1. NCMA-RI Ocean State Workshop
In the Strike Zone: What’s In and What’s Out Under Recent Regulatory Changes
June 14, 2017
Terence Murphy | (757) |

2. Important Note
The contents of this presentation are intended for general information only and should not be construed or relied upon as legal advice nor as a legal opinion on any specific facts or circumstances. If you need legal advice concerning your specific circumstances, please consider contacting Kaufman & Canoles, P.C.

3. Introduction Small Business Labor Cybersecurity Trump Executive Orders
Proposed Legislation

4. 1. Small Business SBA Final Rule Implementing 2013 NDAA
81 Fed. Reg. 34,243 (May 31, 2016) (effective June 30, 2016)
Limitations on subcontracting
Similarly situated entities

5. 1. Small Business SBA Final Rule Implementing 2013 NDAA
Limitations on subcontracting
Subcontracting limitations now based on total contract value
Percentage of prime expenditure on subs based on cost of contracts (excluding cost of materials when applicable) cannot exceed:
50% for services and supply
85% for general construction
75% for specialty trade

6. 1. Small Business SBA Final Rule Implementing 2013 NDAA
Similarly Situated Entities
Work subcontracted to “similarly situated entities” counts as work done by the small business prime contractor
“Similarly Situated Entity” defined as a “small business concern subcontractor that is a participant of the same SBA program that qualified the prime contractor as an eligible offeror and awardee of the contract.”
Small business → Small business
8(a) → 8(a)
SDVOSB → SDVOSB
HubZone → HubZone
WOSB → WOSB

7. 1. Small Business SBA Final Rule Implementing 2013 NDAA
Similarly Situated Entities (cont’d)
Must also qualify as “small” based on the NAICS code prime contractor assigned to the subcontract
Only applies to first-tier subcontractors

8. 1. Small Business Additional Provisions
SBA Final Rule Implementing 2013 NDAA
Additional Provisions
Penalty for violating the “LOS” rule
Greater of $500,000 or the dollar amount spent in excess of the limitations
Possible suspension and debarment
Practical Note: SBA regulation only; not yet in FAR
Proposed FAR rule held up by “2 for 1” Executive Order
FAR Council moving forward with proposed interim rule
Ask CO question in proposal process whether recognition of this change

9. 1. Small Business SBA Final Rule on Mentor-Protégé Program
81 Fed. Reg. 48,557 (July 25, 2016) (effective August 24, 2016)
Program Expansion
Creates an expanded program for all small businesses modeled after the 8(a) program
8(a) mentor-protégé program still in existence as separate program

10. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Joint Ventures
8(a) “affiliation exception” now applies program-wide
Exception to automatic assumption of “affiliation” for small business size status determination between joint venture members
Mentors and protégés allowed to form joint ventures in order to compete for contracts based on protégé’s size
SBA must pre-approve joint venture agreements

11. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Joint Ventures (cont’d)
“[C]ontract awarded to a joint venture between a protégé and mentor as a small business continues to qualify as an award to small business for the life of the contract ”
JVs must be identified separately in the System for Award Management (“SAM”)

12. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Mentor-Protégé Requirements
Mentors:
Any business that “demonstrates a commitment and ability to assist small business concerns ”
Must be in good financial health and possess good character
Protégés:
Company must qualify as small under its primary NAICS code designation

13. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Mentor-Protégé Requirements (cont’d)
Can now alternatively qualify under their secondary NAICS classification—requirements: (1) must have prior experience in that classification and (2) firm must show how M-P program is “a logical business progression and will further develop or expand capabilities.”
Mentors cannot have more than three protégés at any one time aggregated over both the new program and the existing 8(a) program
Business can be both a protégé and a mentor as long as second relationship does not compete or conflict with first

14. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Mentor-Protégé Agreements
Written agreement required between mentor and protégé
Agreement must include a description of the protégé’s needs for assistance and detailed plan of how to address those needs
Agreement must be pre-approved by the SBA
Changes to the agreement must also have SBA pre-approval and must be in writing

15. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Mentor-Protégé Agreements (cont’d)
M-P Agreement must be for at least one year, but cannot exceed three years
Agreement may be only extended for an additional period of no more than three years
Agreement will automatically renew each year until expiration unless SBA determines the M-P relationship needs review
Agreement must allow for termination with 30-day notice

16. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Reporting Requirements
Protégés required to submit annual reports to the SBA describing:
Assistance the mentor provided
Contracts awarded to the M-P JV
Narrative detailing how mentor’s assistance developed the protégé’s business
Annual report utilized by SBA to determine whether to allow automatic renewal of relationship

17. 1. Small Business SBA Final Rule on Mentor-Protégé Program
Effects of New Rule
Potential huge impact on the small business community
SBA set up new unit in October 2016 within Office of Business Development solely tasked with reviewing and approving M-P Agreements
Approximately 170 M-P Agreements approved to date
Practical Note: Get in line at SBA!

18. 1. Small Business C. Untimely Payment of Subcontractors
81 Fed. Reg (December 20, 2016) (effective January 19, 2017)
Final rule “requires contractors to notify the contracting officer, in writing, if the contractor pays a reduced price to a small business contractor or if the contractor’s payment to a small business subcontractor is more than 90 days past due.”
Reporting window of 14 days for prime contractors to report to the contracting officer an untimely or reduced payment.
FAR : Part of small business subcontracting plan reporting requirement.

19. 1. Small Business C. Untimely Payment of Subcontractors (cont’d)
Examples of payment and nonpayment situations not considered to be unjustified:
Contract dispute on performance.
Partial payment is made for amounts not in dispute.
Payment is reduced due to past overpayments.
Administrative mistake.
Late performance by subcontractor leads to later payment by prime contractor.

20. 1. Small Business C. Untimely Payment of Subcontractors (cont’d)
FAR : Prime contractor’s past performance evaluations shall include assessment of performance of subcontracting plan, including history of reduced or untimely payments to subcontractors.
Practical Note: SBA rule only – awaiting proposed FAR rule.

21. 2. Labor Fair Pay and Safe Workplaces Overtime Rule Paid Sick Leave
Comp Time

22. 2. Labor Fair Pay and Safe Workplaces 2014 Executive Order
Pre-award disclosure of labor law violations
“Blacklisting Rule”
August 25, 2016: DOL Rule
October 25, 2016: Final FAR Rule to become effective
October 24, 2016: Court Injunction
March 6, 2017: Senate approves joint resolution overturning EO
March 27, 2017: Signed by President

23. 2. Labor B. Overtime Rule DOL Final Overtime Rule
81 Fed. Reg (May 23, 2016) (proposed effective date December 1, 2016)
Revises the “white collar” exemption regulations under the Fair Labor Standards Act (“FLSA”) (increase salary threshold to $47,476)
November 22, 2016: Court Injunction

24. 2. Labor
C. DOL Final Rule Establishing Paid Sick Leave For Federal Contractors
81 Fed. Reg (September 30, 2016)
Implements Executive Order 13,706
Effective November 29, 2016
Employees will accrue “1 hour of paid sick leave” per 30 hours worked
Option to grant up to 56 hours at the beginning of the accrual year
Contractors allowed to limit total accrued hours to 56 and required to allow carry-over of accrued hours

25. 2. Labor
DOL Final Rule Establishing Paid Sick Leave For Federal Contractors
Employees can use paid sick leave for any personal illness/injury, treatment, care of a close family member, or domestic violence situation
Employers not required to “cash out” employees accrued sick leave upon separation
Must reinstate accrued leave if employee re-hired within 12 months

26. 2. Labor
DOL Final Rule Establishing Paid Sick Leave For Federal Contractors
Documentation:
Employees may request sick leave in writing or verbally at least 7 days in advance for foreseeable situations or as soon as practicably possible
Denial must be in writing accompanied by an explanation
May only require certification for absences of 3 or more consecutive days—only request minimum information

27. 2. Labor
D. H.R – Working Families Flexibility Act (Proposed “Comp Time” Legislation)
May 2, 2017: Passed House
Gives employers option to provide paid time off v. paid overtime (time and half)
Up to 160 hours (4 weeks)
Above 80 hours, employer can “buy back” with notice
Not likely to see Senate action soon

28. 3. Cybersecurity
DFARS Rule
FAR Rule

29. 3. Cybersecurity DFAR Rule
February 2013: EO 13,636 (“Improving Critical Infrastructure Cybersecurity”)
Establish cybersecurity framework by creating technical standards
National Institute of Standards and Technology (“NIST”)
November 2013: DFAR Rule
Cybersecurity measures imposed on defense contractors
“adequate security” for “systems” that handle “unclassified controlled technical information” (UCTI) (military or space application)

30. 3. Cybersecurity A. DFAR Rule
Utilize NIST standards (NIST SP )
Incident reporting (72 hours)
Investigate and preserve data
2015 – DFAR Interim Rule (Safeguarding Covered Defense Information and Cyber Incident Reporting) (effective December 2015)
Extended date of full compliance to December 31, 2017

31. 3. Cybersecurity
A. DFARS Interim Rule — Safeguarding Covered Defense Information and Cyber Incident Reporting
DFARS expanded to include all “covered defense information”
Covered Defense Information (“CDI”): controlled technical information, critical information, export controlled information, or any information that law or policy requires safeguarding or controls—very broad, encompasses most contracts
Must comply with security requirements outlined in National Institute of Standards and Technology (NIST) SP (110 controls)

32. 3. Cybersecurity
A. DFARS Interim Rule — Safeguarding Covered Defense Information and Cyber Incident Reporting
DFARS clause includes requirement that contractors must report incidents within 72 hours
Reportable incidents involve compromise of CDI, covered contractor systems, or actions that limit the ability to perform “operationally critical support”
Contractor should register for a DoD-approved medium assurance certificate for incident reporting (see

33. 3. Cybersecurity
A. DFARS Interim Rule — Safeguarding Covered Defense Information and Cyber Incident Reporting
Clause must be flowed down to subcontractors handling CDI
Contractor must report to DoD within 30 days of any non-compliance with new security requirements and what substitute measures are in place
Full compliance mandated no later than December 31, 2017

34. 3. Cybersecurity A. DFARS Final Rule
October 21, 2016: Network Penetration Reporting and Contracting for Cloud Services
DoD adopted “as final, with changes, [the] interim rule amending the [DFARS] to implement a section of the” NDAA 2013 and “a section of the” NDAA 2015, “both of which require contractor reporting on network penetrations, as well as DoD policy on the purchase of cloud computing services.”
Key Takeaway: December 31, 2017 Compliance Deadline

35. 3. Cybersecurity
B. Final FAR Rule: Basic Safeguarding of Contractor Information Systems
81 Fed. Reg. 30,439 (May 16, 2016) (effective June 15, 2016)
Outline basic network safeguards and standardize rudimentary security procedures

36. 3. Cybersecurity
B. Final FAR Rule: Basic Safeguarding of Contractor Information Systems
New clause (FAR ) in solicitations and contracts when the contractor or subcontractor at any tier may have Federal Contract Information (“FCI”) residing in or transiting through its information system.
Federal Contract Information: non-public information provided by or developed for the Government in connection with the contract, excluding “simple transactional information, such as necessary to process payment.”

37. 3. Cybersecurity
B. FAR Final Rule: Basic Safeguarding of Contractor Information Systems
Requires compliance with 15 basic safeguarding measures (already covered in DFAR Rule)
Includes: physical security and access monitoring, network scanning, periodic updates of “malicious code protection mechanisms,” sanitize/destroy media before disposal, maintain policies for limiting system access to appropriate users, limit connections to and use of external systems

38. 3. Cybersecurity DFARS-FAR Clauses Relationship
FAR clause provides basic requirements for almost any government information stored and processed by a contractor
FAR clause explicitly states it is not to diminish other more stringent security requirements—acts as a supplement
Both clauses will likely be included—CO should make known use of Covered Defense Information (“CDI”) early in the process
Both clauses are required to be “flowed down” to subcontractors
DFARS is only required to be “flowed down” when CDI is necessary for performance of the subcontract

39. 3. Cybersecurity D. Potential Contractor Liability for Non-Compliance
False Claims Act (“FCA”) Liability
Recent Supreme Court decision* made it easier to incur FCA liability when non-compliant with cybersecurity measures
Could be liable even when not making an express certification but “knowingly fails to disclose noncompliance with a statutory, regulatory, or contractual requirement.”
Breach of Contract Liability
*Universal Health Servs. v. United States ex rel. Escobar, 136 S. Ct (2016)

40. 4. Trump Executive Orders
Cybersecurity
“2 for 1” on Regulations
Buy America

41. 4. Trump Executive Orders
A. Cybersecurity EO
EO (May 11, 2017): “Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure”
Top down review requiring all agency heads to prepare risk management report within 90 days (OMB to evaluate within 60 days)
NIST framework mandatory for government-wide cybersecurity protection
Potential change in government network architecture (preference for shared IT services such as cloud-based solutions)

42. 4. Trump Executive Orders
B. “2 for 1” EO
EO (January 30, 2017): “Reducing Regulation and Controlling Regulatory Costs”
Order requires that “for every one new regulation issued, at least two prior regulations be identified for elimination, and that the cost of planned regulations be prudently managed and controlled through a budgeting process.”
Subject to pending lawsuit.

43. 4. Trump Executive Orders
C. Buy American EO
EO (April 18, 2017): “Buy American and Hire American”
Requires all agencies to assess monitoring, enforcement, implementation and compliance with BAA laws (including waivers)
Assessment of impact of domestic preferences on all free-trade agreements
Elevates to Head of agency waiver requests
Sec’y of Commerce has 220 days for report with recommendations to strengthen BAA laws implementation
Agencies to submit annual reports on efforts to maximize procurement of domestic products

44. 5. Proposed Legislation
Thornberry Acquisition Reform Legislation (H.R. 2511, “Defense Acquisition Streamlining and Transparency Act”) (May 17, 2017)
Allow DoD to buy commercial items through on-line market place (Amazon)
Reform DCAA audit process materiality threshold for incurred costs audits
– allow CO to choose DCAA or private auditor
– complete audits within 1 year

45. 5. Proposed Legislation
Thornberry Acquisition Reform Legislation (“Defense Acquisition Streamlining and Transparency Act”) (May 17, 2017)
Reform acquisition of Services
Increase transparency and visibility on service contracts
more detail in annual budget request
restrict use of bridge contracts
Establish centralized DoD intellectual property office
Assist companies with IP strategy and negotiations with CO earlier in acquisition process

46. Questions?
Terence Murphy Kaufman & Canoles, P.C. T (757) F (888)