• Increase font size
  • Default font size
  • Decrease font size
Apogee Consulting Inc

“Begun, the Cyber-Wars Have”

E-mail Print PDF

A fake fortuneteller can be tolerated. But an authentic soothsayer should be shot on sight. Cassandra did not get half the kicking around she deserved.”

Robert A. Heinlein

We’ve been warning you about cyber threats and cyber security for quite some time. Surprisingly (to us) our articles have not proven to have been very popular, consistently scoring amongst the lowest in the site article analytics. We have been ringing the alarm bells about cyber security for nearly two years.

In November, 2009, we wrote that—

The AW&ST article reports that the U.S. is under such constant cyber-attack that ‘the definition of ‘success’ has shifted to containing intrusions instead of eliminating them.’ As SecDef Gates noted in a June 2009 memo, ‘our increasing dependency on cyberspace, alongside a growing array of cyber threats and vulnerabilities, adds a new element of risk to our national security.’ … As the AW&ST article reminds us, our adversaries are making advances as well, perhaps in areas in which we are vulnerable to exploitation.

A month later, we reported on the U.S. Cyber Challenge, a nation-wide contest that was designed to “find 10,000 young Americans with the interests and skills to fill the ranks of cyber security practitioners, researchers, and warriors. Some will become the top guns in cyber security.” The United States needs such “cyber warriors,” of course, because it’s tough to defend (or attack) when one lacks resources. We have consistently pointed out that the Pentagon’s over-reliance on tanks and aircraft and missiles is missing the point that the information grid and its infrastructure are its unprotected flank.

In January 2010 we asserted that—

The next big war between nation states probably won’t be fought using tanks and planes; it will probably be fought in cyberspace. The war could be over before a single shot is fired, with the winner being the first to shut down the other side’s electrical and information grids. The soldiers of the next war are in training now. And the United States is way behind other nations in training and equipping its cybersoldiers.

Finally, we noted the following—

We certainly don’t want to be seen as being overly alarmist. So, we’re just saying that the so-called “Iranian Cyber-Army” “may have successfully infected as many as 20 million PCs.” Our cyber-security stories don’t interest many site visitors for some strange reason, but here’s a link to the story at computerworld.com. Again, there’s no reason to be overly concerned about this group, which may or may not be connected to the Iranian government, but which is known for having hacked both Twitter and Baidu. Don’t be worried about its for-rent botnet service. Ignore the fact that investigators found ‘an administration interface where people who want to rent the botnet can describe the machines they would like to infect and upload their own malware for distribution by the botnet.’ …



And while you’re not looking at your lack of cyber-security, take no notice of Darnell Albert-El, of Richmond, Virginia, who was sentenced to serve 27 months in prison for ‘hacking into his former employer’s website’ and ‘one count of intentionally damaging a protected computer without authorization.’ Albert-El, a former IT Director for Transmarx, LLC, was fired by his employer. After his termination, ‘he used a personal computer and an administrator account and password to access the computer hosting the Transmarx website.’ What did he do with his unauthorized access? He ‘caused the transmission of a series of commands that intentionally caused damage without authorization to the computer by deleting approximately 1,000 files related to the Transmarx website.’ ….

So when we heard (in March 2011) that EMC’s security division, RSA, had been hacked, we were hardly surprised. RSA, for those scratching their heads in puzzlement, is the self-proclaimed “premier provider of security, risk, and compliance solutions for business acceleration.” According to its website, RSA “brings visibility and trust to millions of user identities” by helping businesses implement “controls in identity assurance, encryption and key management, SIEM, data loss prevention, and fraud protection.” Except the company founded on computer security found itself the victim of an “extremely sophisticated” exploitation scheme that stole “information related to the company’s SecurID two-factor authentication products.”

As they say, “Physician, heal thyself.”

According to this Wired article, “SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds.” The Wired article also reported—

While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers,’ RSA wrote on its blog, ‘this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack. We are very actively communicating this situation to RSA customers and providing immediate steps for them to take to strengthen their SecurID implementations.’



As of 2009, RSA counted 40 million customers carrying SecurID hardware tokens, and another 250 million using software. Its customers include government agencies.

Well, RSA’s assessment of the situation proved to be—shall we say?—overly optimistic.

On May 21, 2011, less than 60 days after the EMC penetration, aerospace/defense giant Lockheed Martin was attacked in a “tenacious” manner. According to this Financial Times article—

Lockheed did not confirm that the raid on its data built on the attack on RSA, but many analysts said that it was likely, because one of Lockheed’s first acts had been to disable the remote logins.



More disturbing, they said, was the fact like others in the defence industry, Lockheed had previously acted to make itself less dependent on the rapidly-changing numeric passwords the RSA tokens produced.



The RSA breach began with e-mails sent to its staff with an attachment that contained a hidden remote-access program that took advantage of a security flaw in Adobe’s Flash software for viewing content. …



Analysts said it appeared the hackers had obtained the ‘seed’ numbers used to generate passwords. If they combined that with administration information kept by customers associating tokens with specific employees, the passwords could be duplicated.



The National Security Agency went further, declaring not long after the RSA attack that the tokens should no longer be deemed sufficient to grant access to ‘critical infrastructure’. Defence contractors including Lockheed began requiring employees to put in extra personal passwords.



Although Lockheed said its programs and customer data had not been compromised in the attack, the breach suggests that the extra passwords were not sufficient to repel hackers, an ominous sign for remote-access systems in defence and other industries.



Richard Stiennon, a former Gartner security analyst and author of a recent book on cyberwar, said: ‘If there is a direct connection between the RSA breach and the subsequent attacks on Lockheed Martin and other defence contractors, this will be one of the most sophisticated sequences of attack events ever’.



But that’s not all—not by a long shot.



Reports have recently emerged that both Northrop Grumman and L-3 Communications may also have been victims of similar cyber-attacks. One news story reported—



Attackers hit major defense contractor L-3 Communications Holdings by spoofing pass codes from a cloned RSA SecurID token, Reuters reported May 27. The attackers may have used a similar method to target another defense contractor, Lockheed Martin, on May 21. The second-largest U.S. defense contractor Northrop Grumman may also have been hacked, as the company shut down remote access to its network without warning on May 26, according to Fox News. …



L-3 Communications has been actively targeted with penetration attacks leveraging the compromised information,’ an L-3 executive wrote April 6 in an internal memo obtained by Wired Threat Level.

It’s not clear from the internal email whether attackers managed to actually break into L-3 networks, or if they were detected in the midst of the attack. The memo also did not specify exactly why or how L-3 came to the conclusion that the SecurID two-factor authentication system was at fault. An L-3 spokesperson just said the company takes security seriously and that the incident has been resolved.



While the details of these attacks are not “fully known,” it is likely that attackers were able to install a keylogger somewhere within the network, according to Harry Sverdlove, CTO of security firm Bit9. The information captured and knowledge of RSA’s token-generation algorithm would give attackers a way to breach the network, Sverdlove said, noting that this would be a “worst case scenario” for SecurID.

It would mean that a single point of attack can be used to defeat the dual-factor authentication provided by the security tokens,’ Sverdlove said. The keylogger may have been installed on a remote system that connected to the network via a VPN. This makes sense, since the ‘best bet’ is to attack vulnerable endpoints, or computers that are connecting remotely and are likely not under the direct control of the organization’s security policies.



Northrop Grumman does not comment on cyber-attacks against it, the company spokesperson said. It’s also unclear how Northrop Grumman was hit, as ComputerWorld reported that the defense contractor replaced all its SecurID tokens with tokens from a different vendor ‘immediately’ after the RSA breach.

The network shutdown at Northrop Grumman caught ‘even senior managers by surprise’ and caused chaos, according to the Fox News story. ‘We went through a domain name and password reset across the entire organization,’ an unnamed source told FoxNews.com.

Okay. If that were all we had, you might be a little concerned. But we’re not done yet …

This past week, the International Monetary Fund (IMF) was attacked. “The hack's perpetrators obtained a ‘large quantity of data,’ including e-mail and other documents during the intrusion, according to Bloomberg.” The report continued—

How hackers were able to penetrate the IMF's network is still unknown. But it appears the intrusion may have been the result of a spear phishing attack. This kind of attack typically works by tricking an employee into clicking on a link to a malicious website or downloading a file loaded with malware.

And, on June 11, 2011, the hacker collective Anonymous called-out the North Atlantic Treaty Organization (NATO), according to Time Magazine. According to Time, Anonymous issued a response to a recent NATO report on the perils of cyber warfare by telling NATO, “This is no longer your world. It is our world—the people’s world.”

Anonymous’ manifesto continued—

We do not wish to threaten anybody's way of life. We do not wish to dictate anything to anybody. We do not wish to terrorize any nation.



We merely wish to remove power from vested interests and return it to the people - who, in a democracy, it should never have been taken from in the first place.



The government makes the law. This does not give them the right to break it. If the government was doing nothing underhand or illegal, there would be nothing 'embarassing' [sic] about Wikileaks revelations, nor would there have been any scandal emanating from HBGary. The resulting scandals were not a result of Anonymous' or Wikileaks' revelations, they were the result of the CONTENT of those revelations. And responsibility for that content can be laid solely at the doorstep of policymakers who, like any corrupt entity, naively believed that they were above the law and that they would not be caught.



A lot of government and corporate comment has been dedicated to 'how we can avoid a similar leak in the future'. Such advice ranges from better security, to lower levels of clearance, from harsher penalties for whistleblowers, to censorship of the press.



Our message is simple: Do not lie to the people and you won't have to worry about your lies being exposed. Do not make corrupt deals and you won't have to worry about your corruption being laid bare. Do not break the rules and you won't have to worry about getting in trouble for it. Do not make the mistake of challenging Anonymous. Do not make the mistake of believing you can behead a headless snake. If you slice off one head of Hydra, ten more heads will grow in its place. If you cut down one Anon, ten more will join us purely out of anger at your trampling of dissent.

Now you should be nervous.

Our take (besides our repetition of the need to enhance cyber security)? We think we are all watching history being made. We believe that 2011 will one day be noted for the beginning of the cyber-wars.

No, we don’t think we’re being overly alarmist. Just ask Lockheed Martin, or L-3 Communications, or Citigroup, or the IMF. Our website was attacked and wiped-out a few weeks ago—and we had taken the precaution of blocking all IP addresses based in China. (Fortunately, our back-ups worked and we were up and running again within 72 hours.)

We think the U.S. has fallen behind other countries, and parastatial entities, in the strategy and tactics of cyber-warfare. Like the French and their Maginot Line, the U.S. has spent billions on its military assets, without adequately securing the information grid that is the true backbone of its high-tech military. We think the U.S. military is vulnerable; we think corporate America is vulnerable. And we’re pretty sure you are vulnerable as well.

 

Shay Assad Departs DPAP

E-mail Print PDF

Shay Assad

On May 31, 2011 the Defense Department announced that Shay Assad, Director of Defense Procurement and Acquisition Policy (DPAP) had been assigned to a new position, that of Director, Defense Pricing. Both positions report to the Under Secretary of Defense (Acquisition, Technology, and Logistics), so this is a lateral move. Reportedly, Mr. Assad will be replaced by Richard Ginman, one of his deputies.

Seems innocuous, doesn’t it? Not really. We’re going to dig a bit deeper to show you how this transition not only ties into many of the important issues on which we have routinely reported, but that it also establishes the future for DOD acquisition policy.

Mr. Assad has been either the subject of, or a key participant in, many blog articles on this site. A quick search returned 21 articles in which he has been mentioned. He’s been a key figure in our ongoing saga of Defense contractor oversight.

As DPAP Director, he established acquisition and cost policy for the Pentagon. For example, we reported that his Class Deviation implemented the Franken Amendment. Perhaps more importantly to regular readers, he emerged in late 2009 as the mediator in the public flame wars between the DCMA, DCAA, DOD IG, and Commission on Wartime Contracting (CWC). In another “for example,” in this article we reported that Mr. Assad had Chaired the DOD’s Taskforce on Wartime Contracting (TFWC), and that he had concluded that every concern raised by the CWC was already being addressed.

Mr. Assad had established himself as a key leader in the Pentagon’s contractor management. He had been involved in the highest profile issues facing DOD’s acquisition workforce. Recently, reports linked Mr. Assad to the travails of the F-25 JSF program. Reuters reported that—

Carter's deputy, Shay Assad, came to Fort Worth last week to review Lockheed's costs amid growing frustration that only about 15 percent of the plane's cost is linked to ‘touch labor,’ work on the plane actually done in the plant, with the rest linked to Lockheed's overhead.

We touched on these frustrations in our story on customer reactions to program cost/schedule increases. We quoted a report that stated—

Committee chairman Carl Levin said new estimates of ‘life-cycle’ F-35 costs, including development, operation and maintenance, now top $1 trillion. The committee has been a strong supporter of the program, but he asked Carter to present alternatives as a ‘backup’ option within a week. … Senator John McCain of Arizona, the panel's top Republican, described the F-35 program as ‘incredibly troubled’ and a ‘train wreck.’ He suggested the Pentagon think of alternatives to the F-35 program if its costs cannot be brought down. Carter, the undersecretary of defense for acquisition, responded that there were no good alternatives to the F-35, a multirole aircraft due to replace various aircraft in the military fleets of both the United States and its partners.

Mr. Assad’s lateral move to his new position—a position apparently created for him—portends something new in the Pentagon’s approach to establishing contract prices. The new approach was discussed in an interview of Mr. Assad, published online in Federal Computer Week. Mr. Assad said—

One of the things that we are looking at is creating within the DCMA a pricing center of excellence. It would include a market research branch. If people are looking for a particular service, these folks would be able to provide them guidance as to how to go about doing that market research.

Matthew Weigelt, author of the FCW story, summed up Assad’s new responsibilities thusly—


Ashton Carter, undersecretary of Defense for acquisition, technology and logistics, has sought to improve efficiency through the Better Buying Power initiative and other activities that drive down costs, such as increasing competition for contracts.



DOD has also focused on managing program costs. Senior officials are trying to control spending and comparing what an acquisition should cost and what it will cost in the end.



David Berteau, director of the Center for Strategic and International Studies' Defense-Industrial Initiatives Group, said Assad's new position will help reverse 15 years or more of a decline in managing defense contracts and controlling prices. Such a position is long overdue and will have lasting value for DOD.

It is central to the success of Carter's initiatives,’ he said. ‘But more importantly, it will have benefits across all $360 billion of DOD contract dollars.’

Aviation Week reported a Reuters story with an emphasis on weapon system cost control. It reported—


The Pentagon is stepping up efforts to get the best prices possible for up to $400 billion in weapons and services it buys each year, but officials insist they are not trying to slash contractors’ profits.



This isn’t a war on contractor profitability. This really is trying to figure out how do we pay less for the goods and services that we buy,’ Shay Assad, a top aide to the Pentagon’s chief weapons buyer, told Reuters after a news conference to discuss an organizational change that left him with the new title ‘director, defense pricing.’



The reality is we need to step up our game across the board, and so that’s what we’re doing,’ Assad told reporters. He said unlike profit margins, overhead costs would be fair game. ‘That’s cost. How do we get that out?’ …



Assad said his job was not to tighten the screws on contractors, but to help equip the service’s acquisition experts to achieve the best possible deal for taxpayers.

He said he would review all sole source acquisition deals valued at over $1 billion, and some others worth more than $500 million. He would also be involved with pricing for competitive deals, but another official would oversee those negotiations.



Over the next 18 to 24 months, for instance, the Pentagon is revamping its Defense Contracts Management Agency and building a database that will help contract officials compare their programs with those of other services.



DefenseNews reported the story with emphasis on Assad’s role in negotiating contract costs. It said—


There will be a new negotiator at the table as the Pentagon and Lockheed Martin hammer out a pricing deal for the latest batch of F-35 Joint Strike Fighters. Shay Assad, the newly named director of defense pricing, will help the U.S. Defense Department buy weapons at a lower cost than official budget estimates. The creation of the new position is part of the Pentagon's quest to drive down the cost of weapons at a time when defense budgets are constricting. In his new role, Assad will help program managers hit these should-cost targets, which will be set at levels less than official budget estimates.



In addition, he will spend more time improving the contracting and pricing work forces in ‘improving their skills on what it is we pay on the goods and services we buy.’



One of the major elements of this is to transform the Defense Contract Management Agency (DCMA), Assad said. DCMA has hired 300 pricing analysts who will assist contract officers during negotiations for weapons, sustainment, services and other contracts. It will take 18 to 24 months to bring this work force up to speed, Assad said.



Officials are also creating an online system that will ‘enable our contracting officers to get insight into the financial aspects of the companies that we deal with in a real-time way,’ he said. The system, which already includes rate data, is being tested. Currently, it could take contracting officers months or even a year to compile this type of data. Soon it will all be organized under one roof and should take minutes to retrieve. …



Assad will be ‘intimately involved’ supporting the acquisition of the F-35, the Pentagon's most expensive program. DoD converted the program to a fixed-price construct last year and has entered new negotiations for the fifth batch of production aircraft. The F-35 negotiations will likely not wrap up until this fall, Assad said.

We noted above that Mr. Assad’s transfer shows how the DOD intends to manage its contractors. Let’s list some of the strategies mentioned in the various stories above.

  1. Allegedly, 85 percent of the F-35’s unit cost is “overhead”. That’s nonsense, of course, but it plays well. Assad’s intent is to drive down such “overhead” costs by focusing on what those various tasks “should cost” as opposed to what the contractor tells DOD it is actually costing.

  2. Assad is going to focus on enhancing DCMA’s existing skillset in analyzing contractor proposals and their proposed prices, and in negotiating program prices. Reports mentioned that DCMA’s pricing analysts would be key to achieving those goals.

  3. Another aspect of the transformation is to develop insight into contractors’ actual costs. To that end, a database has been created to permit rapid comparisons between contractors.

A couple of final thoughts on the foregoing:

  • Omitted from any reports that we saw was mention of the role of Mr. Charlie Williams, Jr. (Director, DCMA) in the agency transformation. We can’t help but wonder whether Mr. Williams sees Mr. Assad’s new role as being one of additional, badly needed, support—or whether he sees Mr. Assad as stepping on his toes like an elephant at a sock hop.

  • Omitted from any reports that we saw was mention of the role of DCAA in assuring fair and reasonable contract prices. Mr. Assad, who has been an effective mediator between DCMA and DCAA (and other stakeholders), is going to focus on DCMA and nobody has anything to say about DCAA. What’s that about? And while we’re on this topic, what about that DCMA/DCAA dispute resolution process that Mr. Assad was instrumental in crafting and in executing? What’s going to happen to that process without Mr. Assad?

  • About that magic database. Surely the database cannot be intended for use in comparing contractor indirect rates. Nobody can compare contractors’ indirect cost rates because very few contractors have identical cost accounting practices. Some contractors have a lot of direct costs and others have a lot of overhead pools and special cost allocations. What matters is the bottom-line price and not how much is “overhead”. So there must be another purpose to that database….

Leveraging on the points above, let’s speculate wildly for your amusement.

Suppose—and we’re just speaking hypothetically here—just suppose DCMA wanted to stop relying on DCAA. Suppose DCMA was fed up with audit reports that arrived too late, and contained too little reliable information to permit effective contract negotiations. Suppose DCMA was tired with DCAA’s misplaced emphasis on compliance with GAGAS and maintenance of auditor independence. Suppose DCMA wanted to negotiate with contractors on issues ranging from forward pricing indirect cost rates to contractor proposals, and it wanted to conduct those negotiations on its own timetable, and be responsible for its own outcomes. What might DCMA do in that hypothetical situation?

It seems to us that DCMA might develop its own price analysis center of excellence. One that focused on analyzing contractor costs. One that was staffed with dedicated analysts who had been rigorously trained in cost and price analysis techniques—analysts who could match DCAA auditors in proposal analysis expertise. In that scenario, DCMA could conduct its own proposal analyses and negotiate with contractors without the need for a detailed DCAA audit.

And if DCMA wanted to move away from reliance on DCAA to negotiate contractor indirect cost rates—especially forward pricing rates—then DCMA might develop a database of historical contractor indirect cost rates. Such a database might be used for linear regression and other similar statistical analyses, so as to project future contractor indirect cost rates without relying on a detailed audit of contractor budgets. DCMA could negotiate from a position of strength based on its statistical analyses, and would no longer need to wait for a DCAA audit report.

As we’ve asserted before, our belief is that DCMA has given up on DCAA and is frantically trying to develop its own expertise so that Contracting Officers no longer need to rely on audit reports in order to sit down at the negotiating table.

From this viewpoint, Mr. Assad’s new role makes perfect sense: his new job is to get DCMA to “man-up” so that DCAA’s current role in contract pricing can safely be de-emphasized. From this viewpoint, Mr. Assad’s seemingly innocuous transfer portends a significant change for DOD contractor management, one that does not bode well for DCAA.

Watch DOD’s new pricing center of excellence carefully. Watch DCMA’s interaction with DCAA. Look for changes in the current roles and relationships. Those changes might be signs that we’re on the right track.

Hypothetically speaking.


 

Interim DFARS Rule Addresses Contractor Business Systems “Definition and Administration”

E-mail Print PDF

It’s here.

Much like a long-expected—yet dreaded—phone call from your oncology specialist, or your spouse’s divorce lawyer, on May 18, 2011, the new DFARS rule covering contractor “business systems” (aka internal control systems) was published in the Federal Register.

This item has to be among the top two or three issues we’ve been writing about on this website, since we first took issue with the “independent” (but not bias-free) Commission on Wartime Contracting in Iraq and Afghanistan (“CWC”). We’ve published many articles related to this topic, including this notification of the proposed DFARS rule, our comments on that rule (as submitted to the DAR Council), the DAR Council’s revised draft rule, and our additional comments on the revised draft.

Suffice it to say, we’ve been all over this issue like white on rice.

And now we have an interim rule, with additional public comments solicited. (As if those comments are going to affect the rule.…)

DCAA has been holding off on performing its “ICAPS” system reviews for nearly two years, ostensibly awaiting this new rule. (Which is wrong on several levels—including the situation where at least one contractor was left with an “inadequate” accounting system (which kept it from winning new work) because DCAA wouldn’t return to perform a follow-up system review to confirm that all corrective actions had been effectively implemented.) So this new rule permits DCAA to gear-up and get back out there into the field, reviewing and assessing contractors’ systems of internal controls.

(Since DCAA hasn’t been auditing too many contractor internal control systems, and hasn’t been auditing too many contractor incurred cost submissions, one wonders just what the hell they have been auditing … but perhaps that’s a rant better left for another day.)

Let’s summarize the interim rule, remembering that, as a DFARS rule, it applies only to DOD and NASA contractors. If you’re a civilian agency contractor, you need not worry overmuch—though we bet DCAA will assert that the DFARS rule establishes a basis for the adequacy of any contractor’s business systems. In fact, the rule’s promulgating comments assert that, “Because they are designed to be consistent with GAGAS, while are based on standards developed by the American Institute of Certified Public Accountants (AICPA), the system criteria are applicable equally to DoD, NASA, and civilian contractors.” So don’t rest too easy, civilian agency contractors: your time may be coming sooner than you think.

Anyway, here’s our take on the rule:

  1. There are now six (6) contractor business systems of internal control, not 10. They are: Accounting, Estimating, Purchasing, Earned Value Management, Material Management and Accounting, and Property Management. But that’s somewhat misleading, because the adequacy criteria formerly associated with some of the other internal control systems (e.g., Billing System, Timekeeping/Labor Accounting, etc.) now have been consolidated into the adequacy criteria associated with the Accounting System.

  1. A new DFARS clause (252.342-7005, Contractor Business Systems) will be inserted into solicitations and contracts when the contract is a “covered contract” and the solicitation or contract includes one or more of the individual business system clauses (e.g., 252.215-7002, Cost Estimating System Requirements; 252.234-7002, Earned Value Management Systems; 252.242-7004, Material Management and Accounting System; 252.242-7006, Accounting System; 252.244-7001, Contractor Purchasing System Administration; or 252.245-7003, Contractor Property Management System Administration).

  1. A “covered contract” is defined as any contract subject to Cost Accounting Standards (CAS). If you are not a CAS-covered contractor or your contract is exempt from CAS—congratulations! You don’t have to worry too much about this new rule. For example, small businesses are exempt from CAS. (In addition, educational institutions and Federally Funded Research and Development Centers (FFRDCs) also are expressly exempt from the rule’s requirements.)

  1. The administration of the new rule is found at DFARS 242.70 (Contractor Business Systems); between that direction and the language found in the 242-7005 clause, this is how we think it will operate.

    1. DCAA, or other “functional specialists,” will perform reviews of the six business systems. Any “significant deficiencies” will be identified to the cognizant Administrative Contracting Officer (ACO).

    2. A “significant deficiency” is defined as “a shortcoming in the system that materially affects the ability of the Department of Defense to rely upon information produced by the system that is needed for management purposes.” But that definition is somewhat misleading. According to the promulgating comments, “DCAA policy is to report only deficiencies determined to be significant deficiencies” as defined both in the rule and in the Generally Accepted Government Auditing Standards (GAGAS). The promulgating comments note that, “Based on the definition in GAGAS, a significant deficiency is a deficiency, or combination of deficiencies, that adversely affects the entity’s ability to initiate, authorize, record, process, or report data reliably.” So note there is a separate, more detailed definition of “significant deficiency’ that DCAA will be using.

    3. The ACO will make an initial determination to approve or disapprove the business system(s) based on the identification of significant deficiencies by auditor or functional specialist.

    4. The contractor will have 30 days to respond to the initial determination.

    5. The ACO will evaluate the contractor’s response and issue a final determination. If the contractor’s response is unpersuasive, then the final determination will notify the contractor that (i) its system is being disapproved, and (ii) that payment withholds are being implemented.

    6. The ACO will identify “one or more” covered contracts from which the payments will be withheld. When there are multiple systems with significant deficiencies, the ACO is directed to ensure “that the total amount of payment withholding … does not exceed 10 percent of progress payments, performance-based payments, and interim payments … under each of the identified covered contracts.” Similarly, when only a single system is involved, then the withholding limit is five (5) percent of such payments. The ACO has “sole discretion” to identify the covered contracts from which to withhold payments.

    7. Payment withholds will be taken against in-process payments by the DOD, and the ACO will direct that the contractor deduct the payment withholds from prospective invoices that it generates. Payment withholds are not subject to interest payments under the Prompt Payment Act.

    8. The contractor has 45 days to submit a corrective action plan to the ACO. If the ACO “in consultation with the auditor or functional specialist” determines that the contractor is effectively implementing the corrective actions, then the payment withholds “will” be reduced to two (2) percent.

    9. Payment withholds will persist until the ACO “determines that the contractor has corrected all significant deficiencies as directed by the Contracting Officer’s final determination.” The contractor must notify the ACO in writing when it has made all the necessary corrections. At that point, the ACO may discontinue payment withholds and direct the contractor to bill for outstanding amounts due, but only if there is agreement that the significant deficiencies have been corrected; otherwise, the payment withholds will continue.

    10. If the ACO has not made a determination within 90 days, then whatever payment withholds exist must be reduced by “at least 50 percent.”

Looking at the individual business system clauses, we see quite a bit of familiar adequacy criteria. It’s also interesting to see how the granularity of the adequacy criteria varies system by system.

Within the Accounting System Administration clause (for example) we see eighteen (18) criteria that must be met, but none of the criteria are new: they were previously associated with either overall Accounting System adequacy or with one of the subsidiary systems (e.g., timekeeping/labor accounting). But we were impressed to note that there are twenty-four (24) adequacy criteria associated with Purchasing System adequacy.

The single adequacy criteria associated with Property Management is “The Contractor’s property management system shall be in accordance with paragraph (f) of the contract clause at Federal Acquisition Regulation 52.245-1.” But we all know that a DOD Property Administrator expects a contractor to have detailed command media that addresses a multitude of detailed criteria.

There are five (5) adequacy criteria associated with Estimating System requirements. There are two (2) adequacy criteria associated with Earned Value Management Systems—although we note that one of the two criteria references ANSI/EIA-748, which contains 32 criteria. There are three (3) MMAS adequacy criteria.

So to wrap it up, this interim rule seems to be written in such a way that defense and NASA contractors—and perhaps all contractors (as we noted above)—can live with it. That’s not to say that it is without risk. Indeed, we see considerable risk associated with implementation of this new rule. We see two sides to the risk: (1) the known risk associated with the rule language, and (2) the unknown risk associated with how the rule will be actually implemented in the field.

The known risks include:

  • Whether DCAA will comply with the requirement to report only “significant deficiencies,” or if the audit agency will continue the unfortunate trend of reporting every small mistake as a glaring systemic problem.

  • Whether the significant deficiencies will be reported “in sufficient detail” to permit the ACO and contractor to understand both the problem and necessary solution, or whether the contractor will be left in limbo, trying to correct a problem that it doesn’t understand.

  • Whether the ACO will exercise the FAR-provided authority to implement payment withholds only when required—and reduce those payments in line with the rule’s guidance; or if the ACO will timidly await DCAA’s concurrence/permission to take any action.

The unknown risks include:

  • Whether DCAA will apply these criteria to contracts not officially covered by the rule.

  • Whether DCAA will apply pressure to DCMA Contracting Officers to implement payment withholds for relatively insignificant findings.

  • Whether DCMA Contracting Officers will be eager to disapprove contractor systems, knowing the immediate cash flow hit as well as the more long-term undermining of the contractor’s competitive position.

  • Whether the cash flow hit will be of such magnitude to force some contractors out of business.

This is a significant regulatory development. Your company’s cash flow is at risk. DCAA will be issuing audit guidance to implement the rule in the near future. Stay tuned for further details.


 

Final FAR Close-Out Rule Issued

E-mail Print PDF

When we wrote about issuance of the interim DFARS rule on “business systems” we opined that seeing the rule in print was like receiving a long-expected—yet still dreaded—phone call from your oncology specialist or from your spouse’s divorce attorney.

This feeling is worse than that. Much worse.

On May 31, 2011, the final FAR rule on contract close-out was issued in the Federal Register.

Where to start?

Quick-close outs are authorized when unsettled direct and indirect costs associated with the contract do not exceed the lesser of $1 million or 10 percent of the total contract, task order, or delivery order amount. This is more restrictive than the prior language, which focused only on indirect costs and provided for more contracting officer discretion.

(The quick close-out amount(s) also represent a significant reduction from the amount(s) in the proposed rule. DCAA submitted a comment that the proposed amounts were too high. Given that DCAA got everything it wanted in this rule, it is hardly surprising that the FAR Councils lowered the quick close-out ceilings as well.)

The Allowable Cost and Payment contract clause—which is mandatory for cost-type contracts—has been revised to define what an “adequate” final indirect cost rate proposal must look like. It contains fifteen (15) mandatory schedules and fifteen (15) “supplemental” schedules. The 15 mandatory schedules must be submitted in order for the proposal to be considered “adequate” while the 15 supplemental schedules must be provided during audit.

Final “completion” vouchers/invoices must include settled subcontractor amounts/rates. According to the new rule, “The prime contractor is responsible for settling subcontractor amounts and rates included in the completion invoice or voucher and providing status of subcontractor audits to the contracting officer upon request.”

Fee withholds are now mandatory instead of being discretionary. The new rule revises the Fixed Fee clause (52.216-8) to state—

(b) Payment of the fixed fee shall be made as specified in the Schedule; provided that the Contracting Officer withholds a reserve not to exceed 15 percent of the total fixed fee or $100,000, whichever is less, to protect the Government's interest. The Contracting Officer shall release 75 percent of all fee withholds under this contract after receipt of an adequate certified final indirect cost rate proposal covering the year of physical completion of this contract, provided the Contractor has satisfied all other contract terms and conditions, including the submission of the final patent and royalty reports, and is not delinquent in submitting final vouchers on prior years' settlements. The Contracting Officer may release up to 90 percent of the fee withholds under this contract based on the Contractor's past performance related to the submission and settlement of final indirect cost rate proposals.

Similar changes have been made to clauses 52.216-9 (Fixed Fee-Construction) and 52.216-10 (Incentive Fee).

We have railed and ranted about this rule before. In August, 2009, we reported that—

Although some aspects of the proposed rule change did, in fact, address contract close-out activities, the majority of the language turned out to be a ‘wolf in sheep's clothing’ that, if implemented as drafted, will significantly expand the powers of DCAA, and will force contractors to comply with arbitrary DCAA demands or risk monetary penalties.

In October, 2009, we told you about some of the comments the FAR Councils had received. Those comments were considered and, in the main, ignored. Although the ostensible purpose of the rule originally was to improve the contract close-out process, during the rulemaking process that purpose became “to ensure uniformity, consistency, and fairness to all contractors.” The new rule “assures that contractors are fully informed in advance of the Government's parameters for the content of an adequate final indirect cost rate proposal.”

The FAR Councils’ responses to the public comments were, to put it diplomatically, misleading. For example, the FAR Councils assert that, “no new requirement is imposed on contractors by this rule. The list of data (schedules) now included in FAR 52.216-7(d) requires the same information previously cited in FAR 42.705-1(b).”

The language at 42.705-1(b) was—

A contractor shall support its proposal with adequate supporting data. For guidance on what generally constitutes an adequate final indirect cost rate proposal and supporting data, contractors should refer to the Model Incurred Cost Proposal in Chapter 6 of the Defense Contract Audit Agency Pamphlet No. 7641.90, Information for Contractors, available via the Internet at http://www.dcaa.mil.

Unfortunately, that “guidance on what generally constitutes an adequate final indirect cost rate proposal and supporting data” has now become “See the clause at 52.216-7(d)(2) for the description of an adequate final indirect cost rate proposal and supporting data.” And of course, that clause now lists the 15 mandatory schedules we noted above. The guidance has become the absolute rule.

If that’s not a significant regulatory change, we’ll eat our hat(s). Yet that’s what the FAR Councils would have us believe. They state—

The Department of Defense, the General Services Administration, and the National Aeronautics and Space Administration certify that this final rule will not have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601, et seq., because the rule does not impose any additional requirements on small businesses. The changes to FAR parts 4 and 42 clarify and streamline closeout procedures. The changes to the clauses at FAR 52.216-8, 52.216-9, and 52.216-10 allow for a reserve to be set-aside to protect the Government's interest. Contracting Officers already may set aside a reserve under current FAR procedures.

To sum up, this rule does nothing to streamline contract close-outs. Instead, it gives DCAA sole authority to determine whether a contractor has submitted an “adequate” incurred cost submission/final indirect cost rate proposal. Sure, the rule states that the cognizant Administrative Contracting Officer makes the official determination, but when was the last time an ACO picked a fight with DCAA? How many DCMA Review Boards does it take to teach ACOs that the path of least resistance—rubber-stamp agreement with DCAA—is the unofficial DCMA policy?

The proposed rule omits any discussion regarding whether the ACO’s determination constitutes a “final decision” under the Contracts Dispute Act. If the determination is a final decision under the CDA, then it is appealable to the U.S. Court of Federal Claims or to the appropriate Board of Contract Appeals. If it is not a final decision, then no appeal is possible.

And any attempt to fight DCAA’s checklist approach to adequacy, to argue that certain mandatory schedules are not applicable to the facts and circumstances of a particular contractor, will result in monetary penalties—as the ACO invokes mandatory fee withholds that will not released until the contractor agrees (under financial duress) to submit exactly the schedules that DCAA demands.

Did you submit a comment? Did you point out the inequity of this rule? If not, you have no reason to complain. Go download your DCAA “ICE” model and prepare your final rates.


 

DCMA Reinforces Contracting Officer Authority While Industry Criticizes DCAA

E-mail Print PDF

We are looking at the new DFARS “business systems” rule and we’ll have some things to say about it in the near future. To provide context, though, we want to note two recent events.

First, we came into possession of a May 12, 2011 letter from Charlie Williams, Jr. (Director, DCMA) to all DCMA Administrative Contracting Officers (ACOs), entitled “Expectations for Contracting Officers”. The memo starts out by acknowledging that DCMA has been criticized in recent times—by many, including Apogee Consulting, Inc.—for ceding FAR-mandated authority to DCAA auditors. The memo discusses the importance of the ACO role, stating—

At contractor locations where we have determined it is in the government’s interest to establish forward pricing rates, we should be continuously evaluating the rates and the individual pool and base elements that comprise them. In other words, I expect you to be as knowledgeable if not more so than anyone else with respect to the contractor’s rate structures and methodologies so you can provide expert advice based on fact. …

Working closely with DCAA auditors is a critical factor in your ability to be successful in the final outcomes that result from your rate decisions. … it is our policy that when you receive an audit report from DCAA, you should use the audited rates as the single government forward pricing rate recommendation. While this is policy, you will not find anything that states, ACOs should ignore common sense or relinquish their discretion in promulgating FPRRs. So simply put, it is my expectation that ACOs should always apply judgment and well informed thought prior to making any decision. I fully expect that there will be times when the contracting officer determines, in his or her judgment, that the rates contained in the audit may not be the best representation of future projections. When that judgment is well informed by fact and data, you must not be reticent or feel constrained in communicating your views with the auditors and if necessary requesting a Board of Review to elevate real differences.

Well. The above is nicely worded but (as they say) we’ll believe it when we see it. And from our experience, ACOs and other Contracting Officers are not walking that particular walk at the moment.

Before we move on, we also want to note a recent letter sent by the Aerospace Industries Association (AIA) to Patrick Fitzgerald, Director of DCAA, expressing “concerns with the current audit environment”. The letter tells Mr. Fitzgerald that the AIA is “greatly concerned that DCAA’s audits have now virtually eliminated materiality and risk assessments in planning and performing audits.” The AIA letter asserts that, as a result of the DCAA audit issues, “audits now take considerably longer to complete and consume considerably more resources.”

Attached to the AIA letter is a list of 54 audit issues experienced by AIA members. The audit issues range from the serious to the relatively trivial. Here are some examples—

  • Branch Manager claims that contractor’s systems with an ‘adequate’ determination do not reduce risk nor decrease the amount of transaction testing required.

  • Audit started in April 2009, then was reassigned to another auditor in September 2009, and then reassigned to another auditor in April 2010. Since April 2009, the DCAA has only requested information for their risk assessment… DACO requested that give [the audit] a high priority and requested a report by November 2010. Current due date is March 2011.

  • The Contractor is unable to reach an FPRA with the USG because the DCMA cannot negotiate without first having a DCAA FPRP audit report. As no FPRP audit report has been issued during 2010, this has resulted in difficult and protracted contract negotiations for both the Contractor and DCMA.

  • Entrance conference held February 2009. Received verbal notification November 2009 of ‘no findings’. Received notification December 2010 the audit was to be cancelled due to test data being over 9 months old ….

These two events share a commonality. They indicate a disconnect between theory and practice. This disconnect will feature prominently in our upcoming discussion of the DFARS “business systems” rule.

Stay tuned for that article, out soon.

 


Page 202 of 278

Newsflash

Effective January 1, 2019, Nick Sanders has been named as Editor of two reference books published by LexisNexis. The first book is Matthew Bender’s Accounting for Government Contracts: The Federal Acquisition Regulation. The second book is Matthew Bender’s Accounting for Government Contracts: The Cost Accounting Standards. Nick replaces Darrell Oyer, who has edited those books for many years.