GovCon Roundup: Three September Developments Federal Contractors Need to Know

September 2026 has been one of the busiest months for federal procurement policy in years. The Defense Department turned its CMMC pause into binding contract policy, the FAR Council released its second set of Revolutionary FAR Overhaul proposed rules, and SBA’s overhaul of 8(a) eligibility took effect.

Each development is significant by itself. Together they point to one lesson: as the government removes third-party checks and regulatory detail, more of the compliance burden, and more of the legal risk, moves onto the contractor’s own self certifications. 

1. CMMC Is Paused. Your False Claims Act Exposure Is Not. 

What happened. On July 13, 2026, the Department of War announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had been scheduled to take effect on November 10, 2026. Phases 3 and 4 and all later implementation milestones were frozen as well. The stated reason was cost and capacity: according to SBA, Phase II would have required more than 120,000 small businesses in the defense industrial base to pursue compliance through a system supported by only about 100 approved assessors. 

What did not change. Standard Defense contract clauses still require contractors to self-assess CMMC compliance, including NIST SP 800-171 Rev. 2 controls for Level 2. Offerors generally still need a current status and affirmation in the Supplier Performance Risk System (SPRS) to be eligible for award, and must attest to ongoing compliance. Contractors also remain bound by the rest of DFARS 252.204-7012, including cloud security, cyber incident reporting and investigation, and media preservation requirements.. 

DOJ is still bringing cases. Just before the deviation issued, Honeywell Aerospace Inc. agreed to pay $2,042,518 to resolve False Claims Act allegations that it failed to comply with cybersecurity requirements in a Department of Defense contract. The broader trend points the same way: DOJ cybersecurity settlements totaled $52 million in fiscal year 2025, more than triple the prior year, and DOJ reported a record 1,297 qui tam suits filed in FY 2025. 

What’s next. The CMMC Reform Task Force’s report was due to the DoW Chief Information Officer on September 11, 2026, but has not yet been made public. History suggests the program will be narrowed rather than abandoned.  

Action items. Verify your SPRS score. Confirm what your primes still require under your subcontracts.  

2. The FAR Overhaul Enters Its Second Rulemaking Wave 

What happened. On September 18, 2026, the FAR Council (OFPP, DoD, GSA, and NASA) published four proposed rules in the Federal Register as part of implementing Executive Order 14275, Restoring Common Sense to Federal Procurement, which directs the Council to simplify the FAR and remove unnecessary, non-statutory requirements.  

The September rules cover several core parts of the procurement process: FAR Parts 8, 12, 13, 15, 38, 44, and 51 (sources of supply, commercial products and services, simplified acquisitions, negotiated procurements, and subcontracting policy); Parts 16, 17, and 35 (contract types, special contracting methods, and R&D contracting); Parts 14, 28, and 36 (sealed bidding, bonds and insurance, and construction); and Parts 9, 27, and 47 (contractor qualifications, patents and data rights, and transportation), each with conforming changes to Part 52. 

Changes worth watching. Two stand out. In Part 16, the proposed rule reinforces the preference for fixed-price contracts with performance-based considerations, and adds justification and approval requirements for other-than-fixed-price contracts and for firm-fixed-price, level-of-effort term contracts. Contractors whose business relies on cost-reimbursement, T&M, or LOE vehicles should expect more of those requirements to be converted to fixed-price or to face internal justification hurdles, which will change how risk is allocated in their pricing. In Part 9, the Council proposes to remove FAR subpart 9.6, Contractor Team Arrangements, as unnecessary.  

Action items. Review the proposed text for the parts that drive your revenue, particularly Parts 12, 15, and 16. Comment by October 19 if a change would affect your pricing or competitive position. Industry comments can shape final rules, and the first-round deviations were revised in response to feedback.  

3. 8(a) Program: A New Eligibility Test and a Defense Fast Track 

What happened. On August 11, 2026, SBA published a final rule amending 13 C.F.R. § 124.103 to eliminate the 8(a) Business Development Program’s race-based rebuttable presumption of social disadvantage. In its place, SBA adopted a group-discrimination-plus-self-certification test available to any U.S. citizen regardless of race, ethnicity, or sex. Under the new standard, an applicant must present evidence of group-based discrimination or bias and self-certify that the owner suffered a resulting loss of access to, or diminished opportunity for, economic advancement. The rule took effect September 10, 2026. 

Who is affected. The rule also does not apply to Alaska Native Corporations, Community Development Corporations, Indian Tribes, or Native Hawaiian Organizations. Pending applicants are the ones most affected: a firm with an application in the queue will be measured against a test that did not exist when it applied. SBA returned pending applications through its “Return to Business” system, and applicants have 45 calendar days to update and resubmit. Applicants whose files were returned on September 10 should be working toward a late-October resubmission. 

The defense fast track. On the same day, SBA announced that it will prioritize 8(a) applications from firms in ten defense-critical NAICS codes and reinstate the merit-based “potential for success” review for prospective participants. The prioritized codes cover ammunition, missiles and space vehicles, aircraft components, electronics, steel, machine shops, fabricated metals, and shipbuilding. I suspect that this change will not impact very many 8(a) applicants.   

The certification risk. This development follows the same pattern as CMMC. SBA allows applicants to self-certify that discrimination or bias caused them material harm, but those certifications remain subject to federal false-statement laws. A knowingly false certification that is material to 8(a) eligibility and is later used to obtain contracts could create False Claims Act exposure. Litigation over the rule is also possible, since civil rights organizations raised constitutional and statutory objections during the comment period. 

Action items. Pending applicants should calendar the 45-day resubmission window now and build a documented evidence file rather than relying on narrative.  

The Common Thread 

Across all three developments, the government is removing verification steps, such as third-party assessors, prescriptive FAR language, and eligibility presumptions, and relying more on what contractors say about themselves. That may reduce compliance costs, but it increases the stakes of every SPRS score, annual affirmation, and 8(a) certification. The contractors in the strongest position this fall will be the ones whose certifications are backed by documentation. 

Key dates: 

• October 19, 2026: Comments due on the September RFO proposed rules. 

• About late October 2026: Resubmission deadline for 8(a) applications returned on September 10 (45 calendar days). 

• Any day now: Public release of the CMMC Reform Task Force report.

For more guidance or legal assistance on government contracting issues, please contact Centre Law & Consulting.