Get tomorrow's brief in your inbox
Today: A federal court dismissed an FCA cybersecurity complaint against Archer Daniels Midland on materiality grounds, the first such ruling since 2022 and a signal that DOJ's Civil Cyber-Fraud Initiative faces judicial limits on what constitutes a viable cybersecurity fraud claim. GSA flagged a SAM.gov glitch that may have corrupted small business representations, and DoD is moving to replace government-unique Cost Accounting Standards with GAAP.
DoD moves to replace Cost Accounting Standards with GAAP. The Pentagon is shifting from government-unique Cost Accounting Standards (CAS) to Generally Accepted Accounting Principles (GAAP), aiming to lower barriers for commercial firms entering defense contracting. Status: policy direction announced, no final rule yet. DIB contractors currently subject to CAS should not change their accounting systems yet, but finance teams should begin assessing what a GAAP-only environment would require for indirect rate structures and incurred cost submissions. Commercial firms considering defense work should note this as a potential reduction in compliance overhead. (Federal News Network via PilieroMazza)
Revolutionary FAR Overhaul: comment period open. The FAR Council published proposed rules on September 18 covering Parts 8, 9, 12, 13, 14, 15, 16, 17, 27, 28, 35, 36, 38, 44, 47, 51, and 52. Comments close October 19, 2026. Any DIB contractor or MSP that touches subcontracting (Part 44), contract types (Part 16), or commercial item procedures (Part 12) should review the proposals and submit comments. (Federal Register via PilieroMazza)
SBA extends comment period on size standard overhaul to November 20. The proposed rules would increase some small business size thresholds by up to 10x. SBA has already received nearly 70,000 comments. If your NAICS codes are affected, the expanded thresholds could change your competitive landscape for set-aside contracts. Review the proposals and comment by November 20. (Crowell)
First court dismissal of an FCA cybersecurity complaint on materiality grounds. In United States ex rel. Pannek v. Archer Daniels Midland Co. (N.D. Ill., Sept. 2, 2026), Judge Harjani dismissed a qui tam cybersecurity FCA complaint, ruling the relator failed to show ADM's cybersecurity representations were material to the government's payment decisions. Key holdings: (1) general assertions about the government's interest in cybersecurity are insufficient; the relator must show specific facts that cybersecurity compliance influenced payment decisions for that contractor's contracts; (2) merely designating compliance as a "condition of payment" does not establish materiality under Escobar; (3) implicit certification theories require identifying an affirmative false statement. (Crowell)
What this means during the CMMC suspension: DOJ's Civil Cyber-Fraud Initiative has recovered $50M+ across nine settlements in 2025 alone, but nearly all were pre-litigation settlements. This is the first contested court ruling since 2022, and it raises the bar for relators. Self-attestation under DFARS 252.204-7012 and NIST 800-171 remains enforceable via the FCA, but a relator now needs to show the specific contracting agency cared about cybersecurity compliance when making payment decisions, not just that cybersecurity was mentioned in contract terms. This does not reduce your obligation to maintain accurate SPRS scores and SSPs. It does suggest that speculative qui tam complaints lacking contract-specific materiality evidence face dismissal. Contractors should still treat self-assessment accuracy as an FCA risk, but can take some comfort that courts are applying Escobar's materiality standard rigorously.
BEC recovery: $375,000 seized. The Northern District of Iowa recovered $375,000 in fraud proceeds from a business email compromise scam. Not CMMC-specific, but BEC remains the top financial cyber threat to defense contractors. If your organization handles CUI or processes government payments, ensure email authentication (DMARC, DKIM, SPF) is enforced and wire transfer procedures include out-of-band verification. (DOJ)
GSA SAM.gov glitch: validate your small business representations now. A known bug has reset FAR 52.219-1 small business program representations for some SAM registrants, displaying "N/A" instead of the correct "Yes" or "No" for NAICS code size certifications. This has affected registrations since spring 2026. Check your Representations and Certifications section immediately. Incorrect data could affect eligibility for pending or upcoming awards and create compliance risk. Re-enter receipts and employee counts to restore accurate entries. This is a data correction, not a recertification against a specific contract. (Crowell)
Navy MUSV marketplace expanding. The Navy issued a call for solutions to onboard Phase II medium unmanned surface vessels to the drones.mil marketplace using a commercial solutions opening. Platforms must be demonstration-ready at submission. Relevant for DIB contractors in autonomous maritime systems, but also a signal that DoW acquisition is leaning further into digital marketplace models for rapid procurement. (DefenseScoop)
GAO protest dismissed as sanction for fabricated facts. In Aim for AdVantage, LLC, GAO dismissed a protest after forensic evidence proved the protester fabricated claims about system failures preventing timely proposal submission for the Army's $50B MAPS IDIQ. Lesson: forensic logs are definitive. If you miss a submission deadline, do not misrepresent the circumstances. (Crowell)
Boundary scoping for FedRAMP Moderate cloud tools. An r/CMMC thread asks whether users can access Box/Kiteworks/PreVeil outside the FedRAMP-authorized virtual machine boundary. The core question: if your authorization boundary is a secure VM environment, can users authenticate to the same cloud service from outside it? The answer depends on your authorization boundary definition and how you enforce access controls. If the cloud service is only authorized within the VM boundary, accessing it from outside is out-of-scope and could introduce CUI handling outside your assessed environment. Restrict access via conditional access policies (IP allowlisting, device compliance) rather than relying on user discipline. This is a common scoping mistake in NIST 800-171 SSPs. (r/CMMC)