Emma Merrill

Emma Merrill is an associate in the firm’s Washington, DC office. She advises clients on a broad range of issues related to government contracting, including both regulatory and transactional matters. She maintains an active pro bono practice.

Contact:Read more about Emma MerrillEmail

On June 21, 2023, DHS published a final rule that amends the Homeland Security Acquisition Regulation (HSAR) both by modifying the existing regulations through removing and updating existing clauses and by adding new contract clauses to include certain requirements for the safeguarding of Controlled Unclassified Information (CUI).  The final rule, first released in proposed form…

By: Robert Huffman, Susan Cassidy, Michael Wagner, Ryan Burnette, and Emma Merrill

This is the seventeenth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and…

On September 14, 2022, the Director of the Office of Management and Budget (“OMB”) issued a memorandum to the heads of executive branch departments and agencies addressing the enhancement of security of the federal software supply chain.  The memorandum applies to all software (other than agency-developed software) developed or experiencing major version changes to be operated “on the agency’s information systems or otherwise affecting the agency’s information,” and requires new self-attestations from software vendors before that software can be used by agencies.  

The memorandum is one among many deliverables stemming from Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  We have covered developments under this Executive Order as part of a series of monthly posts, with the first blog summarized the Cyber EO’s key provisions and timelines, and the subsequent blogs described the actions taken by various Government agencies to implement the Cyber EO from June 2021 through August 2022.  Key requirements of the memorandum are discussed in more detail below.…

Continue Reading OMB Issues Memorandum on Self-Attestations by Software Developers of Secure Software Development Practices and Collection of Software Bill of Materials

This is the fourteenth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the subsequent blogs described the actions taken by various Government agencies to implement the Cyber EO from June 2021 through May 2022.  This blog describes key actions taken to implement the Cyber EO during June 2022.…

Continue Reading June 2022 Developments Under President Biden’s Cybersecurity Executive Order

This is the thirteenth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the subsequent blogs describe the actions taken by various Government agencies to implement the Cyber EO from June 2021 through April 2022.  This blog reflects on the one year anniversary of the Cyber EO and discusses the status of various implementation activities.  It also describes key actions taken to implement the Cyber EO during May 2022.…

Continue Reading May 2022 Developments Under President Biden’s Cybersecurity Executive Order: One Year Anniversary Update

This is the twelfth in a series of Covington blogs on implementation of Executive Order 14028, “Improving the Nation’s Cybersecurity,” issued by President Biden on May 12, 2021 (the “Cyber EO”).  The first blog summarized the Cyber EO’s key provisions and timelines, and the second through eleventh blogs describe the actions taken by various Government agencies to implement the Cyber EO from June 2021 through March 2022, respectively.  This blog summarizes key actions taken to implement the Cyber EO during April 2022.  As with the steps taken during prior months, the actions described below reflect the implementation of the EO within the Government. However, these activities portend further actions, potentially in or before June 2022, that are likely to impact government contractors, particularly those who provide software products or services to the Government.
Continue Reading April 2022 Developments Under President Biden’s Cybersecurity Executive Order

On December 22, 2021, the Defense Security Cooperation Agency (DSCA) announced the Fiscal Year 2021 transaction figures for the Foreign Military Sales (FMS) Program, reporting $34.8 billion in total transaction value.  FMS declined for the second consecutive year, down 31 percent from $50.8 billion dollars in transactions in FY 2020.  The 2021 figure represents the…