August Update for Government Contractors: National Survey of Cases, Proposed Agency Rules, and Forthcoming Regulations

Agency Regulations:

FAR Amendment: Clarifying Size and Socioeconomic Status Protests for Multiple-Award Contracts

Overview: The Department of Defense (“DoD”), along with other federal agencies, has issued a final rule amending the Federal Acquisition Regulation (“FAR”) to align with the Small Business Administration's (“SBA”) updates on size and socioeconomic status protests. This amendment aims to clarify protest requirements associated with multiple-award contract set-asides.

Key Changes:

• FAR 19.302(d)(1) Revision: Includes a new paragraph (ii)(C), aligning with SBA's regulations, specifying the applicable protest deadline when the contracting officer requests size recertification.

• Protest Deadlines Clarification: Clarifies certain protest deadlines when notification is through non-written means.

• Removes the terms "indefinite-delivery indefinite-quantity (IDIQ)" and "IDIQ," since the definition of multiple-award contract at FAR 2.101 already encompasses IDIQ contracts.

Impact: This final rule will not result in any substantive changes to protest provisions concerning size and status; it merely clarifies the existing protest provisions to remove certain ambiguities.

Effective Date: August 29, 2024

Modernizing FedRAMP: Enhancing Cloud Security for Federal Agencies

Overview: On July 25, 2024, the Office of Management and Budget ("OMB") issued Memorandum M-24-15, signaling potential forthcoming updates to the Federal Risk and Authorization Management Program (“FedRAMP”). FedRAMP is a government-wide program designed to ensure that cloud security providers (“CSPs”) used by federal agencies meet rigorous security standards.

The memorandum is largely aspirational and highlights various goals to modernize FedRAMP by updating its vision, scope, and governance structure to address developments in cybersecurity and the commercial cloud marketplace. These updates replace the previous memorandum issued in 2011. While the memorandum does not directly regulate CSPs, it does signal some forthcoming changes on the horizon.

Key Changes:

• Expanded Scope: FedRAMP will now include a broader range of cloud services, reflecting the growing reliance on Software as a Service (“SaaS”) solutions by federal agencies, in addition to Infrastructure as a Service (“IaaS”).

• Enhanced Risk Management: The program will emphasize threat-based analyses and industry best practices to improve cybersecurity. FedRAMP will prioritize high-impact security controls and leverage real-world threat assessments.

• Automation and Efficiency: FedRAMP will streamline the authorization process by implementing automated security assessments, utilizing machine-readable data formats, and exploring the use of artificial intelligence to enhance efficiency and security outcomes.

• Promoting Shared Infrastructure: The memorandum discourages the creation of federal-specific cloud solutions, promoting the use of commercial cloud infrastructures to benefit from industry advancements and security practices. To that end, the federal government is exploring alternative paths to authorization in addition to the current process.

Implementation Timeline: The implementation of the new FedRAMP guidelines will proceed in stages to hopefully effectuate a smooth transition and effective adoption:

• Within 180 days: federal agencies are required to align their policies with the updated requirements.

• Within 18 months: the General Services Administration will update FedRAMP's continuous monitoring processes and develop automation protocols for security assessments and reviews.

• Within 24 months: agencies must ensure their governance, risk, and compliance tools can produce and ingest machine-readable authorization artifacts using certain protocols identified by FedRAMP.

Recent Cases/Decisions

Eleventh Circuit Clarifies SBA 8(a) Program Obligations Post-Graduation

Issues Considered: In this False Claims Act (“FCA”) matter, the U.S. Court of Appeals for the Eleventh Circuit, considered two main issues:

1. Whether a business that has graduated from the SBA’s 8(a) program but is still bidding and performing work on 8(a) contracts is an 8(a) “participant” and, therefore, subject to the program's ownership and control requirements.

2. Whether submitting bids and claims for payment under those circumstances without notifying the SBA presents an actionable claim under the FCA.

Overview: The contractor in this matter, DWG & Associates, Inc., originally qualified under the SBA’s 8(a) program, successfully securing several 8(a) set-asides. DWG eventually outgrew the program’s size limits, although SBA regulations allowed it to continue fulfilling previously awarded 8(a) set-aside contracts.

DWG faced financial difficulties, risking default on its contracts. GAIC, the surety bonding company, froze DWG’s bonding program, leading DWG to partner with Native American Services Corporation (“NASCO”). GAIC and NASCO assumed control over DWG, including one contract that assigned 100 percent of DWG’s contract proceeds to GAIC and NASCO. However, they did not notify the SBA of the change in ownership and control.

Allegations and District Court Ruling: Relators filed a qui tam suit under the FCA, alleging GAIC and NASCO presented false claims by using DWG to bid on 8(a) contracts despite being ineligible. The district court dismissed the suit, stating DWG was no longer an 8(a) participant post-graduation, among other reasons for dismissal.

Key Appellate Court Findings: The appellate court clarified a crucial aspect of the 8(a) program: businesses that have graduated from the program but are still performing on existing 8(a) contracts remain participants and are subject to the program's requirements. The court emphasized that the regulatory definition of a “participant” includes those companies that continue to work on contracts awarded while they were in the program, even after they have graduated. This interpretation ensures that the core objectives of the 8(a) program—providing opportunities to small disadvantaged businesses—are not undermined by changes in ownership or control after graduation.

The court noted that 8(a) contracts must be performed by the participant who originally received them. The regulations stipulate that businesses must seek an SBA waiver if there are any changes in ownership or control, even if they have graduated. The court found that the district court’s interpretation, which exempted graduated businesses from these requirements, would create a loophole allowing ineligible firms to benefit from the 8(a) program, contradicting its intent.

Citation: Gose v. Native Am. Servs. Corp., No. 23-10600, 2024 WL 3533041 (11th Cir. July 25, 2024).

COFC: Follow-On Production Contract Issued Under OT Authority Is “Procurement” for Bid Protest Jurisdiction

Overview: In this bid protest matter, the contractor-protester challenged the scope of corrective action taken by the U.S. Army for a follow-on production contract solicitation. The key legal dispute concerned whether the Court of Federal Claims ("COFC") had jurisdiction to hear a protest concerning a solicitation issued under the Army's Other Transaction ("OT") authority, which does not fall under the Federal Acquisition Regulation ("FAR"). This matter is significant as it is a case of first impression for this court.

Ruling: Regarding jurisdiction, the court ruled in favor of the protester, determining the issue pursuant to the definition of procurement under its bid protest authority, which includes all stages of acquiring property or services. The court distinguished the follow-on solicitation from a solicitation issued during the OT prototype phase, the latter of which, standing alone, is not a procurement subject to the court’s jurisdiction. The court noted that its jurisdiction is not limited to contracts governed by the FAR but also extends to any process aimed at acquiring goods or services for the government, such as a follow-on solicitation issued under the Army’s OT authority.

While the protester prevailed on the jurisdictional issue, its System for Award Management registration lapsed between the submission of its offer and the award. As such, the court dismissed the matter as the protester did not have standing to pursue the protest.

Citation: Indep. Rough Terrain Ctr., LLC v. United States, No. 24-160, 2024 WL 3434501 (Fed. Cl. July 1, 2024).

GRSM Government Contracts Practice Group

GRSM’s government contracts team has considerable experience defending and enforcing the rights of our contractor clients in disputes against government entities and private businesses. In addition to litigating claims in state and federal courts, we routinely handle matters before administrative tribunals, such as the Government Accountability Office, the Small Business Administration, and the Armed Services Board of Contract Appeals.

Our team of attorneys is located throughout the United States, which allows the firm to represent contractors, regardless of size, and in a wide variety of industries, including defense, information technology, construction, and aerospace, among others. Please contact the authors with any questions.

Subscribe to receive the latest Government Contracts practice group updates directly to your inbox.

Click here to listen to the podcast summary of this legal update.