David Mullis has been analyzing the FAR Overhaul from a small-business perspective for well over a year now. So when the FAR Council published its first batches of proposed rules last week, the former SBA Advocacy assistant chief counsel and current regulatory consultant at Gov Contract Pros was my first choice to break down how those rules affect small businesses. There are some surprises in there, David says. The proposed rules aren’t the same as what we saw published last year—instead, there are substantive policy changes. And there are some hidden changes for small businesses that you’ll miss if you read the 1,000 pages too quickly.
Right now, David is pushing to get small businesses more time to comment on the rules. But, if the FAR Council keeps to its current schedule, comments will be due on July 23. David and I talked about the strategies that small businesses should use to make sure their comments are considered, and how they might play a long game to push back on the changes, even if they are finalized.
Links
David Mullis on LinkedIn
FAR Overhaul Proposed Rules:
Executive Order on Restoring Common Sense to Federal Procurement
“You Said, We Did: How Public Feedback on Model Deviations Informed the Proposed Rules”
FAR proposed Rule on Controlled Unclassified Information, January 2025
FAR Proposed Rule on Strengthening America’s Cybersecurity Workforce (NICE Framework), January 2025
Guide to the Regulatory Flexibility Act
Regulations.gov docket for comments
Chapters
00:00 - Introduction to the FAR Overhaul
01:28 - What is the Revolutionary FAR Overhaul?
02:30 - The Significance of Proposed Rules
04:05 - The Rulemaking Timeline
06:01 - The Scope of the 12 FAR Rules
07:50 - Substantive Changes vs. Model Deviations
09:41 - The Impact of Public Comments and the Sunset Provision
13:30 - The Regulatory Flexibility Act and 10-Year Reviews
15:06 - Changes to Market Research (Part 10 to Part 7)
17:14 - The Push for COTS and Full and Open Competition
19:15 - Balancing COTS with Cybersecurity and Compliance Risks
20:22 - Oral Acquisition Plans
21:09 - The Impact on Small Business Programs
24:43 - Good News for SBIR/STTR Programs
27:13 - The New CUI and Cybersecurity Requirements
32:41 - The 30-Day Comment Period Debate
36:36 - Breaking Down the 12 Rulemaking Batches
37:48 - The Regulatory Flexibility Act (RFA) Explained
39:43 - The Missing Data in the Regulatory Flexibility Analysis
41:55 - The IRFA, FRFA, and Judicial Challenges
45:08 - The Role of the SBA Office of Advocacy
46:57 - Strategic Tips for Submitting FAR Overhaul Comments
51:38 - Conclusion and Contact Info
Transcript
Introduction to the FAR Overhaul
Sam: Welcome to GovCon Intelligence. If you’ve been paying attention to the world of federal procurement policy, you’ve no doubt heard of the FAR Overhaul. Today, my guest is David Mullis. He’s the regulatory consultant for Gov Contract Pros. He was previously the Assistant Chief Counsel at the SBA Office of Advocacy where, among many other things, he worked on the FAR Overhaul in reviewing it for regulatory compliance and small business issues. Just this week, we’re recording on Thursday, the FAR Council published its proposed rules for many parts of the FAR Overhaul in four different batches and they gave everybody 30 days to respond. 30 days, that includes July 4th, by the way, or the July 3rd holiday. So if you have any comments, you have to get them through quickly. David and I are going to be going through these first four batches of the FAR Overhaul. It’s a laptops out episode of GovCon Intelligence. And David, thanks very much for joining me today.
David: Thanks so much for having me, Sam. I’m excited to go through the weeds on all of this.
Sam: That’s what we do here, and I know we’ve been looking at parts of the FAR Overhaul for, gosh, about a year now, when they started the process of the class deviations.
What is the Revolutionary FAR Overhaul?
Sam: Just generally, for people who might be busy running their businesses, what is the Revolutionary FAR Overhaul? What is the overarching purpose of this process?
David: Sure, so this is all stemming from an Executive Order that was signed in April of 2025 and was the President directing the FAR Council to streamline and create more efficient contracts. A lot of this was stemming from just the fact that the FAR is 2,000 pages. It’s a very long document. They’ve been trying to, in their own way, whittle this down into something that they see as more manageable or more streamlined or efficient. And so that’s why we’ve gone through this model deviation phase. Now we are at this phase of actual proposed rules that we actually get to kind of turn through and look at what’s going to be actually implemented with these agencies. But it’s just been a long, long line of trying to make this more hopefully streamlined is the intention here.
The Significance of Proposed Rules
Sam: So for people who aren’t thinking rulemaking 24/7, what’s the significance of a proposed rule, which is what we saw on Monday pre-publication, Tuesday officially, what’s the significance of a proposed rule as compared to posting things online as they were doing last summer?
David: Sure. So the model deviations, which was basically them just posting kind of their wish list of what the FAR should look like, was really non-binding. So they aren’t technically the law. They aren’t technically regulations. They permitted agencies to adopt those model deviations. But at the end of the day, you can even look at which agency has adopted which of the model deviations right now, and it is not uniform. There’s no agency that’s accepting all of these and currently implementing all aspects of the model deviations. And so this actual proposed rulemaking phase means it is seeking public input, which is why we want everyone to be commenting on what they’re seeing in the FAR Overhaul. They have to take in that input and then they can actually put out a final rule that would actually bind all the agencies, all the contracting officers to the terms that are put forward here.
Sam: So now we’ll have consistency among all the agencies that use the FAR, once you get to the final rule.
David: Right, exactly. Yeah, which is still months away. It takes a minute or two to get through the whole process here. But once it is a final rule, it would then be the across agency binding regulations for everyone.
The Rulemaking Timeline
Sam: Well, tell me about that. How long is this process? I remember being at SBA and there were rules that would take a year. And sometimes it would take many years even to get into the FAR. It seems like the FAR is trying to move quickly here, given those 30 days. How fast do you think they’re trying to move?
David: I mean, obviously they’re trying to move fast. They’ve chosen to use the shortest timeframe possible to seek public comment. But really a rule from its inception as an idea, even at the fastest track, is at least 18 months.
Sam: Wow, 18 months.
David: Because it has to go through drafting, it has to go through interagency comments, it has to go through the White House’s regulatory office review, it has to then go into the Federal Register as a proposed rule that has to have a minimum of 30 days. Then they receive the comments. They have to sort through and meaningfully respond to any significant comments. And then once they’ve kind of crossed all those T’s, dotted all those I’s, then they can actually put forward the final rule. And usually the final rule has a 60-day window until it’s actually effective. So that’s you know where even at this point it’s going to take a couple months to see a final rule on just these four proposals and we’re expecting...
The Scope of the 12 FAR Rules
Sam: At least eight more. Oh, it’s 12 all together. 12 batches all together. They’ve already batched all these parts up into different segments. Just going back to the 18 months, that 18 months includes some time that’s already passed to get the proposed rule out, right? Because they’ve already gone through the interagency review process, OIRA, OFPP review on the proposed rules. Those took longer than they were talking about. At some point they were talking about these will be out in April and now it’s June. So not a huge amount of time, but it did cause some delay, that long process.
David: Yeah, and really important to know, kind of weaving in that there’s going to be a total of 12 rules to redo the entirety of the FAR, it’s that these are the only four that have actually passed through OIRA at this point. OIRA has the right to hold a rule for up to 90 days before releasing it to go into the Federal Register as a proposed rule. So we haven’t even seen three-quarters of these rules even start that multi-month process at this point.
Sam: Yeah, and if you go to the FAR tracking chart, the PDF, the rule that I’m interested in, Part 19, it says it’s still parked at OFPP. So for everybody in the audience, this does not include Part 19, which is Small Business. It doesn’t include that debate over the Rule of Two and the 8(a) program. That’s yet to be seen.
David: That is a fight for another day. A couple months from now. Honestly, maybe next calendar year at this point. That might be when it comes out. It’s just got a long path to go right now.
Sam: Right. I wonder how they’re going to work sequentially on these. So there are 12 altogether. I think that they’ll be concurrently working on these as they have already been essentially working on all of these because it’s so intertwined.
David: I don’t think that they would wait for these four to be finalized because that’s going to take months. I think that their initial plan was to have these more out almost at the same time or as one is closing out to put out the next one into the public register.
Substantive Changes vs. Model Deviations
Sam: Well, a lot for us to read as people interested in the regulatory world. When this came out in pre-publication on Monday, I added up all the pages and it was over a thousand pages. So as you’re reading through these 1,000 pages, do you see differences between what is being proposed now versus what was in the class deviation?
David: So it’s certainly, there’s the biggest difference between what the model deviations were showing and what these rules have now is that the model deviations were just removing non-statutory requirements from the FAR. These proposed rules contain substantive rulemakings. These contain substantive policies. This has things like changes to implementing a former CUI proposed rule, a former cybersecurity proposed rule. It’s changing meaningful deadlines on certain termination processes. It’s introducing not just the reduction of the FAR, but it’s actually now including new provisions to the FAR that the model deviations just couldn’t do through that process.
Sam: So don’t think that just because you read the FAR deviations over last summer, that you’ve read these because there are substantive changes.
David: Right. It was not one and done. Even those model deviations have been subject to many updates and have had multiple rounds of version 2 of Part 19 and such. And so I think that we don’t know how these final proposed rules are going to look and we don’t know how the final rules are gonna look which make substantively change from what we’re seeing right now because they can always say there was something that was a logical outgrowth from the comments received and they can make substantive changes in that final rule.
The Impact of Public Comments and the Sunset Provision
Sam: So the comments do matter. I know that from being at SBA, you know that from being at Office of Advocacy, and it seems like the comments mattered even pre-proposed rule here because earlier this week GSA or the FAR Council published on their website a summary of some of the 1,000 comments that they received on the RFI on the model deviations. The biggest point to come out of that is they address small business comments on the so-called sunset provision. This was the idea that any non-statutory FAR provisions and clauses would sunset after 10 years [actually, 4 years]. 2035 or 2036 [actually, 2030 or 2031] those would sunset meaning they would become inoperative. Small businesses commented that that creates unnecessary uncertainty because they don’t know what’s going to be in their contracts, they don’t know how to act in accordance with the Rule of Two or other small business provisions. What did the FAR do there and why did they decide to respond to those comments?
David: So I guess a little bit twofold there is like one of course the day that they actually publish these rules we finally get to see what had been submitted during the model deviation phase and that’s the first time we’ve actually even heard how many comments were being filed in that phase, because before that was just a black box. People would file comments, but there was no public record or no public showing. Even now, we don’t know what did the comments say, who was filing comments, what was responsive and what was unresponsive, what have they chosen to not show us in that comment collection process. But the sunset provision particularly was originally in there and was part of the executive order as well to ensure that that’s clearly stated that rules that are non-statutory would be removed within that four-year period. Now it’s kind of backed off of that and now it’s more of a general we want to generally have this set up that in the future the FAR Council will propose rules on regulatory sunset provisions. And so it then becomes a little bit of a task for another day for the FAR Council to go through and create some sort of regulatory sunset.
Sam: Yeah, I’m looking at it here. 1.109, the FAR Council will seek public input, through rulemaking on sections, provisions, and clauses. So they’re not going to do another, you know, RFI, informal comment, not even comments, feedback, I think they called it. It would actually be through rulemaking. And actually, it doesn’t even say, I don’t see a certain number of years here in 1.109.
David: Right. The original executive order that instigated the FAR overhaul, the 14275 that it notes there, it actually does specifically say four years, but that has been removed as in part response to the comments or the feedback that they received during Model Deviation.
Sam: Okay, so it takes some of the pressure off 2030 or so.
David: Possibly, we don’t know. We don’t know what the final, because that could end up being the next proposed rule by the FAR Council is saying is implementing a four year sunset.
Sam: Well, at least they’ve committed themselves to using rulemaking. It specifically refers to the Federal Register in bold that they’ll be using for this next sunset period. But also in terms of years, it might not be four years.
The Regulatory Flexibility Act and 10-Year Reviews
Sam: It could be that there is, we were talking about before, there’s a Section 610 of the Regulatory Flexibility Act that requires agencies to review regulations every 10 years. So it’s conceivable that they could just say, well, we’re going to do it every 10 years because that’s what the RFA says.
David: Right. The RFA, which I was partly in charge of upholding, does have that Section 610 that requires every 10 years. It’s not a sunset. It’s instead asking agencies within 10 years of passage of a rule to just review it. Did they correctly estimate the impacts that that rule would have on small entities? If you’re going to tie it to something that already exists, that seems like a very easy mechanism, but I will note that most agencies don’t engage with Section 610 in any meaningful way as is, and so that might even be a foreign concept to the FAR Council to introduce a 10-year look back in the same way that 610 does.
Sam: Except for the FCC.
David: They put out a nice little document of every rule that’s 10 years old now. But it is really seldom that agencies already do not comply with that provision of the law.
Sam: Great. Well, we have that in common as well that we also work on communications policy. My former associate classmate Brendan Carr is the chairman of the FCC now and maybe he’s responsible for that as well as many other things.
Changes to Market Research (Part 10 to Part 7)
Sam: Let’s get into some of the meat of these four proposed rules that came out. Big surprise to me when it came out, the very first thing I looked at was to see what happened to Part 10 which is on market research and the reason for that is small businesses want to be involved in the results of market research. They want agencies to be required to look at the SBA website, do internet searches for small businesses, and determine whether or not there’s sufficient small business competition to do a set aside. Some of that was removed in the RFI Part 10 during the model deviation phase and then all of it was removed in Part 10. So tell us a bit about what happened in Part 10.
David: It was moved. It was all moved into Part 7 now. So acquisition planning and market research are now consolidated into one part. So now 10 is essentially an empty part of the FAR. There’s a couple other areas where now certain parts of the FAR have been moved over into another part and then that part’s now reserved and essentially empty. And so the market research has been kind of consolidated into acquisition planning, which logically makes sense. That does operatively, that is how it was working. But as you’re noting, the proposed rule really does remove small business considerations. Even to activate the Rule of Two, you have to show that there’s two small businesses that could reasonably do this work. How is the contracting officer going to know that moving forward if they don’t meaningfully engage with the Small Business Administration, they don’t meaningfully engage with the industry or do their research into who’s in these, are there small businesses in these sections and proposals that they’re trying to seek out?
Sam: Right. There used to be things in there about PCRs, checking with SBA, and that’s been taken out. To be fair, there’s some mention of small business generally in Part 7. These are not new, but it’s working with the OSDBU, getting a consolidation or bundling.
The Push for COTS and Full and Open Competition
David: There is some PCR, some working with the Procurement Center Representative still, but generally the role that small businesses would have in contracts is going to be diminished because of how the FAR is really gearing towards open and full competition. It uses that multiple times throughout the proposed rule and the proposed language to the FAR and that also commercial off-the-shelf or COTS purchasing should be the primary goal of any contracting officer. So there’s an intentional move away from more specialized or individualized contracts that the government would be engaging in and really seeking as full and open, which often means that maybe the small businesses will not be able to compete with the big businesses in terms of pricing or services provided.
Sam: So you’re saying the biggest changes in Part 7 or maybe in the FAR in general are have fewer contracts, don’t create new contracts. Do commercial as much as possible.
David: Yeah, those are really some of the biggest pushes here, particularly the commercial off-the-shelf purchasing is ostensibly what is being held up as the streamlining efficiency gain through this whole process, is that now the contracting officer should just go to Staples and buy their office supplies rather than procuring a particular small business to supply those. And so it is just really this is geared towards they’re just like any other buyer. They want them to just order off Amazon. They want these things to not be so special, which has validity, but also brings in things like cybersecurity risks and other concerns for those contracting officers.
Balancing COTS with Cybersecurity and Compliance Risks
Sam: Yeah, that’s a strange dichotomy on one side with you have to go commercial or try to go commercial as much as possible. On the other side, you also have to pay attention to these NIST requirements and CUI and Chinese manufacturing restrictions. How do you balance those two?
David: It’s a great question. I think that’s going to be one of the... When I think that when this rule and the rest of the Revolutionary FAR Overhaul really hits on contracting officers, that’s going to be one of the tough points for them to navigate is that they have personal liability on their contracts that they form and that they could be violating some of those provisions unknowingly. And that’s partly why there might have been a reason to have kind of what was before seen as a checkbox approach to your acquisition planning. That you go through these different steps, they may seem redundant, they may seem tedious, but they at least provided that contracting officer the certainty that they were abiding by all of the underlying regulations and laws.
Oral Acquisition Plans
Sam: And before, they were written. And now you can have oral acquisition plans. David, I want to acquire this commercial product. Is that my oral acquisition plan?
David: That sounds great, yeah, go ahead. You get the agency head approval and you’re good to go.
Sam: So is that a big change, being able to go to oral acquisition plans?
David: I think that is part of the streamlining effect. It does note that the oral acquisition planning does need a written component justifying why it was oral acquisition planning.
David: Interesting. So there’s still going to be some level of a paper trail, but that is one of those, again... Seemingly confusing or possibly muddy parts of how do they expect contracting officers to be implementing this rule.
The Impact on Small Business Programs
Sam: Any other thoughts on Part 10, Part 7 as far as small businesses are concerned? It seems like my first reaction is this is as bad as what we saw in the model deviations. It hasn’t really gotten worse, but it hasn’t gotten better.
David: Yeah, I don’t think it’s gotten, there’s no substantial win that seemingly small businesses got through the submit your feedback deviation process so far. I’ll note that it’s really going to be moving agency responsibilities away from ensuring smalls are in the field and really towards this open and full competition. That’s the term of art that’s used throughout the entirety of the RFO is that they want open and full competition, and to me that reads somewhat as we don’t want to have to consider small businesses or do set-asides. Once Part 19 comes out, we already see within the model deviations that part of that is already suggesting that small business programs like the HUBZone, WOSB, EDWOSB, those won’t have sole sourcing anymore. It’s just going to be about keeping it within the small business world. So there’s seemingly a lot of things that are going to be lost for small businesses within those programs and within generally contracting.
Sam: Yeah, we’ve already seen memos from at least the Army directing their agencies not to use 8(a) sole source and wonder how far that’s going to go here. At the very least, speaking of small business authorities, sole source and whatnot, they at least took out the general reference to the Small Business Act and actually put in the names of the programs. I think that was my comment, actually. I put in that comment.
There was something previously, I think it said, you can use the authorities in Part 14A of the Small Business Act, which nobody knows what that 14A means, but that refers to all of the programs, small business set-aside, 8(a), HUBZone, SDVOSB, and WOSB. And maybe you save a few words by doing that, but you create a lot of confusion. They have now turned to at least put the actual words of the programs into Part 6 now. Part 6, which is the one that covers exceptions to full and open competition.
David: Yeah, and so that’s, you know, they took the loss on adding more words into the FAR, but I think that that’s all the better for its clarity.
Sam: Overall, the model deviations cut the FAR by 20%, I believe. It was 1,600 pages when you add it all up. Any predictions on this? It seems like you’re adding more in with the CUI and some of these other policies.
David: It’s going to keep building up and I think that this is gonna hit there’s gonna be aspects that they realize as it starts being implemented that they need to fill back in. And I think we’re quickly gonna get back to a long FAR again, but also changing it from 2,000 pages to 1,600 pages doesn’t... I think to most people, you don’t want to open either of those books. Like neither of those are short enough for me, and so I don’t know necessarily if that’s the substantive change that everyone’s been clamoring for that this is trying to promise.
Good News for SBIR/STTR Programs
Sam: There is some good news for small businesses involved in the SBIR and STTR programs in Part 6. Those reflect the Phase III sole source authority. That was not previously in the FAR. It’s been in the statute for quite some time. Agencies are certainly using Phase III sole source. But now you see it in the proposed rule. It’s also in the model deviation. So good news there for SBIR. And there’s a hidden recognition of changes to the SBIR data rights.
David: Yeah, very hidden. You caught that really well.
Sam: I don’t know if I was just searching for 20 years or small business, but there’s a provision in the FAR that tells contracting officers how long they must keep documentation for. And in the old FAR, there’s nothing about keeping documentation for SBIR contracts, but in this new proposed rule, there is a requirement that contracting officers keep SBIR contracts for 20 years. Why is it 20 years? Well, it doesn’t actually say, because this is just about documentation, but 20 years is the timeframe that SBA put into its policy directive for the SBIR program back in 2023 [actually, 2020]. So it’s been there for several years now. That’s a big expansion from the previous data rights. Previously, it was four years. So if you were going to keep with the old four years, which is what the current FAR has, you probably wouldn’t require contracting officers to keep the documents around for 20 years. It seems like the reason for keeping SBIR contract documents around for 20 years is the FAR, when it comes out, with the SBIR section, which is partly in... Mostly in Part 27 on data rights, somewhat I think in Part 19, it’ll probably have that 20-year data rights protection period. So that gives the government only government purpose rights for that 20-year period. So that’s a big win for SBIR companies.
David: Yeah, that will definitely be good to have people who are in the SBIR program to be saying, this is good for us, we appreciate this, and to really explain that when that does come into the comment period for this rule.
Sam: Yeah, so we’ll watch for that when Part 27 comes out with the data rights section. And that’ll provide consistency between the SBA rule and the FAR rules.
The New CUI and Cybersecurity Requirements
Sam: All right, CUI. We’ve been talking about CUI, CMMC, NIST, Revision 2, Revision 3. You have been immersed in this for several years now. Tell us what happened with the CUI proposal.
David: Yeah, so in 2025, there was a proposal, January 2025. Well over a year and a half ago there was a proposal for amending CUI data and the reporting of if you have an incident and originally it was proposing a 24-hour reporting. So if you find out that you have an incident you must report it within 24 hours of finding out. And a lot of small businesses that I had been talking to noted that that’s really tough because they’re probably on the field. They’re out. They can’t respond in such a quick timeline. This rule, there’s actually two areas where it kind of brings up old rules, both from January of 2025. But this CUI reporting one extends that to 72 hours. So again, you know, that’s three times the amount. It is kind of interesting that this is one of those substantive aspects of that... It’s now introducing new requirements and it’s kind of pushing through what was before an unpopular proposed rule and it’s pushing it through now as a proposal within this to kind of get it in there without maybe our attention on it.
Sam: We caught that. What would people want to focus on in the CUI or some of the other cyber-related aspects as they’re looking at potentially commenting?
David: Yeah, the other big aspect that’s changed is the introduction of NICE framework, which is a NIST Cybersecurity Framework. And that’s also a January 2025 proposed rule. It only got like eight comments total, but it did receive pushback on that. And now it’s trying to put through this NICE framework to essentially standardize and implement cybersecurity practices amongst the agencies, but also all contractors.
Sam: That’s cybersecurity workforce. Strengthening... it was a proposed rule from January 2025, Strengthening America’s Cybersecurity Workforce, the NICE framework.
David: And so these cybersecurity new requirements, I’m not going to pretend that I know how that’s going to affect every business because it’s going to just be a matter of familiarization. Part of this is each agency could have their own definitions, their own procedures, their own concepts of how to deal with cybersecurity risks. This takes away that ability and standardizes it throughout the government. And so it is going to be learning a new language and it’s going to be learning this framework. If you’ve been working under this NICE framework already, great, you’re already kind of ahead of the game, but if you’re not in one of those agencies that was applying NICE before, you’re going to have to learn this. There’s resources on the website, on this website for implementing NICE, but this is going to be a learn new definitions, those could change, particularly if you’re doing IT services or anything that is really touching cyber capacity, how are you managing this? And that’s not even mentioning CMMC which is also going on at the same time but only affects those within the Department of Defense.
Sam: So just so we don’t get ahead of it, there is not CMMC in this proposed rule. They are not proposing government-wide adoption of CMMC.
David: No, this is not the government-wide adoption. This is certainly a step towards that at least. It is a step towards creating a standardized, uniform cybersecurity framework for the entirety of government contracting. And I wouldn’t be surprised if at some point we see a CMMC government-wide, but we’re not even past the implementation point for CMMC right now. So I think that the government is waiting to see how that is kind of taken in, and then we might see that later on.
Sam: And the CUI proposed requirement here is NIST Revision 3. As opposed to NIST Revision 2. Does that make a difference?
David: I mean, it’s more updated and modern, which we always appreciate. One thing that’s... Having the more updated version of those CUI rules, great. But again, it is just part of that familiarization. It’s going to take you time to learn what are the differences between what have you been doing, what is this now requiring, what does that mean in practical sense for changing your business plan and your procedures to do these kind of reportings.
Sam: So this does seem like a lot to process, particularly if you’re subject to those requirements. And I imagine when the FAR put out these proposed rules in January of 2025, I’m going back and look, but I imagine they had more than a 30-day comment period.
The 30-Day Comment Period Debate
Sam: So tell me, what do you think? Do you think 30 days is an appropriate time to comment on these, at least in pre-publication on Monday, 1,000-plus pages?
David: Sure. You know, they’re going to take the stance that these are technically four separate rules. So each of those rules is only 200-ish pages. That’s nothing. And so if you chunk it out, sure, maybe. But it’s really hard to not see these as intertwined here. These are all really tied together. All four of these plus the eight that we haven’t seen in the Federal Register yet. It’s all about changing the FAR at a baseline. 30 days, that’s the technical requirement, that’s the APA. The Administrative Procedures Act says if you’re going to go through informal rulemaking process and seek public comment on those proposed rules, you need to permit 30 days to allow people to review and submit. That’s really not what most agencies go with though. As you may be very well aware, it’s usually 60 days. 60 days is really the norm for most agencies when proposing a rule. That’s purely a matter of practice though. That is really an unspoken norm within putting out public comments, particularly on more lengthy pieces. You do usually... an agency is going to permit time for the industry to understand it, to familiarize themselves with it, to compare it to what has been and what is being proposed here, and then to also seek meaningful data of surveys. How much is this... how long is this going to take you to familiarize yourself with? So often that is what an agency will do. If an agency does want to get something through fast, you usually put it through at 30 days because you just want to get it through. You want to meet the minimum time frames.
I’ll note that Gov Contract Pros just yesterday filed a comment letter in all of these dockets asking for an extension of 60 or 90 days to this comment period because it is such an intense review. As we’re already talking, we’ve talked about it’s the FAR as it is now is 2,000 pages. The model deviations are 1,600 pages. Now we also have a FAR companion guide that they updated for the model deviations. There’s other guidance. There’s guide management. Now they’ve just published that comments received and how they’ve dealt with them. Thousands and thousands of pages that they’re asking everyone to go through in a very short timeframe. Plus, these are including new statutory new provisions that were not proposed in the model deviation phase that have substantive effects on businesses. And so it would make sense to allow a longer timeframe on these comment letter solicitations because it is an intensive task they’re asking everyone to undertake. And most people, the people they want to hear from the most are the contractors. They want to hear from the businesses. But they have businesses to run. They have bottom lines. This is the end of the fiscal year. They’re very busy right now. And so this is going to be a large task if they actually do want the public to provide meaningful input to this rulemaking.
Sam: I’ll just emphasize to the FAR Council, if you want people to celebrate America’s 250th anniversary, the big birthday, don’t have them at home reading a thousand pages of proposed rules. It’s going to ruin somebody’s beach vacation.
Breaking Down the 12 Rulemaking Batches
Sam: They’re putting these out in batches. Do you have any insight on how they’ve selected these batches? How they’ve decided to put certain parts together and why there are 12 of them?
David: I mean, you can take that there’s 12 of them, four of them are out right now. The FAR Council is made up of three agencies, ostensibly NASA, DOD, and GSA. Ostensibly, that’s looking at each of them taking on about a third of it and kind of taking that on as an administrative task for their staffers. But then also, these are kind of looped together in the general... 7 and 10 are now together, so 7 and 10 are within the same rule. There is some logic to how these are being laid out as much as you can put logic in sorting through 52 different parts and trying to divvy them up into just 12 rulemakings.
Sam: Oh, that’s fascinating. It’s a big math problem. How do you divide 52 by 3 for three agencies and then try to get these out so that you’re not putting out the whole FAR at once? There were some rumors that they were going to put out all 52 parts at once. I’m glad that didn’t happen.
The Regulatory Flexibility Act (RFA) Explained
Sam: So when you were at the SBA Office of Advocacy, your big emphasis was on the Regulatory Flexibility Act, which, as you mentioned before, looks at the impact of regulations on small businesses. And when you hear about, oh, some law or some regulation cuts such millions of dollars from regulations, that’s where it comes from, right? The Regulatory Flexibility Act. So tell us a bit about generally how the Regulatory Flexibility Act works and how does it work specifically during this process for the FAR Overhaul?
David: Yeah, no, that’s a great question. It’s one of those parts of every regulation that even some of the most seasoned administrative law nerds don’t necessarily get into. And so the Regulatory Flexibility Act is really a way to ensure that the agencies are considering the impact a rule will have on small businesses, small nonprofits, and small government jurisdictions of under 50,000 people, i.e., local counties. The RFA asks for a... what I always told people was that the RFA should be essentially a 10-page or less section that you can hold, you can read through, and should be able to accurately explain the proposal. What is being proposed? What is being changed? Why are they doing this? How much will it cost you? And what do you need to do to comply with this new proposal? And then also it asks, what did the agency consider as a reasonable alternative that could lessen the impacts on small entities, but the agency chose not to pursue for another policy reason? Which can often be like, it’s just hard to implement a differentiation between the small and the big on a particular rule...
The Missing Data in the Regulatory Flexibility Analysis
David: And so the Regulatory Flexibility Analysis is really about trying to give some data and some actual numbers behind what is going on here and trying to inform small businesses what they need to know. As far as it relates to these rules and what we’re seeing right now, the regulatory flexibility analysis is there. It is stating that it will have an impact on small entities. It does not provide any estimates, though. And that’s where I think that within the public comment process, it is something that is really vital to be raising up now.
The entirety of this FAR Overhaul, it is asking you to read through the FAR again and again and again and again, as we’ve done over the past year. That’s a familiarization cost. That is a cost. Costs are not just the amount of money you had to dole out; it is about how much time is it taking your senior leaders to work through something. How much time do you have to then spend going over your existing procedures and implementing these changes? And so that’s something that is ostensibly left out of the Reg Flex analysis here, is that it doesn’t tell us how long they think it might take contracting officers to be trained on the FAR. It doesn’t tell us how long they think a small business will have to spend to familiarize themselves with this. And it doesn’t even begin to estimate the impacts of these changes on small entities—how much time and energy will go into implementing the NICE framework, into implementing these different aspects of how the market research changes will actually impact small businesses. It doesn’t attempt to put any numbers behind that right now. And so that’s where the public really needs to be writing comment letters saying, “This is my estimation,” because if you’re putting forward estimations and they’ve put forward nothing, your estimation becomes the official estimates.
The IRFA, FRFA, and Judicial Challenges
Sam: So tell me about how this works. They come up with something called the Initial Regulatory Flexibility Analysis, IRFA, and then small businesses, small entities comment on what the impact of this will look like, and perhaps they quantify that. Then the FAR Council then issues the FRFA [Final Regulatory Flexibility Analysis], right? So tell us about the FRFA and how that comes out.
David: So the FRFA is ostensibly the same document, the same analysis in many ways. So it’s still asking, what is the proposed rule? How will this impact small entities? What are reasonable alternatives that the agency chose not to pursue because of other policy concerns? But then the FRFA also asks, what were the comments received on the adequacy of the IRFA? And so they need to go through their comment record and specifically go through, specifically if the Office of Advocacy Chief Counsel files any concerns, those must be responded to by the issuing agency. And so often that would mean that the agency goes line by line through my comment letter or other of my former colleagues’ comment letters. But then it’s also about what has been sought in the public record that specifically calls it out. So if you are a small business commenting, I really recommend adding in an IRFA, FRFA call out, saying, “Here’s where I think the Regulatory Flexibility Analysis is lacking right now. Here’s what I think it would actually impact me. Here’s if you take my estimate of that and scale it out to all the contractors within the federal base, this is how much money you’re actually asking small businesses to expend on implementing this FAR.” And importantly, what I want to note is that an inadequate Final Regulatory Flexibility Analysis is judicially challengeable. And so you can sue an agency saying that they inadequately considered the impact their rule will have on small entities. And if a court finds in favor of it being an insufficient FRFA, then all small entities are exempt from that rulemaking.
Sam: Wow, so that could be a long game strategy for small businesses that might be upset about what’s in here, maybe from the CUI perspective or something else. Comment on this Initial Regulatory Flexibility Analysis, get your comment in, see if the FAR Council will actually issue a substantive final, the FRFA. And if they don’t, then that can be judicially challenged.
David: Yep, exactly. And then that would exempt all small entities from that rulemaking, which creates kind of a mess for the FAR Council to try and clean up. So it’s really in the issuing agency’s best interest to actually do a complete IRFA and FRFA and to adequately give weight to any comments they receive, and to make sure that particularly any data they receive is being adequately vetted and understood by that issuing agency.
The Role of the SBA Office of Advocacy
Sam: And you mentioned that the Chief Counsel for Advocacy comments get special weight. What do you expect to see from the Office of Advocacy there? And how is that weight applied during the FRFA process?
David: So the FRFA specifically has a section that says, “What were the concerns raised by the Chief Counsel of Advocacy and how do you move past those?” And so when I commented on CMMC, the Department of Defense was going line by line through my comment letter and saying, “Here’s what was raised as an issue, here’s how we’re pledging to commit engagement with small businesses and such.” So the Chief Counsel’s comment letters do get a kind of special weight. They’re literally the only comment letter that anyone can file that must be responded to no matter what. Whereas most comment letters just need to be meaningfully responded to if they raise significant issues that the counsel can actually deal with in the actual rule. When it comes to actually where Advocacy is working on that right now, I don’t know. I highly recommend that you reach out to the Office of Advocacy and contact their Assistant Chief Counsel there who’s managing government contracting and make sure that you’re voicing your concerns because, as someone who was in that role, we only know what small entities tell us are their concerns. It’s not in the business to make up small business concerns, but if you’re going through the Advocacy door and you’re saying, “Hey, I’m a small business, I’m meeting the Revolutionary FAR Overhaul, I’m concerned about the impacts it’s going to have on us,” you’re going to start that ball rolling to get a comment letter submitted into the Federal Register on that issue.
Strategic Tips for Submitting FAR Overhaul Comments
Sam: You’ve given a number of tips already for small businesses as they might be looking to comment. By the way, the deadline, July 23rd, did I get that right? July 23rd, currently, unless your comment encourages the FAR Council to extend it. What other tips do you have for businesses as they might be considering comments?
David: Yeah, I mean, one is in the immediacy, Gov Contract Pros has filed the comment letter asking for an extension. Actually, if you look right now, there’s only one other comment filed so far and it’s also asking for an extension. I really recommend that folks in the immediacy file for that extension because that’s going to start creating that chain of, is this being rushed through? Is this being arbitrary and capricious rulemaking? And so that’s the immediate thing. It’s a simple letter, doesn’t have to be complex, just make sure you’re making your case. On the broader scope of when you’re filing a comment letter for these four parts, it’s really going to be how you want to take it, of course. But what I really recommend is your first decision is do you file one comment letter on all four of them, or do you file four individual comment letters that speak to whatever part you’re looking at?
Sam: Or 12 or 16 because there are multiple agencies that are accepting them.
David: Yes, on the actual regulations.gov docket. Each agency posts this rule. So NASA, OFPP—DOD has actually not posted it—but GSA. So each of these four rules is posted three times by three different agencies. And so there’s a lot of different dockets. And so that’s going to make it kind of difficult for everyone to be tracking what comments were received, what comments, where did that land. But on the comment letter structure, the things I like to talk to folks about is, if you are a small business who is impacted by this, lead with your experience. As I’ve already noted, there is no data about how this is going to cost small entities. So your input on how this is going to impact you, even if it’s rough estimates of time, of money, of consultants you need to hire, of any amount of work that’s going to go through to implement the FAR Overhaul. If you are putting that in the public register, you are the one who gets to control what the narrative is around how much this costs, how many millions or billions of dollars will this cost the economy in red tape to go through to understand.
The other thing is, I’ve mentioned it when talking about the Regulatory Flexibility Analysis, but agencies have to consider reasonable alternatives to proposed rules that could lessen impact on small entities. So if you’re making reasonable proposals, if you’re actually dealing with the text as presented and going through that to present, “Hey, here’s where I think you could just change this wording.” That’s more helpful than a comment letter that is merely saying, “I don’t like this, this is horrible, please don’t ever do this.” That’s, of course, very valuable to have stated opposition or stated support for a rule, but it’s much more valuable to provide something to the government for them to consider, whether that be just reasonable alternatives or data. You know, small businesses, contractors, those who are implementing these contracts, they are the boots on the ground. They are the actual people who deal with the FAR. Everyone here in DC, we get to think about it. So your experience of being in the FAR, of having to deal with these, that is very valuable and much more persuasive than you might think at first.
Sam: Yes, these reasonable alternatives can bring up very good points. I’ll note that sometimes agencies have statutory guardrails that they can’t go past, so they have to stay within a particular lane there. But I remember several times at SBA where we received alternatives that we had not thought about because we are not living these regulations through day to day. We write them and we see the statutes as they come through, but it’s the businesses that have to cope with them.
Conclusion and Contact Info
Sam: David, how do people find more about you and about Gov Contract Pros?
David: You can find me on LinkedIn, David Mullis. You can always email me at david.mullis@govcontractpros.com. Follow us on LinkedIn, GCP, our website (govcontractpros.com). I’m certainly around DC a lot, so it’s not too hard to find me usually.
Sam: Great going around DC with a 2,000-page book of the FAR.
David: Exactly. I’ll be the one with the thousands of pages of FAR on hand.
Sam: Looking forward to seeing your comments on these rules and the next batches that come out. Thanks so much for joining us on the show.
David: Thank you for having me, Sam.
Sam: Thanks, David.
With 20 years of Federal legal experience, Sam Le counsels small businesses through government contracting matters, including bid protests, contract compliance, small business certifications, and procurement disputes. Sam received his law degree from the University of Virginia and formerly served as SBA’s director of procurement policy. His website is www.samlelaw.com.
This video is for informational purposes only and does not constitute legal advice.
