Pentagon Suspends CMMC Phase 2 Requirements Pending 60-Day Overhaul Review
In a major shakeup for the defense industrial base, the Pentagon has immediately suspended the Cybersecurity Maturity Model Certification (CMMC) Phase 2 requirements that were slated to take effect in November 2026. Citing prohibitive compliance costs that threaten to push innovative small businesses out of the market, the DoD is launching a 60-day review via a new CMMC Reform Task Force. Phase 1 self-assessment requirements, however, remain firmly in effect.
GovCon Takeaway: Defense contractors can hit pause on the frantic race to secure third-party Certified Third-Party Assessor Organization (C3PAO) assessments before November. However, Phase 1 self-assessments and existing DFARS 252.204-7012 requirements for NIST SP 800-171 compliance are still strictly enforced. Use this 60-day window to refine your internal cyber hygiene while awaiting the DoD’s revised mandates.
Lawmakers Press SBA on 8(a) Application Backlog Amid Sweeping Program Overhaul
Tribal participation in the SBA’s 8(a) Business Development Program took center stage during a recent House Appropriations subcommittee hearing. Lawmakers pressed the SBA on a months-long slowdown in application approvals—affecting numerous tribal and Native-owned enterprises stemming from a comprehensive agency audit. While the SBA emphasized its goal of rooting out fraud, lawmakers urged a swift return to timely application processing.
GovCon Takeaway: Native-owned and prospective 8(a) businesses should prepare for rigorous new financial reviews and extended timelines. Ensure all application materials and financial statements are meticulously prepared and continue tracking the final rules as the SBA works through its backlog.
SBA Expands Partnership with Palantir for AI-Driven Anti-Fraud Enforcement
The Small Business Administration (SBA) is ramping up its anti-fraud capabilities by expanding its collaboration with Palantir Technologies. The agency is leveraging Palantir’s advanced data analytics and artificial intelligence to identify anomalies, accelerate investigations, and recover stolen funds tied to pandemic-era small business relief programs like the Paycheck Protection Program (PPP) and EIDL
GovCon Takeaway: Federal contractors and small businesses that utilized pandemic-era programs should ensure their documentation is impeccable. With advanced AI now actively analyzing large SBA datasets, the likelihood of targeted audits and aggressive enforcement actions has significantly increased.
GSA Solicits Industry Feedback to Prioritize American-Made Products on GSA Advantage
The General Services Administration (GSA) has issued a Request for Information (RFI) seeking private-sector solutions to enhance the procurement of American-made products. Aligning with a renewed push for resilient supply chains, the GSA is prioritizing U.S. suppliers and aggressively removing Trade Agreements Act (TAA) non-compliant items from its federal marketplaces.
GovCon Takeaway: GSA Schedule contractors must urgently audit their supply chains for TAA compliance. Expect increased scrutiny, stricter enforcement, and potential removal of non-compliant items from GSA Advantage! catalogs as the agency cracks down on supply chain risks.
Experts Warn GSA’s Proposed AI Acquisition Rule Defies Customary Commercial Practices
During a recent listening session, government contracting experts and major tech firms voiced concerns over the GSA’s proposed AI acquisition rule. Stakeholders argue the revised rule remains too vague, demands unworkable notification timelines for SaaS companies, and attempts to rewrite commercial software license terms regarding data privacy and intellectual property.
GovCon Takeaway: AI developers and integrators selling to the government must closely track this evolving rule. If finalized as-is, contractors may need to renegotiate commercial licensing terms, take on significant compliance risks, or explore non-GSA contracting vehicles for advanced large language model (LLM) solutions.
