Overview
- The Office of Management and Budget and the FAR Council published four proposed rule packages totaling roughly 1,000 pages to begin a broad rewrite of the Federal Acquisition Regulation.
- The packages, which cover about 20 FAR parts, were released Tuesday and start a 30‑day public comment period that is expected to close around July 23, 2026.
- Key changes would move protest handling from the Government Accountability Office to agency contracting officers, consolidate security rules into a newly populated Part 40, and create a single 'Do Not Buy' list that targets vendors the government deems security risks.
- Security proposals require contractors to report cyber incidents within 72 hours, ban certain foreign‑built drones, and require cloud‑hosted controlled unclassified information to meet at least a FedRAMP Moderate baseline.
- The rules also raise the threshold for mandatory public award announcements from $4.5 million to $5.5 million, fold market research (former Part 10) into acquisition planning (Part 7), and signal more discretion for contracting officers while prompting transparency and small‑business concerns as later packages are prepared.