Cyber Incident Reporting May Be "Material" For Federal Contractors

Last month, the Federal Acquisition Regulatory Council proposed new cybersecurity and incident reporting regulations for federal contractors on behalf of the Department of Defense (DoD), the General Services Administration (GSA), and the National Aeronautics and Space Administration (NASA).

The proposed regulations include data incident reporting requirements the government explicitly designated as material to government contractors – meaning a failure to follow the reporting requirements could be grounds for False Claims Act liability.

Under the proposed rule, contractors would be required to create a "software bill of materials (SBOM)" for the software they use. Contractors would also be required to grant access to and cooperate with the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Justice (DOJ) for purposes of threat hunting and incident response. Additionally, contractors would be