Get tomorrow's brief in your inbox
Today: DoD raised the TINA certified cost/pricing data threshold to $10M effective July 1, published new IT category management policy affecting all components, and reminded contractors about Chinese military company lobbyist restrictions while remote worker fraud cases highlight FCA exposure for workforce attestation failures.
DoD IT Category Management Directive (DoW Instruction 8000.02) Takes Effect
Pentagon CIO Kirsten Davies approved a department-wide directive (effective July 29) establishing policy for IT category management across all DoD components, including national security systems and defense business systems. The instruction mandates use of enterprise capabilities before pursuing individual IT investments "unless mission or cost dictate otherwise," emphasizes best-in-class purchasing vehicles (core enterprise technology agreements, joint enterprise licensing agreements), and requires cyber supply chain risk management in ITCM acquisition programs. Key requirement: program managers must assess the suitability of DoD-wide purchasing solutions when acquiring commercial IT. The directive establishes the ITCM Cross Functional Board (chaired by the deputy CIO for the information enterprise) as the senior decision body and the Enterprise Software Initiative Working Group as the implementation lead. Action item: If you sell IT products/services to DoD, familiarize yourself with the ESI framework and best-in-class contract vehicles; if you're a contractor buying IT, expect more centralized purchasing and less component-level discretion. Source
Chinese Military Company Covered Lobbyist Prohibition: DoD Publishes Guidance
DoD published a two-page guidance document ("PROJECT CLEAR Contractor Lobbying Evaluation for Adversarial Relationships") and a webpage implementing Section 851 of the FY 2025 NDAA (10 U.S.C. § 4663), which restricts defense contractors from retaining outside consultants who lobby for Chinese military companies. The guidance focuses on relationships with entities on DoD's 1260H list, a narrower scope than the broader definition in the DFARS class deviation. Action item: If you use outside consultants, lobbyists, or government relations firms, confirm they do not represent entities on the 1260H list; failure to comply could trigger contract termination or suspension. The guidance is available on DoD's website; Covington's analysis notes the narrower focus may provide some relief but does not eliminate the compliance burden. Source
$10 Million TINA Threshold Now in Force (As of July 1, 2026)
The FY 2026 NDAA raised the threshold for requiring certified cost or pricing data from $2.5M to $10M, effective for contracts entered into after June 30, 2026. Contracts entered into on or before June 30 remain subject to the $2.5M threshold, and modifications to legacy contracts still trigger certification at the old threshold. The statutory change is operative now, even though FAR 15.403-4 has not yet been amended (still shows $2.5M). Contracting officers are instructed to apply the $10M threshold immediately. Critical detail: This is not retroactive and the two thresholds will coexist for years. A contractor negotiating a new award after July 1 applies the $10M threshold; a modification to a pre-July 1 contract applies $2.5M. Subcontractors should confirm with primes which threshold applies, as a subcontract entered into after July 1 may still be governed by $2.5M if the underlying prime was awarded before July 1. Action item: Map every pending award, modification, and subcontract that straddles the July 1 cutoff; update proposal templates and compliance checklists; do not assume the higher threshold applies without confirming the contract entry date. Defective pricing stakes (downward adjustment with interest, FCA exposure) remain unchanged. Source
Remote Worker Fraud: Foreign Actors and FCA Exposure for Contractors
Organizations are discovering that remote workers they hired may not be the people actually performing the work, with cases ranging from "paycheck fraud" (one person working multiple jobs using AI-assisted interviews or stolen credentials) to foreign actors accessing systems via laptop farms. DOJ recently prosecuted multiple cases involving a North Korean remote worker scheme in which employers believed workers were in Virginia (where laptops were physically located) but the work was performed from North Korea via installed software. For government contractors, this creates three compliance risks: (1) Export control violations if data is accessed from prohibited jurisdictions, (2) Cybersecurity/data breach obligations if unauthorized persons access CUI or other controlled data, and (3) False Claims Act liability if you represented to the government that a specific person is doing the work or that personnel are located in the U.S., then discover a breach. Action item: If you hire remote IT workers, implement controls to verify identity and location (not just at hire, but continuously); if you discover a mismatch, determine whether you have a reporting obligation under your contract or DFARS 252.204-7012 (cyber incident reporting). During the CMMC Phase 2 suspension, self-attestation plus FCA enforcement is the center of gravity; a workforce fraud discovery that contradicts your SSP or SPRS attestation is an FCA risk. Source