Third Quarter 2025 Government Contracts Policy and Regulatory Review

At a Glance

• The FAR Overhaul has progressed through new model-deviation texts and agency-level class deviations — most notably for FAR Part 19, which preserves the Rule of Two for small business set-asides, but slightly alters its discretionary application under multiple-award contracts.
• The Department of Transportation has removed automatic presumptions of social and economic disadvantage based on race or sex in disadvantaged business enterprise (DBE) and airport concession DBE programs, meaning all applicants under these programs must now seek reevaluation and provide individualized evidence of disadvantage.
• The Department of Defense issued the final DFARS rule implementing the Cybersecurity Maturity Model Certification, effective November 10, 2025. DoD also provided guidance on duty-free entry for qualifying imports and published its inflation-based adjustments to various acquisition thresholds.

As the federal procurement landscape continues to evolve under the second Trump administration, the third quarter of 2025 brought a wave of significant regulatory and legislative developments to the fore for federal contractors and grantees. From the long-anticipated CMMC final rule to broad-based changes under the FAR Overhaul, we summarize several of these updates below.

More recently, federal contractors and grant recipients have also experienced operational and financial disruptions due to the government shutdown, which we covered in greater detail in a previous client alert. Federal funding recipients should also consider the impact of new federal grantmaking procedures mandated by executive order, which we outlined in another article earlier this year.

FAR Overhaul Initiative

Building on its reform efforts over the summer, the FAR Council has expanded its “Revolutionary FAR Overhaul” (RFO) initiative through the continued publication of model deviation texts and corresponding agency adoptions. The initiative is driven by Executive Order 14275, “Restoring Common Sense to Federal Procurement,” directing the FAR Council to “amend the FAR to ensure that it contains only provisions that are required by statute or that are otherwise necessary to support simplicity and usability, strengthen the efficacy of the procurement system, or protect economic or national security interests.”

By the end of September, model deviation texts had been released for all FAR parts under the RFO initiative. Although the model deviation texts issued by the FAR Council are not directly binding on government contractors, agencies have issued class deviation memoranda designed to implement the revisions (e.g., GSA class deviation for FAR Part 19). Many of the agency class deviations direct contracting officers to utilize the RFO model deviation language in new solicitations or contracts, while providing discretion for contracting officers to amend contract provisions in existing contracts as they see fit. Contractors can access the agency deviations associated with each revised FAR subsection on the RFO website. The FAR Council has also published “practitioner albums” to assist agency officials and government contractors in navigating the changes, with each “album” including a summary of key changes, a redlined version of the FAR text and practitioner tools to assist with implementation of revised clauses.

Although the changes to most “overhauled” FAR parts are largely procedural and focused on reorganizing clauses or removing duplicative language, several subparts include substantive changes that may impact government contractors going forward. In particular, the new model deviation text for FAR Part 19 — detailed further below — provides greater discretion to contracting officers in utilizing the “Rule of Two,” potentially affecting competitive bidding procedures for small businesses and other contractors eligible for set-asides (e.g., AbilityOne businesses). Additionally, the model deviation issued for FAR Part 36 (Construction and Architect-Engineer Contracts) removes applicability provisions, pre-award site inspection requirements and minimum workforce expectations (i.e., potentially allowing for greater subcontracting in construction contracts). The model deviation for FAR Part 40 also includes streamlined representations regarding contractor obligations to conduct a “reasonable inquiry” into not providing or using covered telecommunications equipment and services. In a number of instances and as evidenced by proposed changes to FAR Part 8, much of the preexisting language has been moved to agency “guidance” memos, which OMB has made clear are not legally binding. It is important that entities impacted by the “streamlining” of the FAR are cognizant of potential impacts of this effort, including as it relates to the filing of bid protests.

The FAR Council has created an informal feedback link for practitioners and interested parties to provide recommendations for additional revisions or perceived conflicts contained in the revised FAR provisions. Feedback is due by 4:30 p.m. ET on November 3, 2025. The FAR Council is also required to undertake a formal notice-and-comment rulemaking process to implement its proposed changes to the FAR in the coming months. Government contractors and interested parties will have additional opportunities to submit comments during this formal process.  

FAR Part 19 Rewrite

On September 26, 2025, the FAR Council released new model deviation text for FAR Part 19 (Small Business), opening it for informal feedback through November 3, 2025, on the FAR Overhaul website. As it has done in conjunction with other new model deviation texts, the General Services Administration (GSA) also issued a class deviation that directs its contracting workforce to adopt the new FAR Part 19 deviation language for new solicitations.

A key change under the FAR Part 19 class deviation relates to the “Rule of Two,” which requires federal agencies to set aside a contract award for small businesses whenever they determine there are at least two small businesses that will bid and can offer “competitive” pricing, quality and delivery terms. The rewrite clarifies that contracting officers maintain discretion regarding the use of set-asides under multiple-award contract vehicles (i.e., task orders). Accordingly, under the revised version of FAR 19.111-2, a contracting officer’s decision to set aside (or not) an order placed under a multiple-award contract is an exercise of discretion and cannot serve as the basis for a protest.

The new model deviation text for FAR Part 19 maintains the “Rule of Two” for contracts between the micro-purchase threshold and the simplified acquisition threshold, as required by statute, and retains the “Rule of Two” for contracts above the simplified acquisition threshold as “essential to sound procurement,” according to the practitioner album.

Going forward, contracts may also be automatically released from the 8(a) program if a follow-on procurement will be set aside under the HUBZone, service-disabled veteran-owned small business, or women-owned small business programs. Separately, the revised text also removes automatic re-representation requirements for orders under multiple-award contracts, meaning that size determinations will remain fixed at the contract-level and will only be revisited upon triggering events (e.g., novations, option exercises, etc.).

The GSA class deviation is slated to go into effect on November 3, 2025, and remains in force until formally rescinded or incorporated into the FAR.

Monitoring Further Developments

Government contractors — particularly those involved in set-aside opportunities — should monitor agency ordering policies and engage with their contracting officers about set-aside rationales going forward. Small businesses should also consider pursuing broader award opportunities beyond set-aside awards, particularly as set-aside opportunities associated with task orders may diminish as the new model deviation text is implemented. Contractors should also track or consult with counsel regarding which agencies have adopted the class deviation and where deviation text is being used on an interim basis, before the FAR Council proceeds with its formal notice-and-comment rulemaking process.

DOT Ends Race- and Sex-Based Presumptions From DBE and ACDBE Programs

On September 30, 2025, the Department of Transportation (DOT) issued a memorandum regarding an interim final rule to eliminate race- and sex-based presumptions of social and economic disadvantage in its Disadvantaged Business Enterprise (DBE) and Airport Concession DBE (ACDBE) programs. DOT subsequently issued an interim final rule on October 3, 2025, to remove the presumptions from the DBE program regulations set forth at 49 CFR Part 23. As a result, program participants will no longer be presumed as disadvantaged based on race or sex, and now must make an individualized showing of social or economic disadvantage.

The interim final rule follows a September 2024 decision by the U.S. District Court for the Eastern District of Kentucky in Mid-America Milling Co v. U.S. Department of Transportation, determining that the DBE program’s use of race- and sex-based presumptions likely did not comply with constitutional equal protection requirements, particularly following the Supreme Court’s 2023 decision in Students for Fair Admissions. See No. 3:23-cv-00072, 2024 WL 4267183 (Sept. 23, 2024).

Under the interim final rule, all program participants currently certified under DOT’s Unified Certification Program (UCP) — which allows applicants for the agency’s DBE program to apply only once for a DBE certification to be honored by all state agencies — must be reevaluated under the new standards. Until program participants complete the reevaluation process with the UCP, recipients and participants previously covered by the UCP are not permitted to include DBE contract goals or concession-specific ACDBE goals or count any participation toward overall DBE or ACDBE goals. Further, the interim final rule eliminates requirements for recipients to obtain and report bidder information about race and sex.

Contractors previously certified under these programs should prepare for reevaluation to ensure they can make an individualized showing of social or economic disadvantage in accordance with the new standards and consider revising their internal procedures to reflect new certification and reporting standards.

Defense Industry Updates

The Department of Defense (DoD) issued several regulatory updates and memoranda in the third quarter, spanning issues across cybersecurity, import policies and national supply chain integrity.

CMMC Final Rule Published: Phased Implementation Begins

As covered in a previous client alert, the DoD published a final rule on September 10, 2025, to implement the Cybersecurity Maturity Model Certification (CMMC) program by introducing new Defense Federal Acquisition Regulation Supplement (DFARS) requirements for contractors handling sensitive unclassified information. The CMMC program institutes a standardized, tiered model of practices and processes for contractors and subcontractors to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).

The rule takes effect on November 10, 2025, initiating phased roll-out:

• Years 1-3 (Nov. 2025 through Nov. 2028): CMMC requirements apply only when program offices determine they are necessary, using a phased approach.
• Year 4 and beyond (Starting November 10, 2028): CMMC compliance will be mandatory for all contracts involving contractor systems that process, store or transmit FCI or CUI, excluding COTS-only contracts.

Among other changes, the final rule introduces new and enhanced definitions at DFARS 204.7501, including a new definition for FCI to align the definition with that included at FAR 52.204-21 (“information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments”). The final rule also permits contractors to hold conditional CMMC status in certain instances and specifies that subcontractors must submit affirmations of continuous compliance and the results of self-assessments for any system processing FCI or CUI.

Contractors should continue to review all active and anticipated DoD contracts to determine required CMMC levels and consider conducting a gap analysis to remediate any deficiencies in their cybersecurity systems prior to conducting self- or third-party compliance assessments. Notably, contractors lacking a solicitation’s required CMMC status at the time of award will be ineligible for the contract, making it vital that contractors shore up their internal systems prior to submitting new bids. Failure to maintain continuous compliance during the life of a contract may result in liability under the False Claims Act (FCA), made particularly important following a recent wave of FCA prosecutions relating to cybersecurity and DFARS compliance.

Expanded Guidance on Duty-Free Entry for DoD Contractors

On August 25, the DoD issued a memorandum to reaffirm and clarify its policy on duty-free entry (DFE) for qualifying imports under DFARS 252.225-7013. Under that clause, contracting officers have discretion to award contractors with duty-free import certificates for supplies exempted from duty pursuant to Subchapters VIII and X of Chapter 98 of the Harmonized Tariff Schedule of the United States (19 U.S.C. 1202). Specifically, the August 25 memo directs contracting officers to include or modify contracts to include the clause for contracts or orders that anticipate delivery of end products, components or materials imported into the customs territory of the United States. Contracting officers are also directed to indicate in solicitations and indefinite delivery contracts that any subsequent contract actions will include the duty-free entry clause, and the contractor should use the clause to assure that appropriate shipping documentation is used to prevent incurring duties.

Relatedly, the Defense Contract Management Agency (DCMA) released updated training guidance emphasizing that contractors must exclude duties from contract pricing when eligible, and must follow strict documentation protocols for entitlement requests. The guidance also specifies that contractors are responsible for submitting duty-free entitlement requests on behalf of subcontractors, and that administrative contracting officers will review the prime and subcontractor’s requests in accordance with DFARS PGI 225.902 and DFARS 252.225-7013(h).

DoD Inflation Adjustments

On August 25, 2025, the DoD issued a final rule amending the DFARS to adjust acquisition-related thresholds for inflation, as required by 41 USC 1908 every five years. Thresholds across multiple DFARS parts were updated to reflect inflation, including those related to contract award announcements (required for all contracts exceeding $9M), liquidated damages (now applying to construction contracts exceeding $900,000), post-award debriefings (now required for contracts valued at $15M or more) and small business set-aside thresholds. Notably the adjustments do not apply to thresholds under the Davis-Bacon Act, Service Contract Labor Standards, performance and payment bonds, or trade agreements.

Semiannual Regulatory Agenda

The Office of Federal Procurement Policy (OFPP), DoD, GSA and National Aeronautics and Space Administration (NASA) published an overview of upcoming and ongoing rulemaking efforts under the FAR as part of their Semiannual Regulatory Agenda on September 22, 2025.

Key regulatory developments referenced in the agenda include cybersecurity and supply chain security initiatives (e.g., through FASCA orders), telecommunications restrictions (e.g., prohibiting contracting with entities using or providing certain Chinese-manufactured equipment), CUI handling, and new definitions and clauses to help agencies identify and mitigate OCI risks in federal acquisitions. Contractors should continue to monitor rulemaking timelines and prepare for the implementation of final rules expected later this year or in early 2026.

What’s Next?

Federal contractors should continue to stay apprised of additional changes to the FAR and agency-specific procurement policies, particularly as the FAR Council proceeds with formal notice-and-comment rulemakings regarding its FAR Overhaul initiative. Contractors and federal grant recipients should also work closely with their contracting officers and legal counsel to navigate the impact of the federal government shutdown and new federal grantmaking procedures mandated by executive order.

We encourage federal contractors and grant recipients to contact counsel to engage in compliance risk assessments and contract reviews as needed, particularly as agencies contemplate pursuing enforcement actions with greater frequency going forward.

For More Information

Faegre Drinker’s government contracts team will continue to monitor additional regulatory and legislative developments in the coming months.