In recent years, we have seen statutory and regulatory exclusions from federal contracting of various entities and their goods and services happening outside the normal suspension and debarment process, the most notable being those subject to Section 889 of the National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232) (i.e., the Huawei ban). In furtherance of these exclusions, the Federal Acquisition Regulation (FAR) Council recently issued an interim rule amending the FAR to implement future exclusion and removal orders made by the Federal Acquisition Security Council (FASC). The orders will require contractors not to use identified information technology and other devices or services in performing federal contracts.
While FASC has not issued any exclusion or removal orders, starting on December 4, 2023, all contractors will be required to start checking the System for Award Management (SAM), much like they do for suspended or debarred entities, for FASC orders. At least half of contractors are anticipated to be affected by an order banning some source, product, or service from its supply chain.
Below is a primer on the FASC and the new interim rule. Comments on the interim rule are due December 4, 2023.
Where are these new requirements coming from?
The interim rule revises the FAR to implement Title II of the Federal Acquisition Supply Chain Security Act (FASCSA) of 2018, Pub. L. 115-390, Dec. 21, 2018, 132 Stat. 5173, 5178-93 (codified at 41 U.S.C. §§ 1321-1328), as well as a final rule issued by the FASC (86 Fed. Reg. 47581 (Aug. 26, 2021), codified at 41 C.F.R Part 201-1).
The goal of this legislation and the FASC is to reduce exploitations of and vulnerabilities in the federal government's information technology and telecommunications supply chain.
What is the FASC?
The FASC is an interagency council within the executive branch with representation from the Office of Management and Budget, General Services Administration, Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, Office of the Director of National Intelligence, National Counterintelligence and Security Center, Department of Justice, Federal Bureau of Investigation, Department of Defense, National Security Agency, Department of Commerce, and National Institute of Standards and Technology.
Among other functions, the FASC is responsible for establishing criteria and procedures for "recommending orders applicable to executive agencies requiring the exclusion of sources or covered articles from executive agency procurement actions" and "recommending orders applicable to executive agencies requiring the removal of covered articles from executive agency information systems[.]" 41 U.S.C. §§ 1323(c)(1)(A)-(B).
What are FASC exclusion and removal orders?
FASC has not issued any such orders yet, but an "exclusion order" will require the exclusion of one or more sources or covered articles from executive agency procurement actions, whereas a "removal order" will require the removal of one or more covered articles from executive agency information systems. 41 C.F.R. § 201-1.101.
In other words, exclusion orders will limit the sources, products, and services that an offeror can list in a federal proposal, while removal orders will require contractors to change their sourcing of products and services during performance of a federal contract or subcontract.
What sorts of "articles" might be subject to exclusion or removal?
FASC's rules define "covered article" as any of the following:
- Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;
- Telecommunications equipment or telecommunications service, as those terms are defined in section 3 of the Communications Act of 1934 (47 U.S.C. 153);
- The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program or subsequent U.S. Government program for controlling sensitive unclassified information; or
- Hardware, systems, devices, software, or services that include embedded or incidental information technology.
41 C.F.R. § 201-1.101.
What factors might result in FASC issuing an exclusion or removal order for a source, product, or service?
FASC's rules list several "[r]elevant factors" it will consider when evaluating sources and covered articles, although the list is "non-exclusive":
- Functionality and features of the covered article, including the covered article's or source's access to data and information system privileges;
- The user environment in which the covered article is used or installed;
- Security, authenticity, and integrity of covered articles and associated supply and compilation chains, including for embedded, integrated, and bundled software;
- The ability of the source to produce and deliver covered articles as expected;
- Ownership of, control of, or influence over the source or covered article(s) by a foreign government or parties owned or controlled by a foreign government, or other ties between the source and a foreign government, which may include the following considerations …
- Implications for government missions or assets, national security, homeland security, or critical functions associated with use of the source or covered article;
- Potential or existing threats to or vulnerabilities of Federal systems, programs or facilities, including the potential for exploitability;
- Capacity of the source or the U.S. Government to mitigate risks;
- Credibility of and confidence in available information used for assessment of risk associated with proceeding, with using alternatives, and/or with enacting mitigation efforts;
- Any transmission of information or data by a covered article to a country outside of the United States; and
- Any other information that would factor into an assessment of supply chain risk, including any impact to agency functions, and other information as the FASC deems appropriate.
41 C.F.R. § 201-1.300(b).
Is there a process for challenging a removal or exclusion order?
Yes, FASC's rules contain procedures to oppose its determinations, see 41 C.F.R. § 201-1.302, but notice of an exclusion is required only after a recommendation for exclusion takes place, meaning the harm and damage of an exclusion could be imposed well before an impacted party has an opportunity to contest the recommendation. The regulations also rightly provide for the possibility of judicial review, see 41 C.F.R. § 201-1.303; however, it would appear that any review would be subject to the government's very low bar of showing a reasonable basis for the exclusion.
Note that the entire program has yet to be tested in the courts, and therefore there remains a possibility that the scheme does not provide sufficient due process for these broad exclusionary actions.
Is the new interim FAR rule likely to affect my company?
Yes, all federal contractors and subcontractors will need to monitor SAM for FASC orders and then review their supply chains to determine whether a FASC order bans any source, product, or service upon which the contractor intends to rely or relies for performance. It is currently estimated that half of contractors will eventually be affected by a FASC order.
As a recently released Regulatory Impact Analysis (RIA) summarizes: "This interim rule requires all offerors, contractors and subcontractors to periodically review their supply chain for sources and covered articles to comply with any FASCSA orders and share certain supply chain risk information." Thus, "[i]t is expected that all contractors will be required to become familiar with these new compliance requirements in the FAR and will be required to update policies and procedures to ensure compliance with FASCSA orders and train their contracts, program, and supply chain personnel on the requirements."
While the FASC has not issued any orders, the RIA also states that "FASC exclusions will only impact some companies and only affect some contracts; therefore, it is estimated that approximately 50 percent of contractors … will be impacted by a FASC exclusion." The RIA further estimates that just "10 percent of contractors … will submit a disclosure" because contractors "will likely try to comply with the requirements unless no other alternative is available since there is a risk involved for the contractor in not being awarded a contract if a waiver from the requirements must be sought."
What will the new interim FAR rule generally require contractors to do?
The RIA summarizes what will be required of contractors in the new FAR contract clauses:
- Periodically Monitoring SAM, Especially Prior to Proposal Submission
- "All offerors will need to review SAM for any applicable FASC exclusions."
- "The frequency of which an offeror will search SAM will likely be based on the number of contracts and orders that they manage. Some offerors may choose to regularly monitor SAM for new FASCSA orders on a corporate level and notify applicable personnel when a new order is issued, while others may choose to review SAM with each proposal, likely at least once when the solicitation comes out and once prior to submitting the proposal to ensure compliance with the representation before submission."
- "The frequency with which offerors review SAM will also be based on the number and frequency that FASCSA orders are issued; however, at this time no FASC exclusions have been issued."
- Disclosing Any Inability to Avoid Proposing a Banned Source, Product, or Service
- "Once the offeror reviews SAM, they must identify if they cannot represent compliance and intend to propose any covered article or any products or services produced or provided by a source subject to a FASCSA order, in response to the solicitation."
- "If the offeror identifies such items, they must disclose" certain information to the Government, including identifying data and the "[r]eason why the applicable covered article or the product or service is being provided."
- Searching Your Supply Chain for and Then Disclosing Newly Banned Sources, Products, or Services Used During Performance of Existing Federal Contracts or Subcontracts
- Pursuant to a new FAR clause, "when a contractor identifies that a covered article or product or service produced or provided by a source is subject to a new FASCSA order, contractors will have to evaluate their supply chain to determine whether it was provided to the Government during contract performance."
- "[W]hen a contractor identifies that a covered article or product or service produced or provided by a source is subject to a new FASCSA order and was provided to the Government or used during contract performance, then the contractor must notify the Government within 3 business days and provide" certain information, including identifying data and "[a]ny readily available information about mitigation actions undertaken or recommended."
- Removing Newly Banned Sources, Products, or Services from Existing Contracts or Subcontracts
- "Within 10 business days of submitting the previous information, the contractor must provide information on mitigation actions taken and actions taken to prevent future submissions of covered articles or sources."
If my company discovers a source, product, or service for which the FASC has recently ordered removal, how long will my company have to remove it?
The new FAR clauses are not specific, but instead state:
Upon notification from the contracting officer, during the performance of the contract, the Contractor shall promptly make any necessary changes or modifications to remove any covered article or any product or service produced or provided by a source that is subject to an applicable Governmentwide FASCSA order (see FAR 4.2303(b)).
(Emphasis added.)
What if removing a newly banned source, product, or service is costly because the only alternatives are scarce/expensive?
The interim rule does not expressly address this issue, but the RIA contemplates that "negotiations" with the contractor would occur where the contracting officer determines it necessary to modify the contract to remove the item:
The Government contracting officer and the requirements office must review the reports when a contractor identifies that a covered article or product or service produced or provided by a source is subject to a new FASCSA order and was provided to the Government during contract performance. This information will help inform the Government on a range of next steps to take including no action is necessary, to modifying the contract to remove or replace the excluded products or services. The contractor is not responsible for taking action beyond reporting unless the contract is modified. If a modification is required negotiations must take place with the contractor.
It is possible that the final version of this rule will incorporate an explicit equitable adjustment provision.
Will the new FAR clauses apply to commercial and commercial-off-the-shelf (COTS) items contracts?
Yes, the interim rule states that the new FAR clauses "will apply to acquisitions valued at or below the SAT; acquisitions of commercial products, including COTS items; and acquisition of commercial services."
When does this go into effect? Does it apply to existing contracts?
As to solicitations, the interim rule states: "The FAR changes apply to solicitations issued on or after December 4, 2023 in accordance with FAR 1.108(d)."
As to existing contracts, the interim rule states:
For existing indefinite delivery contracts only, contracting officers shall modify them, in accordance with FAR 1.108(d), to include the FAR clause at 52.204–30, Federal Acquisition Supply Chain Security Act Orders-Prohibition (including any applicable alternate) within 6 months of December 4, 2023, to apply to future orders. However, for Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts, if the FASCSA orders are going to be applied at the order level, then FAR clause 52.204–28 should be included instead, within 6 months of December 4, 2023.
If exercising an option or modifying an existing contract or task or delivery order to extend the period of performance, contracting officers shall include the FAR clause at 52.204–30, Federal Acquisition Supply Chain Security Act Orders-Prohibition (including any applicable alternate). When exercising an option, agencies should consider modifying the existing contract to add the clause in a sufficient amount of time to both provide notice for exercising the option and to provide contractors with adequate time to comply with the clause.
Could my company be entitled to compensation if the new FAR clauses are added to our federal contracts?
FAR 1.108(d)(3), which the interim rule cites when advising agencies to add the new FAR clauses to existing contracts, contemplates the contractor receiving "appropriate consideration" for newly imposed requirements.
Similarly, the government's exercise of an option which purports to impose new terms on a contractor which were not included in the option is invalid. The government therefore cannot condition the exercise of an option on the addition of new contract terms. See, e.g., 4737 Conner Co. v. United States, 65 F. App'x 274, 276 (Fed. Cir. 2003) (unpublished decision); Varo, Inc., ASBCA No. 47945, 96-1 BCA ¶ 28,161 ("The inclusion in the exercise of an option of a provision(s) departing from the original contract provisions, makes such option exercise invalid … whether Government was required by regulation to include such clause was 'inconsequential'").
"[I]t is generally held that the Government's insistence upon continued performance after an ineffective exercise of its option, particularly over the protest of the contractor, constitutes a constructive change for which the contractor may be compensated by way of an equitable adjustment … or for the reasonable value of the items provided." Holly Corp., ASBCA No. 24975, 83-1 BCA ¶ 16,327; see also Lockheed Martin IR Imaging Sys., Inc. v. West, 108 F.3d 319, 324 (Fed. Cir. 1997) (option adding term to contract "was a constructive change for which appropriate adjustment is warranted").
Contractors faced with a federal agency demanding incorporation of the new FAR clauses into existing contracts (through unilateral modification or an option exercise), but without compensation for costs the contractor believes the new clauses will impose, should review the details of their contracts in consultation with experienced legal counsel.
* * * *
While the creation of the FASC has thus far garnered little fanfare, the implementation of this interim rule into the FAR will effectuate the Council's determinations and shed significant light on a new exclusionary process that does not have the same checks and balances as the decades-old and judicially tested and modified suspension and debarment process at FAR Subpart 9.4. It remains to be seen how active the FASC may be, but if recent exclusions (i.e., Huawei) are any guide, FASC exclusions could have substantial direct and indirect impacts throughout the IT and telecommunications supply chain.