On January 21, 2025, President Trump signed an Executive Order (“EO”) purporting to “End[ ] Illegal Discrimination and Restoring Merit-Based Opportunity.” This wide ranging EO contains several provisions directly affecting government contractors—one of which appears to open up government contractors to False Claims Act (“FCA”) liability relating to DEI activities.Continue Reading The Squeeze is the Juice – Utilization of The False Claims Act in the DEI/Government Contracting Executive Order 

In the Fiscal Year 2025 National Defense Authorization Act (“FY25 NDAA”), Congress included some important provisions related to the bid protest process at the U.S. Government Accountability Office (“GAO”). These provisions (1) raise the dollar threshold for task order protests of Department of Defense (“DoD”) procurements and (2) task DoD and GAO with exploring processes to make protesting DoD procurements more difficult.Continue Reading FY2025 NDAA Increases the Threshold for DoD Task Order Protests and Asks GAO and DoD to Explore Changes to Bid Protest Process

Over the last few years, the Federal Risk and Authorization Management Program (“FedRAMP”) Program Management Office (“PMO”) has released two draft guidance documents related to defining the applicable boundary for security assessments of cloud service offerings, but final versions were never released. On January 16, 2025, FedRAMP released another draft authorization boundary guidance document (RFC-0004). FedRAMP’s authorization boundary guidance is “the most frequently requested policy update” as it forms the foundation for determining the scope of review for assessment and authorization. The new draft currently is open for public comment through February 17, 2025.Continue Reading FedRAMP Releases New Draft Authorization Boundary Guidance

On January 8, 2025, the Department of Justice (“DOJ”) published its final rule addressing Executive Order (E.O.) 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.” With the final rule, the DOJ National Security Division’s Foreign Investment Review Section (“FIRS”) defines prohibited and restricted data transactions, and outlines trusted data flows for companies with overseas operations involving countries of concern, including IT infrastructure. The general effect of the rule is to close “front door” access to bulk sensitive personal data on U.S. persons and certain U.S.-government-related data. Until now—or rather, April 8, 2025, when the majority of the rule becomes effective—nefarious actors could procure sensitive data through legitimate business transactions.Continue Reading Data, Deals, and Diplomacy, Part III: DOJ Issues National Security Final Rule with New Data Compliance Obligations for Transactions Involving Countries of Concern

In the ever-evolving world of cybersecurity, even organizations that meet stringent security standards can be victims of sophisticated cyberattacks. A notable example of this is the December 8, 2024 cybersecurity incident involving the U.S. Department of the Treasury and its third-party cloud service provider, BeyondTrust. This incident underscores some critical lessons for entities (both government agencies and private sector) that rely on third-party cloud service providers (“CSPs”).Continue Reading Looking Beyond FedRAMP – Lessons from the U.S. Treasury Cybersecurity Incident

The wait is finally over! After more than 14 years of anticipation, the Federal Acquisition Regulation (“FAR”) Proposed Rule on Controlled Unclassified Information (“CUI”) was released on January 15, 2025 and comes as part of the Government’s broader efforts to identify, detect, and respond to ever-evolving threats targeting Federal contractors.Continue Reading At Long Last – The FAR CUI Rule is Here! 

Important Update: On January 28, 2025 the U.S. District Court for the District of Columbia granted an Administrative Stay enjoining OMB from enforcing OMB Memorandum M-25-13 until the Court can hear full arguments, scheduled for February 3. We continue to monitor developments.Continue Reading ALERT: Trump Administration Issues “Pause” on Federal Grant Spending Effective January 28

To kick off the New Year (and as is now tradition, since we put out a similar Recap & Forecast last year), Sheppard Mullin’s Governmental Practice Cybersecurity & Data Protection Team has prepared a cybersecurity-focused 2024 Recap (highlighting major updates and including links to the resources we put out over the past year) and a 2025 Forecast (previewing what we expect to see in 2025). This Recap & Forecast covers the following six high-interest topic areas relating to cybersecurity and data protection:Continue Reading Governmental Practice Cybersecurity and Data Protection: 2024 Recap & 2025 Forecast Alert

Cell phone and laptop searches do happen but they are relatively rare. Although the Fourth Amendment right to be free of unreasonable searches and seizures is drastically reduced at a port of entry, as are expectations of privacy, U.S. Customs & Border Protection (“CBP”) has internal protocols requiring Officers to have some basis for the search. Below, we dive into the CBP protocols and what to expect if you are selected for a search. Continue Reading Will CBP Search Your Laptop and Cell Phone at the Port of Entry?