In the Red Zone: What s In and What s Out Under Recent Regulatory Changes September 21, 2016 Terence Murphy (757) 624.3139 tmurphy@kaufcan.com Page 1
Important Note The contents of this presentation are intended for general information only and should not be construed or relied upon as legal advice nor as a legal opinion on any specific facts or circumstances. If you need legal advice concerning your specific circumstances, please consider contacting Kaufman & Canoles, P.C. Page 2
Introduction 1. Small Business 2. Labor 3. Cybersecurity Page 3
1. Small Business A. SBA Final Rule Implementing 2013 NDAA 81 Fed. Reg. 34,243 (May 31, 2016) (effective June 30, 2016) Final rule similar to proposed rule issued December 29, 2014 with some changes in response to public comments Limitations on subcontracting Similarly situated entities Affiliation Recertification Page 4
1. Small Business A. SBA Final Rule Implementing 2013 NDAA Limitations on subcontracting Subcontracting limitations now based on total contract value Percentage of prime expenditure on subs based on cost of contracts (excluding cost of materials when applicable) cannot exceed: 50% for services and supply 85% for general construction 75% for specialty trade Page 5
1. Small Business A. SBA Final Rule Implementing 2013 NDAA Similarly Situated Entities Work subcontracted to similarly situated entities counts as work done by the small business prime contractor Similarly Situated Entity defined as a small business concern subcontractor that is a participant of the same SBA program that qualified the prime contractor as an eligible offeror and awardee of the contract. Must also qualify as small based on the NAICS code prime contractor assigned to the subcontract Page 6
1. Small Business A. SBA Final Rule Implementing 2013 NDAA Similarly Situated Entities (contd.) Only applies to first-tier subcontractors No requirement for special written agreements with similarly situated entity or reports to CO in final rule Page 7
1. Small Business A. SBA Final Rule Implementing 2013 NDAA Additional Provisions Mixed Contracts CO must select NAICS code that reflects the principal purpose of the acquisition The portion of the mixed contract that is not part of the principal purpose is exempted from the performance of work calculation Penalty for violating the new rule Greater of $500,000 or the dollar amount spent in excess of the limitations Possible suspension and debarment Practical Note: SBA regulation only; not yet in FAR Ask CO question in proposal process whether recognition of this change Page 8
1. Small Business A. SBA Final Rule Implementing 2013 NDAA Affiliation Personal relationships: Presumptive affiliated parties: married, civil union, parents, children, siblings Can rebut presumption by showing clear line of fracture Economic dependence: Presumptive affiliated parties: 70% of small business receipts over previous 3 FYs from certain business Rebut presumption by showing not totally dependent on other company Exception for a new business Page 9
1. Small Business A. SBA Final Rule Implementing 2013 NDAA Recertification Small business firm required to recertify if: Merger/acquisition within 30 days Merger/acquisition occurs after submission of offer, but prior to award Page 10
1. Small Business B. SBA Final Rule on Mentor-Protégé Program 81 Fed. Reg. 48,557 (July 25, 2016) (effective August 24, 2016) Program Expansion Creates an expanded program for all small businesses modeled after the 8(a) program 8(a) mentor-protégé program still in existence as separate program Page 11
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Mentor-Protégé Requirements Mentors: Any business that demonstrates a commitment and... ability to assist small business concerns.... Must be in good financial health and possess good character Protégés: Company must qualify as small under its primary NAICS code designation Can now alternatively qualify under their secondary NAICS classification requirements: (1) must have prior experience in that classification and (2) firm must show how M-P program is a logical business progression... and will further develop or expand capabilities. Page 12
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Mentor-Protégé Requirements (contd.) Mentors cannot have more than three protégés at any one time aggregated over both the new program and the existing 8(a) program Business can be both a protégé and a mentor as long as second relationship does not compete or conflict with first M-P relationship continues after a change in control of the mentor Mentor required to acknowledge and certify continuance of the relationship in writing Page 13
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Mentor-Protégé Agreements Written agreement required between mentor and protégé Agreement must include a description of the protégé s needs for assistance and detailed plan of how to address those needs No explicit requirement for written business plan as under the 8(a) program Agreement must be pre-approved by the SBA Changes to the agreement must also have SBA preapproval and must be in writing Page 14
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Mentor-Protégé Agreements (contd.) M-P Agreement must be for at least one year, but cannot exceed three years Agreement may be only extended for an additional period of no more than three years Agreement will automatically renew each year until expiration unless SBA determines the M-P relationship needs review Agreement must allow for termination with 30-day notice Page 15
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Reporting Requirements Protégés required to submit annual reports to the SBA describing: Assistance the mentor provided Contracts awarded to the M-P JV Narrative detailing how mentor s assistance developed the protégé s business Annual report utilized by SBA to determine whether to allow automatic renewal of relationship Page 16
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Joint Ventures 8(a) affiliation exception now applies program-wide Mentors and protégés allowed to form joint ventures in order to compete for contracts based on protégé s size SBA must pre-approve joint venture agreements [C]ontract awarded to a joint venture between a protégé and mentor as a small business continues to qualify as an award to small business for the life of the contract.... Exception for contract of more than five years JVs must be identified separately in the System for Award Management ( SAM ) Page 17
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Joint Ventures (contd.) Populated JVs eliminated Populated JVs are entities that act like a separate, distinct company (i.e. hires its own employees to perform the contract) If JV exists as a separate legal entity, cannot have separate employees who work to perform contract functions Allowed to have employees that perform purely administrative functions Page 18
1. Small Business B. SBA Final Rule on Mentor-Protégé Program Effects of New Rule Potential huge impact on the small business community Possible backlog of new applicants with expanded program SBA set up new unit within Office of Business Development solely tasked with reviewing and approving M-P Agreements Could use open enrollment periods if necessary to deal with large influx of applications Practical Note: Get in line at SBA! Page 19
1. Small Business C. Women-owned small businesses ( WOSB ) and economically-disadvantaged women-owned small businesses ( EDWOSB ) Issues Final rule (80 Fed. Reg. 55,019), effective October 14, 2015, implementing the authority for sole-source awards to WOSBs and EDWOSBs Interim rule (80 Fed. Reg. 81,888), effective December 31, 2015, added a new FAR provision outlining guidelines (FAR 19.1506) CO must consider a WOSB/EDWOSB sole-source award Page 20
1. Small Business C. Women-owned small businesses ( WOSB ) and economically-disadvantaged women-owned small businesses ( EDWOSB ) Issues Section 825 of 2015 NDAA removes ability for WOSB and EDWOSB to self-certify for set-aside contracts Conflicting with the statute, SBA still encouraging selfcertification with the release of a new web portal to assist in the self-certification process During legal uncertainty of SBA s actions, better to have third party certification Page 21
2. Labor A. Final Rule on Fair Pay and Safe Workplaces 81 Fed. Reg. 58,562 (August 25, 2016) DOL guidance (81 Fed. Reg. 58,654 (April 25, 2016) 2014 Executive Order issued Applies to covered contracts and subcontracts (in excess of $500,000) Pre-award requirement to disclose (in proposal) violations of certain labor laws in the last three years, including administrative determinations and arbitration awards Creates new Government position (Agency Labor Compliance Advisor or ALCA ) CO required to consult with ALCA as part of responsibility determination Page 22
2. Labor A. Final Rule on Fair Pay and Safe Workplaces Executive Order issued 2014 (Contd.) Post-award requirement to update information every six months Penalties include Government decision not to exercise options or termination of contract 2015 Proposed FAR Rule to implement EO and DOL Proposed Guidance Generated over 12,600 comments Final FAR Rule Phase-In Only required to report back one year from October 25, 2016 effective date (will be three years by October 2018) Page 23
2. Labor A. Final Rule on Fair Pay and Safe Workplaces No disclosure for most prime contractors from October 25, 2016 to April 24, 2017 Except if proposed contracts in excess of $50 Million disclosure requirements effective October 25, 2016 Subcontractor disclosure not effective until October 25, 2017 Subs disclose directly to DOL (not to prime) DOL provides an assessment to subcontractor Sub required to advise prime about DOL assessment for prime to decide whether sub is responsible Page 24
2. Labor A. Final Rule on Fair Pay and Safe Workplaces If sub does not agree with DOL assessment, then sub has to disclose to prime all labor law violations Public disclosure requirement Prime to disclose in FAPIIS and SAM information about covered violations Limited (for now) to federal labor law violations, but may be expanded to disclosure of state labor law violations Disclosure required of entity whose name and address is on proposal, but not parent, subsidiaries or affiliates Page 25
2. Labor A. Final Rule on Fair Pay and Safe Workplaces Bottom line Huge compliance effort Possible lawsuit to enjoin rule and Congressional response House and Senate passed versions of 2017 NDAA Bills to exempt defense contractors Could be removed by Conference Committee (probably will not be resolved before election) Practical Tip: Identify now in-house person to set up compliance system for proposals, on-going contracts and subcontractor compliance Page 26
2. Labor A. Final Rule on Fair Pay and Safe Workplaces Effective date: October 25, 2016 DOL pre-assessment process starts September 25, 2016 (contractors can submit violation history and DOL will advise contractor if track record for violations (including how violations were addressed) is satisfactory) Page 27
2. Labor B. DOL Proposed Rule Establishing Paid Sick Leave For Federal Contractors 81 Fed. Reg. 9,591 (February 25, 2016) implements Executive Order 13,706 Final rule expected fall 2016 Page 28
2. Labor B. DOL Proposed Rule Establishing Paid Sick Leave For Federal Contractors Affects the following types of contracts entered into after January 1, 2017: Contracts under the Davis-Bacon Act and the Service Contract Act Concession contracts Services contracts related to Federal property or lands Contracts defined broadly to include all contracts and subcontracts at any tier thereunder Page 29
2. Labor B. DOL Proposed Rule Establishing Paid Sick Leave For Federal Contractors Covered employee: Any person engaged in or performing work on or in connection with a contract covered by the Executive Order.... Includes employees exempt from FLSA s minimum wage and overtime provisions Exemption: Employees not directly engaged in performing the specific work called for by the contract and... [S]pend less than 20% of their hours... in a particular workweek... in connection with such contracts. Page 30
2. Labor B. DOL Proposed Rule Establishing Paid Sick Leave For Federal Contractors Employees will accrue 1 hour of sick leave per 30 hours worked Option to grant up to 56 hours at the beginning of the accrual year Contractors allowed to limit total accrued hours to 56 and required to allow carry-over of accrued hours Employees can use paid sick leave for any personal illness/injury, treatment, care of a close family member, or domestic violence situation Page 31
2. Labor B. Proposed Rule Establishing Paid Sick Leave For Federal Contractors Employers not required to cash out employees accrued sick leave upon separation Must reinstate accrued leave if employee re-hired within 12 months Documentation: Employees may request sick leave in writing or verbally at least 7 days in advance for foreseeable situations or as soon as practicably possible Denial must be in writing accompanied by an explanation May only require certification for absences of 3 or more consecutive days only request minimum information Page 32
2. Labor C. DOL Final Overtime Rule 81 Fed. Reg. 32,391 (May 23, 2016) (effective December 1, 2016) Revises the white collar exemption regulations under the Fair Labor Standards Act ( FLSA ) Page 33
2. Labor C. DOL Final Overtime Rule Raises minimum salary level for the white collar exemption to $913/week or $47,476/year White collar workers include executive, administrative, and professional personnel Additional compensation (i.e. bonuses and commissions) can count towards up to 10% of the minimum salary level Minimum salary for Highly Compensated Employees ( HCE ) raised to $134,004/year Page 34
2. Labor C. DOL Final Overtime Rule Establishes mechanism to automatically update the minimum salary level every three years (first increase set for January 1, 2020) Page 35
3. Cybersecurity A. Final Rule: Basic Safeguarding of Contractor Information Systems 81 Fed. Reg. 30,439 (May 16, 2016) (Effective June 15, 2016) Designed to outline basic network safeguards and standardize rudimentary security procedures Page 36
3. Cybersecurity A. FAR Final Rule: Basic Safeguarding of Contractor Information Systems New clause (FAR 52.204-21) in solicitations and contracts when the contractor or subcontractor at any tier may have Federal contract information ( FCI ) residing in or transiting through its information system. Federal Contract Information: non-public information provided by or developed for the Government in connection to the contract, excluding simple transactional information, such as necessary to process payment. Page 37
3. Cybersecurity A. FAR Final Rule: Basic Safeguarding of Contractor Information Systems Requires compliance with 15 basic safeguarding measures Includes: physical security and access monitoring, network scanning, periodic updates of malicious code protection mechanisms, sanitize/destroy media before disposal, maintain policies for limiting system access to appropriate users, limit connections to and use of external systems New requirements are in addition to any other pre-existing requirement(s) for information security or protection of classified material Page 38
3. Cybersecurity B. DFARS Interim Rule Safeguarding Covered Defense Information and Cyber Incident Reporting 80 Fed. Reg. 81,472 (December 30, 2015) (effective same day) Amended previous interim rule extending date of full compliance for contractors to December 31, 2017 Page 39
3. Cybersecurity B. DFARS Interim Rule Safeguarding Covered Defense Information and Cyber Incident Reporting DFARS 252.204-7012 expanded to include all covered defense information Covered Defense Information ( CDI ): controlled technical information, critical information, export controlled information, or any information that law or policy requires safeguarding or controls very broad, encompasses most contracts Must comply with security requirements outlined in National Institute of Standards and Technology (NIST) SP 800-171 Page 40
3. Cybersecurity B. DFARS Interim Rule Safeguarding Covered Defense Information and Cyber Incident Reporting DFARS 252.204-7012 clause also includes requirement that contractors must report incidents within 72 hours Reportable incidents involve compromise of CDI, covered contractor systems, or actions that limit the ability to perform operationally critical support Contractor should register for a DoD-approved medium assurance certificate for incident reporting (see http://iase.disa.mil/pki/eca/pages/index.aspx) Page 41
3. Cybersecurity B. DFARS Interim Rule Safeguarding Covered Defense Information and Cyber Incident Reporting Clause must be flowed down to subcontractors handling CDI Contractor must report to DoD within 30 days of any non-compliance with new security requirements and what substitute measures are in place Full compliance mandated no later than December 31, 2017 Page 42
3. Cybersecurity C. DFARS-FAR Clauses Relationship FAR clause provides basic requirements for almost any government information stored and processed by a contractor DFARS clause only covers CDI FAR clause explicitly states it is not to diminish other more stringent security requirements acts as a supplement Both clauses will likely be included CO should make known use of CDI early in the process Both clauses are required to be flowed down to subcontractors Page 43
3. Cybersecurity D. Potential Contractor Liability for Non- Compliance False Claims Act ( FCA ) Liability Recent Supreme Court decision* made it easier to incur FCA liability when non-compliant with cybersecurity measures Could be liable even when not making an express certification but knowingly fails to disclose... noncompliance with a statutory, regulatory, or contractual requirement. Breach of Contract Liability *Universal Health Servs. v. United States ex rel. Escobar, 136 S. Ct. 1989 (2016) Page 44
3. Cybersecurity F. Future Developments Constantly changing and high-profile area Take steps to comply early with new requirements Know what requirements apply and properly flow down to subcontractors Expect more regulations in the near future Communicate openly with the government about cybersecurity compliance Page 45
Questions? Terence Murphy Kaufman & Canoles, P.C. T (757) 624.3139 F (888) 360-9092 tmurphy@kaufcan.com Page 46