On October 30, 2015, the Department of Defense (“DoD” or the “Department”) issued a Final Rule amending the Defense Federal Acquisition Regulation Supplement (“DFARS”) and clarifying the scope of the DoD’s ability to evaluate and exclude contractors that represent “supply chain risks” in solicitations and contracts involving the development or delivery of IT products and services related to National Security Systems (“NSS”). The Final Rule clarifies that the DoD’s exclusion authority is limited to procurement of NSS, explains that decisions apply on a procurement-by-procurement basis, and removes the flow down requirement that was present in the Interim Rule. The Final Rule also encourages contracting officers to consider imposing a Government consent requirement for all subcontracts.  Our in-depth analysis of the Final Rule is available here.

As we previously discussed when the DoD issued its Interim Rule, these amendments are significant because they provide the DoD with authority to undertake a Section 806 Action to exclude IT contractors from contract participation or withhold consent to subcontract if the Department determines that a contractor or subcontractor presents a supply chain risk.  Notably, the DoD may implement this tool without providing pre- or post-exclusion notice to or engaging in dialogue with contractors.  Further, the Final Rule states that Section 806 Actions are not reviewable in a bid protest before the Government Accountability Office or in any Federal court.  The lack of procedural protections led commentators to the Interim Rule to suggest that contractors could be effectively excluded from DoD procurements without advance notice or an opportunity to object.  The DoD attempted to address this de facto debarment concern by clarifying that each Section 806 decision to exclude is done on a procurement-by-procurement basis. Nevertheless, multiple exclusions without an opportunity to object or address the Government’s concerns could effectively result in a blanket exclusion.

In addition to outlining the DoD’s authority under Section 806 Actions, the Final Rule allows the Department to use an evaluation factor to assess supply chain risk when making procurement decisions and imposes on contractors an ongoing obligation to “mitigate supply chain risk.”  However, the DoD declined to provide guidance in the Final Rule regarding the manner in which the evaluation factor will be applied or the appropriate means of mitigating supply chain risk.

In short, under the Final Rule, contractors may be excluded from certain DoD IT procurements without (1) notice or an opportunity to be heard, (2) an impartial review of the DoD’s decision, or (3) an opportunity to take corrective action.  In addition, contractors must address a new supply chain risk evaluation factor and satisfy an ongoing obligation to “mitigate supply chain risk.”  Given the potentially significant impact of the Final Rule, contractors would be well advised to closely monitor the DoD’s implementation of these amendments.