In April, the Federal Government announced “sweeping changes” to the Federal Acquisition Regulations (FAR) intended to streamline federal acquisitions.
Driven by an Executive Order (EO) issued by President Trump titled “Restoring Common Sense to Federal Procurement,” the government was ordered to dramatically scale back the FAR clause requirements mandated to federal contracting officers, which are then traditionally flowed down to the supply chain via contract requirements. The initiative is called the Revolutionary FAR Overhaul.
One of the new updates is that Federal contracts are banned from mandating any certifications such as ISO, CMMI, and CMMC. Per the revised language of 1.106 “Certifications“:
Unless allowed under 41 U.S.C. 1304, the FAR must not require a certification from an offeror or contractor.
41 USC 1304 (here) then only allows certifications to be imposed under strict conditions, such as passing a law or statute, or if a high-ranking agency official provides a written justification for the certification requirement. In the case of defense contract requirements, such as CMMC, this would require the Secretary of Defense, Pete Hegseth, to issue the justification. To date, he has not done so.
In the United States, the number one driver for ISO certifications, CMMI, and CMMC is Federal contract mandate. The new rule would shut this down overnight, requiring such schemes—and their marketers—to sell the certifications on their merits rather than using threats of debarment or prosecution under the False Claims Act.
Despite being in draft, the Federal Government has taken dramatic steps to comply with the Trump EO retroactively. In reporting by law firm PilieroMazza, the changes are in effect right now (emphasis added):
However, in a major break from traditional practice, federal agencies are being directed to begin immediate adoption of the draft text through FAR deviations. This allows new procurement standards to take hold before the conclusion of formal rulemaking—raising serious questions about government contractor input, regulatory stability, and transparency.
As a result, the CMMC program appears effectively stalled once again until Hegseth issues a written justification as required by law. In a further blow to the controversial program, the update demands that “All FAR sections that are not required by statute must expire 4 years after the effective date of the sections, unless renewed by the Federal Acquisition Regulatory Council.”
A representative of the United States Special Operations Command (USSCOM) confirmed that the update directly affects CMMC requirements, telling Oxebridge, “The revisions are in effect [and] the future of CMMC, etc. is still unclear.” The representative then added, “We will know more prior to FY26 when DFARS actually implements CMMC into all solicitations and contracts.”
The CMMC requirement was developed without the passage of a law and is only required by a DFARS flowdown. The DFARS are not statutes.
Regardless, the DoD’s CMMC office, led by Stacy Bostjanick, and CMMC’s program creator Katie Arrington have ignore the Trump EO, instead claiming that the program is still active. Repeating the same argument she had been making as early as 2019, Arrington insisted CMMC is on track, threatening companies by saying, “If it’s too hard, get out of the business.”
Ironically, Arrington herself stepped down from her role at DoD after being accused by the National Security Agency of leaking classified information. She only rejoined the DoD after Trump’s reelection, and now finds her costly, burdensome CMMC program running headlong into Trump’s deregulatory stance.
As for ISO certifications, the removal of demands for such certifications is likely to have a heavy impact on the industry. The oversight bodies have increasingly allowed conflicts of interest to fester since the Federal mandates did not concern themselves with the declining validity of certifications. Without that safety net, the certification and accreditation bodies may face new pressure to provide a truly functional, credible, and ethically responsible service.
Companies holding current contracts with FAR or DFARS clauses that impose certifications are urged to discuss the issue with their customer or Federal contracting officer.
