Unpacking FAR Case 2026-001: What The Overhaul Means For SAM Registration, Agency-Level Protests, And Information Security And Supply Chain Security

As promised in our recent blog post, Revolutionary FAR Overhaul Update: Rulemaking Phase Begins with the Issuance of Four Proposed Rules, we’re now digging a bit deeper into FAR Case 2026-001.

On June 23, 2026, the Federal Acquisition Regulatory Council (“FAR Council”) published a proposed rule titled, Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53 (the “Proposed Rule”) under FAR Case 2026-001. This is one of twelve proposed rules under the “Revolutionary FAR Overhaul” (“RFO”) implementing Executive Order (“EO”) 14275, Restoring Common Sense to Federal Procurement. Below, we break down everything you need to know about the Proposed Rule, including how it stacks up to the previously published RFO model deviations. Comments are due July 23, 2026.

FAR Case 2026-001

This Proposed Rule covers the following FAR Parts:

• Part 1 – Federal Acquisition Regulations System
• Part 2 – Definitions and Acronyms
• Part 4 – Administrative and Information Matters
• Part 33 – Protests, Disputes, and Appeals
• Part 39 – Acquisition of Information and Communication Technology
• Part 40 – Information Security and Supply Chain
• Part 53 – [Removed and Reserved]

The below analysis highlights the most significant changes across the affected FAR Parts, including changes from the originally published RFO deviations. While all of the revisions are worth understanding, the sharpest departures from current practice are concentrated in Parts 4 and 40.

The Key Changes

FAR Part 1 – Federal Acquisition Regulations System

Sunset Clause: The Phase 1 model deviation included a “sunset” mechanism that automatically expired all non-statutory FAR language after four years. That concept is gone. Non-statutory FAR language does not automatically expire and may only be removed via formal rulemaking. The Proposed Rule replaces this concept with a formal regulatory sunset review process at regular intervals where the FAR Council will seek public input via rulemaking on non-statutory sections, provisions, and clauses prior to their expiration.

Bottom line: Non-statutory FAR language will not automatically expire, but the FAR Council has committed to an ongoing review process for identifying and removing outdated requirements.

FAR Part 4 – Administrative and Information Matters

Modernization: Part 4 reflects procurement data modernization. Notably, FPDS.gov has been retired and contract award data now resides in System for Award Management (“SAM”) Contract Awards Management. Further, the Proposed Rule relocates internal procedures to nonregulatory resources, giving agencies more flexibility in leveraging technology.

SAM Registration: The Proposed Rule introduces one of the most operationally significant changes in the entire package: a fundamental restructuring of how SAM.gov is used in the procurement process. It streamlines SAM by retaining only entity-level representations and certifications in SAM.gov and removing procurement-specific representations and certifications from SAM for use in solicitations. This change removes over half of the information that was previously required to register to do business with the Federal Government—this includes representations and certifications regarding, for example, supply chain matters such as Section 889 compliance. FAR 52.204-8 (Annual Representations and Certifications) would be eliminated. In its place, revised clauses 52.204-7 and 52.204-13 (when SAM registration is required) and new clauses 52.204-XX and 52.204-YY (when SAM registration is not required) would consolidate entity identification.

Service Contract Reporting: The Proposed Rule would revise certain reporting clauses (FAR 52.204-10, 52.204-14, and 52.204-15) to exclude them from contracts for commercial acquisitions. This move aims to reduce the administrative burden for industry and simplify procurement administration for the government.

Bottom line: The SAM restructuring is a significant step forward in reducing administrative burdens on contractors.

FAR Part 33 – Protests, Disputes, and Appeals

Purpose Statement: A new explicit purpose statement for the bid protest system was added, emphasizing efficient resolution, minimal disruption, rapid correction of procurement errors, safeguarding rights to independent review, and discouraging abuse—while stating expressly that protests are not intended to function as debriefing substitutes. This addition reflects a policy concern about the use of protests as a discovery mechanism in lieu of the formal debriefing process.

Agency-Level Protest Transparency: On the agency protest side, two reforms stand out: (1) contracting officers would be required to report protests to the head of the contracting activity, increasing management visibility; and (2) for independent review above the contracting officer level, the protester would be entitled to receive redacted copies of the agency’s final technical evaluation and source selection decision and to raise additional protest grounds within a reasonable time set by the independent review official. The second change is particularly significant; it gives protesters meaningful access to the evaluation record at the agency level, potentially enabling more issues to be resolved without escalating to Government Accountability Office (“GAO”).

Streamlined Text: Additionally, the Proposed Rule streamlines GAO protest coverage by removing duplicative FAR text and cross-referencing GAO’s own regulations at 4 CFR Part 21.

Bottom line: Greater access to evaluation documentation could make agency-level protests a more attractive first step before heading to the GAO.

FAR Part 39 – Acquisition of Information and Communications Technology

Scope: Part 39 receives a significant structural and substantive overhaul. Part 39’s scope is broadened from “information technology” to “information and communication technology (ICT),” signaling a framework designed for cloud, agile, and AI-era procurements. The breadth of the new scope matters: it positions Part 39 as the regulatory home for technology acquisitions well beyond traditional IT systems.

Privacy Requirements: The Proposed Rule removes FAR 39.105, Privacy, and FAR 52.239-1, Privacy or Security Safeguards, as inconsistently used and duplicative, on the stated basis that other FAR controls and external security control plans cover these safeguards more effectively. Contractors currently relying on FAR 52.239-1 as the primary vehicle for security safeguarding requirements should note that those obligations are not eliminated; they are being addressed through Part 40 and agency-specific security control frameworks.

NICE Framework: The Proposed Rule also consolidates the National Initiative for Cybersecurity Education (“NICE”) Framework cybersecurity workforce initiative into Part 39, requiring agencies and contractors, when specified, to align cybersecurity workforce tasks, skills, and roles with the NICE Framework per the National Institute of Standards and Technology (“NIST”) Special Publication (“SP”) 800-181 for IT and cybersecurity support services. This is a concrete workforce competency requirement that IT services contractors should build into their staffing and deliverable planning.

PNT: Part 39 also introduces a Positioning, Navigation, and Timing (“PNT”) services planning requirement: when acquiring products, systems, or services dependent on PNT services, contracting officers must work with the requiring activity to incorporate the Cybersecurity and Infrastructure Security Agency’s (“CISA”) Federal PNT Services Acquisitions Guidance as appropriate. This reflects growing concern about supply chain vulnerabilities in PNT-dependent systems.

Bottom line: Contractors providing IT, cloud, or cybersecurity services should monitor Part 39 closely. This Proposed Rule sets the framework for more targeted, technology-focused rulemaking to come.

FAR Part 40 – Information Security and Supply Chain Security

Reorganization: This is the big one. Part 40 is the most substantially revised section in this package with its overarching goal as consolidation. Part 40 is reorganized into three subparts: (1) Processing Supply Chain Risk Information; (2) Security Prohibitions and Exclusions; and (3) Safeguarding Information. It consolidates security-related requirements previously scattered across multiple FAR Parts, introduces a unified “do not buy” list concept (a consolidated list of security prohibitions and exclusions in FAR 52.240-3), and reduces multiple security provisions and clauses into fewer instruments. It also incorporates several open FAR cases, including rules on Controlled Unclassified Information (“CUI”), Section 889 (Parts A and B), Federal Acquisition Supply Chain Security Act (“FASCSA”) orders, ByteDance/TikTok prohibition, and the American Security Drone Act.

Harmonized Due Diligence and Reporting Standards: A recurring contractor pain point has been inconsistencies across different supply chain and security prohibitions, many with slightly different due diligence obligations and reporting requirements. The Proposed Rule addresses these concerns directly: a single “reasonable inquiry” standard is adopted across prohibitions, clarifying that offerors and contractors are not required to conduct internal or third-party audits or gather information outside their possession for any of the consolidated supply chain restrictions, significantly reducing compliance uncertainty and potential liability exposure. The Proposed Rule also standardizes reporting and disclosure timeframes across prohibitions to 72 hours from discovery, with just one required report. For contractors currently navigating overlapping and sometimes conflicting reporting timelines under different clauses, this standardization is a meaningful simplification.

Covered Procurement Actions under FASCSA: The Rule implements Section 203 under, FASCSA (41 U.S.C. § 4713), authorizing agencies to take certain “covered procurement actions.” Under this authority, agencies can exclude certain products, services, or sources from the Federal supply chain in the interests of national security. Covered procurements are those involving specified covered articles where supply chain risk is part of the acquisition—these are determinations that can be separate and apart from the formal governmentwide FASCSA exclusion and removal orders. Agencies must establish procedures and contracting officers must identify and update solicitations and contracts when covered procurement actions apply, including post-award updates generally within six months of the requiring activity’s determination.

Standard CUI Form: On CUI specifically: the Proposed Rule establishes a standardized mechanism, Standard Form (“SF”) XXX, for communicating CUI requirements to contractors. The SF XXX should specifically identify what CUI is involved and how it must be safeguarded and marked. There is also the addition of FAR 52.240-6 (notice) and FAR 52.240-7 (CUI clause) where CUI is involved (note that this is generally not applicable to solicitations and contracts solely for commercial off-the-shelf (“COTS”) items).

CUI Incident Reporting: The Proposed Rule also updates CUI incident reporting to 72 hours from discovery with an initial report containing available information and follow-on updates as needed. Further, it provides specific reporting locations (DoD via DIBNet; non-DoD agencies via the CISA reporting site), updates subcontractor reporting to require direct reports to the Government with notifications up the contracting chain, narrows and clarifies the definition of “CUI incident,” removes prescriptive training and contractor-liability language, and includes FedRAMP-related reporting exceptions. Specifically, FedRAMP-authorized cloud providers following FedRAMP incident procedures need not submit an additional report.

Bottom line: Part 40 represents one of the most operationally significant consolidations in this entire rulemaking. Contractors who handle sensitive information or operate in the supply chain security space should review the CUI provisions carefully.

How to Submit a Comment

Comments for this rulemaking are due July 23, 2026. Comments may be submitted online on the Federal eRulemaking portal. Be sure to reference “FAR Case 2026-001” in the comment submission and include your name and company name on any attachments.

Conclusion

FAR Case 2026-001 touches virtually every phase of the contracting lifecycle—from entity registration to protest rights to cybersecurity compliance. While some changes are largely structural (plain-language rewrites, consolidations), others, particularly in Parts 4 and 40, will require contractors to make real operational adjustments. The FAR Council has demonstrated it is paying attention to industry feedback. Now is the time to engage.

For additional guidance on FAR Overhaul developments, please review our latest blog posts here or visit our Revolutionary FAR Overhaul Tracker webpage. We will continue to follow the RFO process closely and will provide additional analysis as the remaining proposed rules are published.