliers for telecommunications and surveillance equipment by contractors and subcontractors supplying goods and services through government contracts. Furthermore, the regulation seeks to address certain threats by implementing new reporting requirements on contractors and subcontractors.

What the Statute Says
As of today, acquisition.gov for FAR 52.204-24 shows “Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) prohibits the head of an executive agency… from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract.”

Covered Telecommunications Equipment & Services
According to The Federal Register, the Daily Journal of the United States Government, “The statute covers certain telecommunications equipment and services produced or provided by certain Chinese companies or their affiliates.” The FAR 52.204-25 regulation outlines that equipment, components, or services produced or provided by the following companies are strictly prohibited:

• Huawei Technologies Company or ZTE Corporation (or any subsidiary or affiliate)
• Hytera Communications Corporation
• Hangzhou Hikvision Digital Technology Company
• Dahua Technology Company (or any subsidiary or affiliate)
• “Any entity owned or controlled by, or otherwise connected to, the government of a covered foreign country” which is defined as the “People’s Republic of China.”

Under certain circumstances, the regulation does allow (per section 889) the head of an agency to grant a one-time waiver on a case by case basis for up to a one-year period that must end before Aug. 13, 2021. In order to obtain such a waiver, a “compelling justification for the additional time to implement” must be submitted and there is no guarantee the waiver will be granted.

Reporting Requirements
This regulation also requires companies with new or pending government contracts to submit with each bid a list of equipment or services to be provided. While the regulation exempts commercial items such as commercial off-the-shelf (COTS) items including surveillance cameras used for security purposes, it is highly recommended to include COTS items when moving toward compliance. Each agency, based on its specific mission and supply chain risks, may also determine additional information a contractor must provide in order to be considered for a contract.

To reduce the burden on contractors when it comes to providing information, the DoD, GSA, and NASA have made updates to the System for Award Management that allows contractors to submit whether or not they sell covered equipment, systems, or services on an annual basis rather than by each bid proposal. If a contractor reports that they do use covered equipment or services, they would be required to provide further details on a contract-by-contract basis.

The Impact of FAR
The FAR Council recognizes that this regulation could impact the operations of federal contractors in a number of industries from healthcare and education to automotive, aviation, and aerospace. Manufacturers that provide COTS items and those that provide building management, billing and accounting, and freight services may also be impacted.

The council realizes that the impact may be wide-reaching and is still assessing the impact this regulation is having on contracts, manufacturers, and businesses providing goods and services.
“For example, in filing to the Federal Communications Commission (FCC), the Rural Wireless Association estimated that at least 25 percent of its carriers would be impacted,” according to the Federal Register document regarding FAR. “The impact and costs to all industry sectors, including COTS items manufacturers, resellers, consultants, etc. are not well understood and is still being assessed.”

While this regulation has gone into effect today, the FAR Council is still seeking public comments regarding the impact of FAR. After considering comments, a final rule will be issued.

The Risk of Non-Compliance & Planning for Compliance
Should a contractor or subcontractor fail to comply with FAR, the government will view it as a breach of contract which can lead to a cancellation or termination of the contract. This would ultimately have financial consequences for the business. It could even negatively impact future bids with government agencies as well.

This means it is imperative for contractors and subcontractors to develop a robust plan for compliance. To best achieve compliance, the FAR Council recommends contractors and subcontractors take the following steps:

• Familiarize yourself and your staff with the FAR regulation.
• Commit to corporate enterprise tracking to examine relationships with subcontractors and suppliers.
• Educate your company’s purchasing, procurement, and materials management staff so they understand your business’s compliance plan.
• Remove and replace existing covered telecommunications equipment or services and ensure new equipment and services are compliant.
• Communicate with the government about the use of covered telecommunications equipment or services immediately upon discovery of its use during the course of a contract.
• For those contractors and subcontractors with waivers, develop a plan to phase out the use of covered telecommunications equipment or services and share that plan with the government.

For more information about how the FAR regulation impacts your business or for assistance in achieving complete compliance, contact the cybersecurity and regulatory experts at Dox Electronics at (585) 473-7766.

Share This Posting
Copyright ©   DoxWeb Design & SEO by Scriptable Solutions