Federal Market Frontlines: This One Compliance Update Will Change GovCon Forever

The Revolutionary FAR Overhaul is rewriting federal acquisition rules right now, and every contractor needs to understand what's changing before it's too late. PSC President Stephanie Kostro joins Federal Market Frontlines to break down FAR overhaul compliance, the companion guide reality, and how to manage risk across legacy contracts already in place. From agency supplement fragmentation to CMMC dual compliance pressures, this episode covers what contractors at every level must act on today.

Subscribe for more conversations with the leaders shaping federal contracting and corporate security.

Follow Federal Market Frontlines and TechnoMile: https://technomile.com | LinkedIn YouTube Facebook

Have a guest suggestion or topic idea? Please email: marketing@technomile.com.

Transcript

SPEAKER_01 0:00

You don't want to be in the position where as a company the government could say, show me the company, I'll find the crime. But is there also concern that as people have new contracts in place or might need to be negotiating or negotiating renewals of contracts and so forth, that with all of this flux, nobody knows what could come back to fight them uh six months from now.

SPEAKER_00 0:21

Education is key, but we are gonna have a bumpy transition here, right? Where we have existing contracts that rely on the legacy FAR clauses that are still in their contracts and are they are requirements with which contractors need to comply. And then we're gonna get new contracts that are based in the new FAR at some point. Transitioning from legacy to next gen is always complicated. It is a pleasure to see you again, Tom.

SPEAKER_01 1:30

And I know that uh a long time at the council and a long time in the trenches of the trade group era, but you also have experience on the Hill and in the Pentagon itself. Tell us a little bit about that.

SPEAKER_00 1:41

It is uh a tale as old as time, Tom. Let's be honest. Uh I came here in the late 90s as a bright-eyed, bushy-tailed recent master's degree uh graduate, and uh started my professional career here in Washington, D.C. at the Pentagon. I was what they called at the time a presidential management intern, then they renamed it fellow, um, at the Pentagon uh in the office of the Secretary of Defense. And I spent a glorious seven years at the Pentagon, bopping around different offices as an intern is wont to do for the first two years. And then I settled in the NATO policy office and then the European Policy Office during a very exciting time. That was back uh right after September 11th. We needed the help of a lot of allies and partners, and to be in a regional office at that time, working on accessing CDs over flight, etc., um, for operations enduring and Iraqi freedom was fantastic. That said, I have got my first exposure to working with industry in that position because so much of what we were doing in Iraq, Afghanistan, and elsewhere around the world relied heavily on what the private sector had to offer. And after that uh position, uh I chose to uh make the leap and go over to the legislative branch where I was a senior professional staff member on the House Armed Services Committee, eventually leading the policy team there for a little while.

SPEAKER_01 2:58

Yeah, so that close-up look at the machinery from the Hill side and the Pentagon side, that'll grow up someone real fast, I think.

SPEAKER_00 3:05

I will say anyone who has been uh, you know, in a situation like that at the Pentagon on September 11th, you do grow up very fast, but you also get to see how we can't go it alone anywhere, whether you're the executive branch or the legislative branch or industry itself, we do need a team outlook and a team effort, and that was a very much my takeaway from that experience.

SPEAKER_01 3:24

Sure, that whole team idea kind of coalesces around procurement because nothing happens until the Pentagon buys something, and really at the Professional Services Council now they are concerned with not just Pentagon buying, but all federal acquisition, of which the Pentagon, you know, the war uh department is about half. And you have come into PSC's presidency just as the landscape is really shifting a lot with the so-called uh rewrite of the FAR, this gigantic changeover that the uh Trump administration has tried to put into effect. Uh tell us what what does it look like from the standpoint of the PSC? Give us a sense of the scope of how things are changing.

SPEAKER_00 4:03

Yeah, you know, I've been now, as you know, Tom, uh with PSC for about five years. I became the president last year, 2025, and it really was a pivotal point in our history. You know, this was a time where a trade association like PSC, where we focus on, we say three main areas, right? We educate, we advocate, and we facilitate, meaning we help with the networking that is so essential to having a good customer uh relationship with the executive branch. And so it was with great excitement that I took over this position. I have a great partner in crime here. Our CEO is a gentleman named Jim Carroll. He started um just about the same time I was elevated to the presidency position. And so together uh we are really tackling what we can at this pivotal time in history. The revolutionary far overhaul is unlike anything we've seen before. You know, incrementally the different administrations and different members of Congress had tried to tackle the federal acquisition regulation, thousands and thousands of pages of regulations, many of which came up because somebody somewhere did something wrong. So there was a regulation created to prevent that behavior in the future. It was not an incentive-based situation, it wasn't a reward system for doing things well. And I think this revolutionary for overhaul is a really great opportunity for trade associations like PSC to educate, advocate, and facilitate all of the networking that needs to happen to make acquisition procurement safer, faster, and more efficient.

SPEAKER_01 5:29

And we've had procurement reform before. I think the most uh the aggressive one happened during the Clinton administration, during the National Partnership for the Reinvention of Government. And the emphasis, though, was not so much on rewriting the FAR, but bringing forth to emphasize different parts of the federal acquisition regulation. For example, oral downselects, this kind of thing. Tools that were already in the box that procurement officers, contracting officers were afraid to use. This is different, though. They're really trying to change the rules fundamentally in this so-called revolution, would you say?

SPEAKER_00 6:02

I I would say, now, you know, the word revolution is a strong word. Um and so um to characterize anything as revolutionary really uh heightens people's senses and gets them what they want to get involved in this. No, the real objectives of this revolutionary far overhaul, as articulated by members of the administration and the executive branch, have been to eliminate unnecessary and non-statutory regulations to accelerate procurement and to increase competition. Those are the three touchstones, if you will, of this whole, I'll call it RFO, it's the revolutionary far overhaul. And as we moved forward through this, they were moving very, very quickly. I would say in 2025, all of this was spurred by an executive order. I'm gonna look down at my paper here so I can get the number correct. Um, but it was executive order 14275, restoring common sense to federal procurement. And since that executive order was signed, they really did move very quickly to create all of these model class deviations, which is something that we hadn't seen previously at this scale of creating class deviations to start changing the FAR in real time. Um, the next phase, of course, all of those class deviations were done by September 30th. Thank God, because then we went into the longest ever shutdown, which you and I have talked about at length, Tom. But you know, that class deviation piece was massive. It was huge. They started moving a lot of things to companion guides and practitioner albums, um, but really getting down to basics of what was in statute and therefore what should be in regulation. Now we are awaiting the rulemaking process, which is by its design, it will take a longer time. And this is an opportunity for industry to really roll up its sleeves and provide some comments.

SPEAKER_01 7:42

And for those that might be in the higher level marketing functions or engineering or you know, corporate development, not so much on the day-to-day capture area of federal contracting. Maybe just let us know what you mean by class deviation.

SPEAKER_00 7:56

Of course. Yeah, thanks for that. Um, sometimes I get too too caught up in the vernacular and I then I gotta take a step back and take a breath, right? Um, so class deviations are uh pieces of language that you know get put out there um to start the process of changing regulations. And so class deviations can be issued, and in this case they were. There was a class deviation for the FAR, every single part of the FAR, things like FAR Part 12, which is commercial products and commercial services, things like part 10, which are uh market research. And some of these PSC and others provided extensive comments on the class deviations of where they were trying to go. What we do expect to see is the the executive branch will have taken all of that feedback on the class deviations and in order to create a proposed rule for actually changing the FAR. So this is sort of a two-step, if you will. Um the class deviations, we provided comments, they started getting incorporated into contracts. And now with the actual formal uh publication of uh the actual proposed rules to change the FAR itself, that will allow us again as the public to provide comments again. So, you know, I I do think this one two-step process has allowed industry and the broader public to see, you know, behind the curtain, to see what the administration and executive branch, what they're trying to do, and to provide helpful feedback.

SPEAKER_01 9:17

So to make an analogy, then the class deviations might be the equivalent of an executive order to do something, whereas actually rewriting the FAR, that would be statutory.

SPEAKER_00 9:27

Rewriting the FAR is regulatory. I would say what we've also seen from the administration and the executive branch is, you know, legislative proposals to actually um repeal some of the statutes that led to regulations. So that statutory piece is a little bit separate here. Um and I'm gonna dork out just for a moment. Um drawing on the love that uh drawing on both my Pentagon experience and my Hill experience, you know, when you've got something in statute, and I'm most familiar coming from the armed services community with the National Defense Authorization Act, which is the authorizing act that provides budget authority and certain uh latitude to the Department of Defense slash war, and then it's followed by the appropriations process. But the authorization process is where a lot of these regulations come from. You'll have a provision in law, in this case the NDAA, the National Defense Authorization Act, that spurs the executive branch to create a regulation. Those are statutory-based regulations based in law. What the RFO has been trying to do is boil the far down just to those statutory requirements, get rid of all of the regulations that popped up because somebody somewhere did something that went awry. And so getting it back to its statutory requirements. That said, the executive branch is putting forward legislative proposals to actually get rid of old statutes so they can get rid of those regulations too. So this is maybe it's a three-step process, Tom. It's not just a one-two, it's a one-two-three.

SPEAKER_01 10:51

Sure. And there's also statutes like SECA, the Competition and Contracting Act, which are not related to any particular year's authorization. Are they going after that, do you suspect? Also, that kind of uh fundamental statute that's been in place for decades.

SPEAKER_00 11:05

It would make sense to me that when the executive branch is putting forward its legislative proposals, that um they include not just the NDAA and other annual authorization bills, although NDAA is kind of where the game is, right? Um, but also some underlying statutes like Sika, like Fatara, like other uh seminal pieces of legislation that are out there. That said, you know, you don't want to cut into bone. It's one thing to trim the fat out of the FAR, it's another thing to cut slightly into muscle. You don't want to hit into bone. So there are statutes out there that I think are going to be immutable and that are required to make sure that we have fair, open competitions when it makes sense to allow for things like set-asides. There is a whole section of the FAR dedicated to small business. Um, and so as we think through this, I think the legislative proposal part will be widespread. But I do hope that they don't cut into the bone the basic foundations of what underpins competition in this country.

SPEAKER_01 12:00

Sure, it's a matter of integrity at the most basic level of spending public dollars when you really boil it down that far.

SPEAKER_00 12:06

Things like Sika, you mentioned Tina, which is the Truth in Negotiations Act piece as well. I think those will have to be protected because they do offer so much goodness, both to the government as a customer and to the contracting partners that support them. Uh the rules of the road have to be known. We have to be consistent. Um, and so that's part of that.

SPEAKER_01 12:25

And when you are hearing from member companies, your several hundred member companies, large and small, in a variety of businesses, both you have some manufacturing/slash service companies, but the big service providers, what are they concerned about? What's the feedback you're getting on the revolutionary FAR overhaul?

SPEAKER_00 12:43

So the concerns are numerous. Um and because this has never been done at this scale before, we appreciate as an industry the opportunity to interact with the FAR Council, which are the um the principal folks who who are guiding this process. So that is the Office of Federal Procurement Policy, and then the FAR principals from the agencies will include folks like NASA, the Department of War, and uh the General Services Administration. And so we've been working very closely with them, providing comments on these class deviations. We will provide comments on the proposed rules. That said, one of the concerns is about how the proposed rules will be rolled out. As I mentioned, they're they're trimming thousands of pages of regulations from the FAR. If they roll out a proposed rule that is a thousands of pages, it will be a lot to go through. And a lot of these different FAR parts interact with each other. And so I'm hoping we will see tranches of them, groupings of them that make sense, but short of several thousands at a time to go through on a 15-day or a 30-day basis, which would be a Herculean task or a Sisophean task if you want to, if you want to spread the wealth along your Greek odds mythology. But I would also mention other concerns include things like in addition to the base FAR, which is the Federal Acquisition Regulation, every department and agency has its own supplement. And so in the defense world, we call that the DFARs or the Defense Federal Acquisition Regulation supplement. Making sure that those supplements are aligned with the changes in the base FAR are is going to be critical. And I'll and I'll say, I'll let you know why, which is basically if you have a large company and you mentioned PSC, we have more than 400 member companies. 300 of them are direct contract holders. The other 100 are what we call associate members. That's an ecosystem that grows up around contracting uh financial institutions, lawyers, accountants, et cetera. But of the 300 or so that hold federal contracts, it's very rare for any of them to hold contracts with only one department or agency. So take a large company, they may hold contracts with the Department of Defense, the Department of Homeland Security, the General Services Administration, et cetera. They all have their different supplements. Are those supplements internally consistent? Now all of them harken back to the FAR, but they may do so in different ways. And therefore, the rules of the road get very, very complicated for that company. And so alignment of the supplements is going to be critical. And finally, what we would like to see is clarity in certain things that we hold to be now. I'm quoting the founding fathers, self-evident, right? Let's make sure that we know the rules of the road. Um, so are there small business utilization requirements? What are the flexibilities available to contracting officers to exercise? Uh they what they talk about in this far overhaul is that it's trying to give more discretion to the acquisition professionals. But let's be honest about what those flexibilities are. Is it to use more commercial products and commercial services? Is it to make um justification documentation easier for um soul sourcing? Is it to use small businesses in new and different ways? And so I think uh we have to be clear on how everyone's going to get trained on this new body of regulations, both government side and on the contractor side. Everybody needs to be educated.

SPEAKER_01 16:05

But is there also concern that as people have new contracts in place or might need to be negotiating or negotiating renewals of contracts and so forth, that with all of this flux, nobody knows what could come back to bite them uh six months from now?

SPEAKER_00 16:21

Yeah, I it's a great question, Tom, as always. Um I would say that education is key, but we are gonna have a bumpy transition here, right? Where we have existing contracts that rely on legacy FAR clauses that are still in their contracts and are they are requirements with which contractors need to comply. And then we're gonna get new contracts that are based in the new FAR at some point. So transitioning from legacy to next gen is always complicated. This is no different.

SPEAKER_01 16:48

Right. You don't want to be in the position where as a company the government could say, show me the company, I'll find the crime. I mean, that's a real potential, I think.

SPEAKER_00 16:56

So I would also mention, and and this is something that we've talked about at length within the contracting community, is that folks get into contracting on the government side, not necessarily because they're risk-loving. They tend to reward risk-averse behavior, which is let's see if we can shift as much risk from the government to the contractor, the private sector partner, and then pay for that delegation of risk, right, if you will. What how that shapes up under this new revolutionary far overhaul construct remains to be seen. And I think what is going to be important as part of this education system is how will the government reward risk-taking behavior for government officials, right? If you have a contracting officer, an evaluation team, how will you reward them in terms of uh trying to exercise and get at innovation? And I'll give you an example. Um, one of the flexibilities that is being afforded to contracting officers is to empower them to use their professional judgment. Now that is beauty is in the eye of the beholder if I've ever heard of it, right? I mean, what is professional judgment? What is your discretion? How should you exercise that? And how might you be punished if it goes sideways, or how might you be rewarded if it goes well? Those are all to be D. I mean, those are all to be determined and to be seen, how all of this works out.

SPEAKER_01 18:12

Yeah, truly the standing workforce of contracting professionals and industry are in the same boat in that sense.

SPEAKER_00 18:19

Yeah, and I would also mention, um, and this is something that I've talked about with media and with the contracting community and the government itself, which is to say in 2025 we lost a big chunk of the federal workforce, and a lot of that came from the contracting or acquisition community. And so initially, before we started to go into this efficiency initiative and offering government employees either early retirement or deferred resignation programs, um, we had a vacancy rate within contracting officers of about 20 to 40 percent, depending on the agency. We are now looking at something about 60, 60 to 70 percent vacancy rates. And so if you are an active contracting officer and you have a, say, two-thirds vacancy rate, literally you're looking to the seat to the left of you and to the seat to the right of you, and both are empty. You have inherited quite the workload. You're guaranteed to be doing more than just your own portfolio as a contracting officer. So speed is important, but so is training, and so is exercising discretion. But if you haven't been active in those portfolios before because those seats are empty and you've inherited their workload, how have you developed that professional judgment? And so this is a question that we have, which is how is the government going to rebuild that acquisition cadre within the government? And how are they then going to train them to exercise that judgment, exercise that discretion and flexibility?

SPEAKER_01 19:38

Sure. And in the meantime, we have something I want to get back to something that you mentioned earlier, and that is the companion and implementation guides to the new proposed rules and to the deviations. And those are as voluminous or more so than the proposed changes themselves, aren't they? And that is a lot for a company and for that matter a contracting officer to get through.

SPEAKER_00 19:59

It's funny when you talk to the cynics out there, and there are a lot within uh within our community, right, uh, who say this is not a revolutionary far overhaul that is shrinking the FAR. It is just shifting the pages, if you will, into these practitioner albums or these um companion guides. I would say what's interesting to see in these albums and guides that accompany the regulations is that they do outline what discretion looks like. And I will tell you something. You know, when I when I went from the Pentagon to Capitol Hill, I didn't think much about the difference between the word shall and the word should. Shall now I know, based in legislation, is something you have to do. Should is something that you can consider, but you don't have to do it. A lot of contracting officers and folks in the acquisition community within government look at shall and should as though they are all shall. What the practitioner guides, the companion guides, and the practitioner albums do is explain what exactly does that mean. And should is a measure of discretion. You don't have to do it. Again, this comes down to training and education. I think if people are just looking at the words, they're gonna go, well, it's same, same, right? Shall is should and forever and never, amen, right? And it's not that. And I think that's where the guides are really, really helpful. They give case studies and examples of what folks have done well in the past. And so again, it's voluminous. Uh, there are lots of pages there. Uh, so the body of work around regulations is not shrinking. The regulations themselves are.

SPEAKER_01 21:21

And just a side question kind of strikes me, and by the way, God forbid the word may should be in there along with shall and should. Then you've really got a complication on your hand. But this just struck me: is the legal community, to your knowledge, up on all of this? Because there's this whole, you know, boatload of law firms and lawyers that follow procurement and defend their companies and so on, and they've got a lot to keep up with, too, because law is all up in the air now.

SPEAKER_00 21:46

Very, very true. As I mentioned earlier, about a quarter of PSE member companies are our associate members. Those include law firms. And I'm on a bunch of mailing lists where the law firms are pushing out their interpretations of the class deviations or what's going on with the revolution. For overhaul. I have been so impressed by the level of detail, but also how well the law firms are boiling it down for lay people, I would say for lack of a better phrase, but people who are not lawyers to actually understand what's going on. So one of the pieces of advice we are giving our contracting companies, our regular members, is to go ahead and talk to your counsels, go ahead and talk to the law firms with which you are affiliated, and get the latest and greatest, get on those mailing lists because those notices and publications are essential to understanding what's going on. And I would say almost all of the law firms, it's almost the same day. If it's certainly by the next day something comes out from the government and they've got a notice on it, and it's been very impressive to watch.

SPEAKER_01 22:43

So as aside from the volume and interpretation, then the issue for agencies is for contractors rather, is agency by agency interpretation and implementation.

SPEAKER_00 22:55

Yeah, and we are seeing those differences, right? As I mentioned, every single department agency has its own supplement where they take the FAR and they sort of specialize it to their needs. And so contracts, you know, we are big on read the contract, know what you're signing up for as a private sector company, and make sure that you understand what compliance looks like because you know that that is what the the the standard to which you will be held.

SPEAKER_01 23:19

Sure. So to summarize operationally, you know, in just a couple of sentences for us, what should contractors basically be doing now?

SPEAKER_00 23:28

So they need to stay up, they need to so we at PSC, we have uh member briefings every other week in the beginning of the Trump second Trump term. Um we had them every week. Now it's every other week. And it's an hour virtually, uh, every other week, every other Tuesday at noon. Um you can it's a video thing, so you can bring your lunch and we won't even see it. But we do highlight what has happened uh in the administration. So I would say uh tuning in to a trade association that has a you know an hour webinar pretty much, um go ahead and do that, talk to your lawyers about what compliance looks like, get smart on what the changes are. You know, GSA, they do have a revolutionary far overhaul website where they post the most recent changes. So bookmark it, check it out. Um, if you're a compliance foot person in a private sector company, you should be visiting that website every day. So, in short, you you asked me to say it in three sentences. I'll I'll boil it down to those three. Uh work with your trade associations um to see what's happening, bookmark that site uh for the revolutionary far overhaul, and of course talk to your lawyers.

SPEAKER_01 24:29

And check out the far overhaul action center at PSC.

SPEAKER_00 24:32

Oh, we do have that, yes. I should have mentioned that. We also have a Revolutionary Far Overhaul Action Center that's available to our member companies, and that's where not only do we track our uh the the recent actions, but we post the comments that we've submitted. We look for member input on class deviations and in the future of the proposed rules, but we will also tie them back to what's going on with executive orders and how are things changing on that front. So, yeah, we do have an Action Center, and I apologize to my colleagues at PSE for not mentioning that at the top of my remarks.

SPEAKER_01 25:04

All right, I wouldn't let you get away without it.

SPEAKER_00 25:05

Appreciate it, Tom.

SPEAKER_01 25:07

And then, of course, this would also seem to overshadow another big development which should not be overshadowed, and that is the growth in other transaction authority, non-FAR acquisition. That's really going strong too. What are the trends there, and what are member companies talking to you about?

SPEAKER_00 25:24

I'm so glad you mentioned that, Tom, because so so often recently we've been talking about this FAR overhaul. And what is equally important, at least in terms of the pace of activity, is this push for other transaction authority, which has been afforded to several uh departments and agencies. It actually started out at NASA decades ago. So OT Authority was born at NASA. They st they have retained it. Uh, the Department of War uh uses OT Authority frequently. All your audience may have heard of um the Defense Innovation Unit or DIU or AFWORKS or other service-specific procurement offices. And OT Authority, you know, was created for the Department of War in particular, in this example, um, to get all the way through prototyping and and to really spur innovation. Um, it is now being used, you know, beyond that, there is some congressional oversight about how OT authority is being used. Departments like Homeland Security did have it for a short time. It has expired and they are trying to get it back as authority. So these are outside of the federal acquisition regulations. It's much more nimble, it's quick, but it's not for everybody. OT authorities pertains specifically to different consortia that have cropped up, as well as non-traditional uh contractors who have not held traditional contracts with a department or agency. And so it is growing rapidly. It is a great tool in the toolbox to be able to do something like an OT agreement, but there are certain constraints uh as to how far along you can go. You can't have a program of record that is solely under other transaction authority. It doesn't fit, and it shouldn't fit given that this is a a tool for nimbleness and agility on the innovation front.

SPEAKER_01 27:04

Right. So be careful, sparing is really the way it should be approached, sounds like.

SPEAKER_00 27:27

And I think, you know, you can't do full rate production under an OT. And I think that's wise because eventually you're gonna have to go and get it into a more foundational piece, and then it would be subject to the FAR. I know there is some disagreement in the community about that, particularly from those who have benefited from OT agreements in the past. Um, they would just like to keep doing it and make that business as usual. But I think that would ignore all of the goodness and competition, et cetera, that comes from the FAR itself.

SPEAKER_01 27:52

So that's a shall not, not a shouldn't.

unknown 27:55

Exactly.

SPEAKER_00 27:56

In my world, it would be. But yeah, you're talking to a former congressional staffer who looked at this stuff very, very closely, right? Um oversight is different over OTs. And, you know, regulations are created to make sure there's a level playing field, there's competition, you can get what you want. OT is there so that you can innovate and get something quickly. Those are not mutually exclusive, right? You can transition from OT to a far-based procurement. We just need to get people educated, both within the acquisition profession uh profession, within the government, but also within companies to say, these are tools, let's use the entire toolbox. Don't fall in love with a particular tool because if you have a hammer, everything looks like a nail, right? Let's not fall into that limiting mindset.

SPEAKER_01 28:37

And the other big kind of tornado that's been sweeping across the acquisition landscape, especially from DOD, but you know, people suspect it'll happen government-wide, and that is CMMC, the Cybersecurity Maturity Model Certification Program that by which the Defense Department, the War Department, wants every contractor to be good at cybersecurity. Status, how is compliance going there? That is now a real program. What do you see happening on the CMMC front?

SPEAKER_00 29:04

I appreciate your imagery, Tom, um, because it has been um it may be a tsunami or a tidal wave, um, but I would also say this has been a long time in coming. You know, those of us who've been watching the cybersecurity maturity model certification program for years now, you know, at some level breathed a sigh of relief when we actually started getting incorporated into contracts. Because again, it's that consistency that we're looking for, the rules of the road, what are they? Now, when CMMC was created, one of the thoughts was that the Department of Defense, as it was called then, um, would create something, test case it as we do in so many things, and then it would permeate throughout the rest of the government. You know, other agencies and departments would would also then adopt CMMC. We're not really seeing that happen. What we are seeing happening is this dichotomy that often gets created, and part of it is because the defense community has that National Defense Authorization Act that is passed every year, and so they get a whole bunch of new authorities or they get authorities sunsetted every single year. And that creates a dichotomous situation where you have a rules of the road for the defense department and then you've got rule of the road for everybody else. Again, it's hard for those contractors who have a foot in each camp to know which rules they have to follow. CMMC is exactly one of those cases. So you have defense contractors who need level one, level two, or level three certification. You can look up CMMC to see what all of those are, but some are you can self-attest that you are cyber secure, you have to get an outside third-party entity to certify you, et cetera, for different levels for work. Then you go over to the Department of Homeland Security where they have a self-attestation model across the board. And more recently, I mentioned the General Services Administration early earlier, GSA has also now created its own system for handling controlled unclassified information that's separate from what DHS is doing and from what DOD is doing. And so again, this is a situation we're trying to avoid, right? Um, and I'll I'll give you a very practical reason why, Tom, and that is if you are a defense contractor and you have paid for a third party to assess you and certify you for cybersecurity, you have costs associated with that. If you are a small business, those costs could choke you. But if you're a large business, perhaps you can spread them out a bit. And particularly if you're a large business with a commercial side, um, you can spread it out even more. But if you are a typical mid-sized company working on CMMC certification, it's a big um bill to swallow. But then you're competing on the DHS side, for example, with a company that is purely a DHS contractor and didn't have to have that and didn't have those costs to spread because they don't work with the Department of Defense or war. And so it puts you at a competitive disadvantage. It is a real-world issue that our companies are facing every single day. And so the right answer has to be any system that makes a company more cybersecure, right? Not disclosing, not reporting requirements, but what actually makes you more cybersecure? And that is where PSC is pushing. What system is most effective for cybersecurity in its purest form? And let's push for that.

SPEAKER_01 31:59

Right. So almost take a risk management approach to it in within your own organization.

SPEAKER_00 32:04

You know, we do talk a lot about risk management. I mentioned it earlier, um, but in cybersecurity, there's a thing, there um there is a new part of the far that was created just on supply chains. So really we're looking at um risk management across the board. And I think as we go forward with CMMC or other cybersecurity measures, we just need to be cognizant of its impact. And at the end of the day, is our nation more secure because of these cyber requirements and making sure that we are keeping pace with the threat?

SPEAKER_01 32:35

All right, and a final question. I read the other day, I think somebody counted 33 months of the Trump administration are left. It's not even halfway through yet. And there's been a lot of change, a lot of stirring up, a lot of digging up, a lot of throwing things up into the wind. Where do you see this in 12 to 18 months? Will this settle down to a normal kind of environment where companies can count on what it is they have to do for some reasonable period of time into the future?

SPEAKER_00 33:02

You have just outlined my hopes and dreams, Tom. Um so so here it is, right? With the revolutionary far overhaul, again, we mentioned, you know, uh making changes to the FAR is not a new concept, but we do have lessons to learn from history about when things fizzle out, when that energy gets lost, when the the entropy of everything sort of, you know, falls in on itself. What I hope is that with this revolutionary far overhaul and some of the other things we've talked about, that we make real progress in the next six months. Sometime during 2026, we need to demonstrate that we've made real progress in making acquisitions faster, more cost effective, and uh more secure. And I mentioned safer earlier. Let's make make things so that our nation can achieve its economic and national security goals, its mission set, if you will. I do think if we don't have successes sometime in 2026, this thing may fizzle. And I don't want that to happen. And so we are pushing hard to make sure we can see the proposed rules, make them effective, get, you know, contracts out under the new FAR, figure out how to transition from old legacy FAR clauses to new FAR clauses. Let's do this in here in 2026. And I think that resonates well with what the administration executive branch wants to happen too. So that is my dream is that we make some progress here in 2026, set ourselves up for success so that it doesn't sort of fall in on itself in the out years.

SPEAKER_01 34:26

Stephanie Costro, president of the Professional Services Council. Hey, it's been great having you with us.

SPEAKER_00 34:31

Thanks so much, Tom.

SPEAKER_01 34:32

And that's it for this edition of Federal Front Lines. Next month, we'll explore the Army's upcoming multi billion dollar services acquisition known as MAPS. Until then, I'm Tom Temen.