• Increase font size
  • Default font size
  • Decrease font size
Apogee Consulting Inc

Cyber-Security and You

E-mail Print PDF

We don’t write much about cyber-security.

There are a couple of reasons for that.

First, everything is moving very quickly and it’s tough to hit a moving target. For the past several years, the US Government—especially DoD—has been struggling to adopt a cyber-security framework that provides assurance that contractors (and their supply chains) are reasonably secure from cyber-intrusions. There have been several iterations of that framework and we have been waiting until the framework seemed to reach a close-to-final state.

Second, there are lots and lots of articles that are already being published by law firms, consulting firms, and want-to-be CMMC audit firms. We don’t feel we have much to add to that pile of publications, so we have refrained.

Third, it’s not like we haven’t been ringing this bell for literally years. In 2019, we wrote this article about “cyber-security and subcontractors.” But our interest in this general topic goes back to 2013, when we wrote about supply chain risk, and noted that a final DFARS rule had just been published “that requires ‘defense contractors to incorporate established information security standards on their unclassified networks and to report cyber-intrusion incidents that result in the loss of unclassified controlled technical information from these networks.’” We concluded that 2013 article with a simple sentence: “You have been warned.” We were there seven years ago and we warned our readers that things were changing in this area, and that it was time to get very serious about securing the supply chain.

Thus, savvy contractors (or at least the ones that read this blog) have had seven years to prepare for this. When did your company start preparing?

Where do things stand today, seven years later?

There is the new CyberSecurity Maturity Model (CMMC), which establishes levels of maturity for contractors (and their suppliers) with respect to cyber-security practices. Oversight is provided by the CMMC Accreditation Body (CMMC-AB), The CMMC-AB determines who can be a Registered Practitioner and who can be a Provisional Assessor. In November, 2020, individuals started receiving official “badges” for those positions—and if you are a contractor in need of Certification, you can go to the “marketplace” and find somebody to evaluate you.

There is also something called a CMMC Third Party Assessment Organization (C3PAO) that hasn’t quite jelled yet. But we are quite sure that many consulting firms are ready and eager to get their C3PAO designation so that can help you in this area.

We should mention that the CMMC-AB has itself had an “evolution” over the past year, with Board Members being replaced and new operating philosophies being implemented. But insofar as we can tell, things are settling down there.

Effective 30 November 2020, a new interim DFARS rule dealing with assessments of contractor cyble-security maturity—and establishing required maturity levels in RFPs and contracts—came into effect. To help understand how to implement that new rule, John Tenaglia (the new Director of DoD’s Defense Pricing and Contracting group) issued a helpful guidance memo.

Without rehashing the entire memo, here are some bits we found interesting. Rather than relying on our excerpts, we suggest you go read the memo. But knowing our readers, most will not do so. For them:

  • On or after November 30, 2020, the contracting officer shall, prior to awarding a contract, task order, or delivery order to, or exercising an option period or period of performance with, an offeror or contractor that is required to implement NIST SP 800-171 in accordance with the clause at DFARS 252.204-7012, verify that the summary level score of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old, unless a lesser time is specified in the solicitation) is posted in Supplier Performance Risk System (SPRS) for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order.

  • On or after November 30, 2020, when a requiring activity identifies a requirement for a contract, task order, or delivery order to include a specific CMMC level, the contracting officer shall not award to an offeror that does not have a CMMC certificate at the level required by the solicitation, or exercise an option or extend any period of performance on a contract, task order, or delivery order unless the contractor has a CMMC certificate at the level required by the contract Contracting officers shall use Supplier Performance Risk System (SPRS) to verify an offeror or contractor’s CMMC level.

  • On or after November 30, 2020, use the new provision at DFARS 252.204-7019 in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of COTS items.

  • On or after November 30, 2020, use the new clause at DFARS 252.204-7020 in all solicitations and contracts, task orders, or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial items, except for those that are solely for the acquisition of COTS items. This clause is required to be flowed down to subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items (excluding COTS items)

  • November 30, 2020, through September 30, 2025, use the new clause at DFARS 252.204-7021in solicitations and contracts or task orders or delivery orders, including those using FAR part 12procedures for the acquisition of commercial items, except for solicitations and contracts or orders solely for the acquisition of COTS items, if the requirement document or statement of work, as determined by the requiring activity and approved by OUSD(A&S), requires a contractor to have a specific CMMC level.

  • On or after October 01, 2025, CMMC requirements will apply to all solicitations and contracts or task orders or delivery orders, except for solicitations and contracts or orders solely for the acquisition of commercially available off-the-shelf (COTS) items. On or after October 1, 2025, use the clause at DFARS 252.204-7021 in all solicitations and contracts or task orders or delivery orders, including those using FAR part 12 procedures for the acquisition of commercial items, except for solicitations and contracts or orders solely for the acquisition of COTS items. This clause is required to be flowed down to all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items, excluding COTS items.

  • The CMMC level to be required for subcontractors is the level that is appropriate for the information that is being flowed down to the subcontractor.

To conclude this article, DoD is now making your cyber-security practices—and those of your supply chain—a matter of responsibility for new competitions. If you don’t have what it takes, then don’t bother to submit a proposal. Further, if you do win a new contract award, be prepared to make cyber-security a matter of on-going contract compliance.

We told you this was coming seven years ago. Don’t say you weren’t warned.

 

CAS Board Moves Forward

E-mail Print PDF

As readers know, we are not super satisfied with the recent pace of CAS Board activity. You can blame COVID-19, or you can blame the lack of an industry representative. You can even assert that the CAS Board Chair has other things to think about right now. Whatever the reason, it’s a rare day when we can post anything about CAS Board activity.

This is one of those days.

But before we discuss the CAS Board’s action, we need to put it into context. As part of that context, let’s look at the five stages of grief. They are:

  1. denial

  2. anger

  3. bargaining

  4. depression

  5. acceptance

In fairness, we understand that there is much to criticize in the above model. It’s not necessarily a series of discrete steps that one checks off along the way towards acceptance of loss. But we still think it provides context here: just as there are stages of grief, there are also stages of CAS Board rulemaking.

The difference between the stages of grief and the stages of CASB rulemaking are many; but one fundamental difference is that the CASB rulemaking process is defined by statute. According to the statute, the following summarize the steps of CAS Board rulemaking:

  1. Prepare and publish in the Federal Register a report on the issues associated with the proposed rulemaking (often called a Staff Discussion Paper or SDP)

  2. Publish an advanced notice of proposed rulemaking (ANPRM) in the Federal Register to solicit comments on the report

  3. Publish a notice of proposed rulemaking (NPRM) in the Federal Register and provide all parties affected at least 60 days after publication to submit their views and comments

  4. Publish the final rule

Recently we discussed a Staff Discussion Paper (SDP) regarding possible revisions to Standards 404 and 411. The interesting thing about the SDP was that it didn’t seem to fully embrace the statutory requirement to discuss the issues associated with the proposed rulemaking. Instead, it just asked a bunch of questions. Will the answers lead to publication of an ANPRM or another SDP? We couldn’t say.

The CAS Board moves in mysterious ways.

The CASB also recently published an ANPRM. It wasn’t published in the Federal Register, as statute requires, but there was a Federal Register notice and a link to the ANPRM. So—good enough for government work?

The latest ANPRM aims to conform CAS and GAAP with respect to the concepts of “operating revenue” and “lease accounting.” Most readers will understand that there has been a lot of relatively recent movement in GAAP with respect to those issues; and most readers will similarly understand that there has been zero movement in CAS for decades with respect to those issues. Thus, what was once similar has now diverged, and the CAS Board aims to bring them back together.

Maybe.

We’ll have to see.

With respect to the concept of “operating revenue,” the CAS Board—

… believes that the definition in GAAP is essentially equivalent to the CAS definition, except that the Board notes that, for purposes of management contracts under which the contractor essentially acts as an agent of the Government in the erection or operation of Government-owned facilities, the CAS definition of operating revenue includes only the fee earned for managing the contracts. GAAP provides no such limitation.

So: essentially equivalent but different with respect to GOCO and M&O contracts. The CAS Board proposed to adopt the GAAP definition but retain the exception for such contracts. “The Board solicits public comments to the proposed change to the CAS definition of operating revenue.”

The Board would also like to know “whether changes to cost accounting practices to conform Operating Revenue to ASC 606 should be considered to be a required change, a unilateral change, or desirable change.” In other words, if, by changing the CAS definition of “operating revenue,” there is a need for a corresponding change in a contractor’s cost accounting practice, how should that change be treated for purposes of determining whether there has been a cost increase in aggregate and how that cost increase (if any) should be treated. That’s kind of an important question and CAS-covered contractors should think long and hard about their answer.

With respect to the concept of “lease accounting,” the CAS Board is aware that adoption of ASC 842 means that contractors are putting more leases on their balance sheets, as well as creating a new type of asset called “right-of-use assets.” As the Board explained—

Right-of-use assets were formerly classified as operating leases. Right-of-use assets are recorded on the balance sheet by the lessee as assets and amortized on a systematic basis representative of the pattern in which the lessee expects to consume the right-of-use asset’s future economic benefits. A corresponding lease liability is also recorded by the lessee at the present value of the lease payments not yet paid. It is the recording of right-of-use assets on the balance sheet that may cause the potential confusion as to whether these “assets” are intangible capital assets or tangible capital assets for CAS purposes.

(Readers may recall that, in 2016, the ASBCA ruled that CAS 404 didn’t apply to leases (whether classified as operating or capital leases) because “by its terms” CAS 404 “applies only to ‘tangible capital assets’ and does not apply to a lease because a lease is an intangible asset.” We wrote about that decision here.)

With the wisdom of Solomon, the CAS Board found a solution to any confusion caused by right-of-use assets. It proposed to define them as being neither tangible nor intangible assets “at this time.” This is because “Before right-of-use assets are considered for inclusion on balance sheets, the Board would need to further analyze the impact of these changes [on various other Standards]. Thus, the proposed rulemaking would be to make no rules, pending further analysis.

And some readers wonder why we have issues with the CAS Board’s speed of activity….

In summary, this ANPRM, which represents one of the most significant actions taken by the CAS Board in several years, accomplishes the following:

  1. Makes minor changes that acknowledge GAAP treatment, while preserving the status quo.

  2. Asks more questions.

And … that’s about it.

Great job, CAS Board!

Now go get your rulemaking participation ribbons.

 

Complying with Executive Orders, Part 2

E-mail Print PDF

In the previous article, we discussed the nature of a Presidential Executive Order (EO). We learned that it is, essentially, a directive from the Chief of the Executive Branch to the various Executive agencies and departments. It may have the force of law, depending on circumstances and the relationship between the content of the EO and Congressional intent on that same subject.

But we still didn’t answer the question—to what extent must government contractors comply with Executive Orders?

An EO is published in the Federal Register and it may have the force of law, but it still must be codified in an agency regulation before it can be implemented. For example, the Government Contracts Law Blog (published by the law firm Sheppard Mullin Richter and Hampton) recently posted an article written by David Gallacher and Ariel Debin that discussed implementation of Trump EO #13881, entitled “Maximizing Use of American-Made Goods, Products, and Materials.” In that article, the authors noted that the EO was signed July 15, 2019, but that it was not until September 14, 2020 that the FAR Council published a proposed rule that would implement it. As with most proposed rules, there is a comment period. The comment period ended 11/13/20 with more than 30 public comments received. Now the rulemakers must review the comments and disposition them before issuing a final rule. Once issued, that final rule will need to be incorporated into government contracts.

Then—and only then—will a government contractor need to comply with it.

Until that point in time, it’s just something to be aware of. A future condition that may change compliance requirements associated with Buy American rules, to some extent that is currently unknown. Certainly, if you think your product or service may be impacted by that rule, when implemented, you would want to get out in front of it now. As the attorneys wrote—

Contractors should consider now taking stock of those items manufactured using steel or iron and determining whether those products are made ‘predominately’ (or more than 50 percent by cost) from iron or steel. Contractors also should begin assessing and documenting their compliance with the BAAs new requirements, generally, including the heightened domestic content requirements. This includes a review of products acquired throughout the supply chain, as the impact of these changes also will flow throughout the entire supply chain.

But there is no impact (outside of competitive position) for failing to do so. Indeed, remembering that often the first act of an incoming Presidential Administration is to revoke or significantly modify the EOs of the prior Administration, it is certainly possible that something will change between now and the final rule’s effective date, such that contractors would not want to invest too much time and effort (and money) into compliance measures.

The seeming dichotomy between a statute (or EO) and the regulations that implement it is nothing new to the readers of this blog. We had a similar discussion here throughout much of 2018 with respect to the changes to certified cost and pricing data thresholds mandated by 2018 National Defense Authorization Act. The Act increased the threshold from $750,000 to $2 million (which also increased the CAS coverage threshold from $750,000 to $2 million) but the FAR Council and the DAR Council were (in our view) very slow to act to implement those threshold changes, leaving a disconnect between what the statute said and what the regulations said. (We also noted that the CAS threshold was tied to the statute and not to the regulations, so that threshold changed automatically, even though implementing agency guidance lagged significantly.) There was a spate of Class Deviations and, eventually, the regulations were changed.1 However, that didn’t change the thresholds found in the contracts that had been issued either (a) before the public law was signed or (b) between the time the public law was signed and the time the regulations were revised. That separate disconnect needed to be fixed via “no-consideration” contract mods—if the parties thought to do so.

Thus, in our view an Executive Order applies to Federal agencies and departments, not to contractors. To the extent those agencies and departments then engage in the regulatory rule-making process to revise regulations—and those regulations then prescribe solicitation provisions and contract clauses that make their way into RFPs and contracts—that then establishes the rules for regulatory compliance.

Until then, not so much.

1 Interestingly, it was not until July 2, 2020 that the regulations were (finally) revised in the FAR, nearly three years after the statute was revised. See this Federal Register notice, implementing FAR Case 2018-005. To our knowledge, that regulatory change has not yet been aggregated into a Federal Acquisition Circular (FAC) for formal publication in the FAR System.

 

Another GSA Contractor Settles Legal Problems

E-mail Print PDF

I do not know the company Cognosante LLC. It could be a great company, a top-notch government contractor. I don’t know. I visited the company website and I don’t feel as if I learned much more than I knew before I visited it.

The company’s mission statement includes the following: “We are a mission-driven technology company that delivers innovative and transformative solutions to government. Our missions inform our market focus, business strategy, investments, and culture.” Does that seem as vague to you as it does to me?

Cognosante is apparently in the healthcare space—which is a pretty good place to be these days. I know this because there is a fair bit about healthcare on the website. For example, on the website Cognosante talks about expanding access to healthcare for “200 million Americans with innovative technologies and expert support.” Cognosante also discusses “improving clinical performance with technology, systems integration and citizen engagement services.” In addition, the website discusses “health equity,” and states that the company is involved in “delivering solutions that address and positively impact the social determinants of health and wellness.” That’s all great stuff and I’m sure the company is thriving.

I’m just not sure what any of that means, in practical business terms.

From the website, I also learned that Cognosante has multiple ISO Certifications as well as a HITRUST Certification for “Data Security and Minimized Risk.” In addition, Cognosante has had a CMMI Level 3 Certification since 2019—which is interesting but it is not the same thing as a CMMC Level 3 Certification. It’s cool that the company has invested time and energy into making sure its Quality and other management processes comply with important standards.

But what’s missing is any hint that the company is focused on other aspects of compliance, such as complying with contract terms and conditions. Cognosante has many government contract vehicles, including Alliant 2 and OASIS GWACS, as well as GSA Schedules and a Seaport ID/IQ and several individual state contracts. But you wouldn’t really know that from the company’s website (well, except the part where they list those contract vehicles).

There are open positions and, if you’re in Contracts, they have openings for you. But if you are into cost accounting, CAS/FAR compliance, or related disciplines, then not so much. For example, there’s an opening for a Project Financial Analyst, and that opening states that required qualifications include “5 or more years of experience in a government contracting environment. Working knowledge of indirect rate structures, a plus.” Preferred (but not required) qualifications include “Understanding of various contract types, e.g., cost plus fixed fee, award fee, fixed price contracts, and Government Wide Agency Contracts; Knowledge of monitoring compliance with general contract terms and conditions for government contracts and supporting multiple clients in a fast-paced environment Experience with financial modeling, including revenue projections; Experience with project or program management, including Federal Acquisition Regulation (FAR) and Joint Travel Regulation (JTR) requirements; Experience with accounting standards, such as General Accepted Accounting Principles (GAAP) and Sarbanes-Oxley (SOX).” (Emphasis added.1)

But you’ll notice that there is not much actual expertise being required. It would be nice if the successful candidate had “experience” with the FAR and the JTR, but it’s not actually required. And generally, those two areas of expertise are not found within the “project or program management” disciplines. In a similar vein, it would be nice if the successful candidate had “experience” with GAAP and SOX, but it’s not really something the company is super concerned about. In fact, you can be the successful candidate and know nothing about those areas, so long as you have five or more years of experience in a government contracting environment (working knowledge of indirect rate structures, a plus2). I know many members of aerospace/defense company janitorial staff who have more than five years of experience in a government contracting environment. Presumably, they are just as qualified as anybody for the company’s job opening.

But it doesn’t just end there. Looking at Cognosante’s website again, there is a page devoted to the Leadership Team. The CFO has an impressive pedigree, including a Masters in Engineering and having served the company as both VP of Finance and the company’s Chief Contracting Officer. The Chief Administrative Officer (who oversees both HR and Quality) is similarly impressive. But what I don’t see is any MBA or CPA types in a leadership role. The closest thing I see is that the CEO has a master’s degree in public and private management from Yale School of Management—which is impressive, no doubt. But it’s not an MBA or a CPA. (Note for accuracy: I didn’t check every leadership bio, but I did check the ones I thought would have or should have a compliance role.)

The key role that’s missing on the Leadership Team page is a Chief Compliance Officer. You might argue that should be the role of the General Counsel. You’d be wrong to argue that, but it’s certainly not unheard-of. Yet there is nothing in the General Counsel’s job description that says he is focused on anything other than the law department. There’s no Chief Compliance Officer listed, just as there is no Chief Internal Auditor listed; and there is very little (if anything) that hints that compliance is taken seriously by the Cognosante Leadership Team.

Neither the bios and job descriptions for the Chief Administrative Officer (who is responsible for the Quality function) nor the Chief Financial Officer (who is responsible for financial reporting, billing accuracy, and other compliance matters) have any indication that compliance is something they care about, are focused on, or are responsible for.

The Cognosante website also has an aggregation of recent press releases and other news in which the company is mentioned. There’s something missing there, as well.

What’s missing is this Department of Justice press release announcing that Cognosante LLC “agreed to pay the United States $18,987,789 to resolve allegations that it violated the False Claims Act by using unqualified labor and overcharging the United States for services provided to government agencies under two General Services Administration (GSA) contracts.”

The settlement resolves allegations that Cognosante overcharged the United States for services performed under two GSA MAS contracts, including by providing false information concerning Cognosante’s commercial discounting practices during contract negotiations. It also resolves allegations that Cognosante charged the United States for labor that failed to meet the qualifications in one of the contracts.

In fairness, the press release notes that it was Cognosante, itself, that identified the issues and disclosed them to the US Government. The company “received credit for its disclosure and cooperation.” So apparently there is some type of internal audit/internal compliance function in operation, even if the company’s website ignores it.

But remember, the $19 million settlement was after Cognosante received credit for disclosure and cooperation. That sum is indicative of a fairly large billing problem; and it is likely that the problem went unnoticed for some time before being discovered and disclosed.

Look, I don’t know Cognosante. It could be a great company, a top-notch government contractor. I don’t know.

But I do see correlation between the gaps in the company’s leadership team and the necessity to pay the government $19 million to settle allegations of noncompliance with contract terms and conditions.

Perhaps that will change, now that the company has been burned. Perhaps if I revisit the company’s website in a few months, I’ll see a newfound focus on compliance. Perhaps there will be a Chief Compliance Officer and/or a Chief Internal Auditor.

I hope so.


1 Editorial note: Please explain what “general contract terms and conditions” means in a government contracting environment. Which terms and conditions are general, and which are specific? Show your work.

2 It’s not clear whether “working knowledge of indirect rate structures” means knowledge of how to design them, understanding of the rules of cost pooling and cost allocation, or simply how to take rates one is given and apply them to program budgets.

 

Complying with Executive Orders

E-mail Print PDF

Apologies for the dearth of blog posts in recent weeks. I’ve been … distracted … by other events/issues/concerns associated with national events. It’s been a bit of a struggle to muster the energy to write about the mundane topics associated with government contracts.

Finally, I think I found a topic that sort of combines both things—the national drama and government contracts. And I hope I can pull it off without offending anybody!

I want to discuss Executive Orders and compliance therewith.

President Trump has issued a number of Executive Orders (EOs) in recent days. Since September, 2020, 12 EOs have been issued, ranging from “Establishing the One Trillion Trees Executive Council” (EO #13955, published 10/16/2020) to “Addressing the Threat to the Domestic Supply Chain From Reliance on Critical Minerals From Foreign Adversaries and Supporting the Domestic Mining and Processing Industries” (EO #13953, published 10/05/20). All told, as of today President Trump has issued 195 Executive Orders. Some of the EOs get more publicity than others, and some impact government contracting more than others.

To be clear: I’m not picking on President Trump. All Presidents issue Executive Orders, to a greater or lesser extent. The first EO was issued by President George Washington in 1789. Here’s a link to the Federal Register site that compiles EOs. If you follow the link, you’ll see that, while President Trump’s quantity is higher that other recent Presidents, it’s not super incredibly higher either. For example, Bill Clinton issued 254 EOs during the eight years of his Presidency. Similarly, George W. Bush issued 291 EOs during his eight years. Thus, Trump’s 195 issued over a bit less than four years is higher than Presidents of the recent past—but it’s not 200% higher. I would say it’s within historical norms.

The issue to be discussed is whether a government contractor must comply with an Executive Order. If so, when and how? What are the remedies associated with non-compliance, if any?

First, what is an Executive Order? Here’s a link to a solid 2014 article on that topic, published by the Congressional Research Service. According to the authors, an EO is the result of the inherent powers of the Presidency, granted to the Executive Branch by the U.S. Constitution. The authors wrote—

While the President’s ability to use executive orders as a means of implementing presidential power has been established as a matter of law and practice, it is equally well established that the substance of an executive order, including any requirements or prohibitions, may have the force and effect of law only if the presidential action is based on power vested in the President by the U.S. Constitution or delegated to the President by Congress. The President’s authority to issue executive orders does not include a grant of power to implement policy decisions that are not otherwise authorized by law. Indeed, an executive order that implements a policy in direct contradiction to the law will be without legal effect unless the order can be justified as an exercise of the President’s exclusive and independent constitutional authority. … [I]f issued under a legitimate claim of authority and made public, a presidential directive could have the force and effect of law, ‘of which all courts are bound to take notice, and to which all courts are bound to give effect.’

The U.S. Supreme Court opined on the limits of Presidential power as exercised via EO in its 1952 decision in Youngstown Sheet & Tube Co. v. Sawyer (343 U.S. 579). According to the authors of the CRS study quoted above, that decision is more notable for the five concurring opinions than for the majority opinion. Among those concurring opinions, “Justice Jackson’s has proven to be the most influential.” In his concurring opinion, Justice Jackson identified three groupings of EO, based on each one’s relationship to Congressional authority. In the first category, the President is executing an express or implied authority granted by Congress. In the second category, Congress has neither granted nor denied authority to the President. In the third category, the President’s actions are “incompatible with the express or implied will of Congress.”

Regardless of which category an EO falls under, by their very nature Executive Orders are not permanent directives. As the CRS authors noted, “The President is free to revoke, modify, or supersede his own orders or those issued by a predecessor.” As Presidential Administrations change, often the very first actions taken are to revoke or modify the prior President’s EOs—especially those EOs that have impacted an agency’s rulemaking process. Moreover, Congress may overturn an EO by passing a bill to do so, though that is a relatively rare occurrence. Finally, the CRS authors noted that—

Congress may also inhibit the implementation of an executive order by preventing funds from being used to implement the order. For example, Congress has used its appropriations authority to limit the effect of executive orders by denying salaries and expenses for an office established in an executive order, or by directly denying funds to implement a particular section of an order.

(Footnotes omitted.)

To sum this up, an Executive Order may have the force of law in certain circumstances; however, since EOs tend to be rather ephemeral, that force may not be long-lasting.

But must contractors comply with Executive Orders?

While I am not a scholar of constitutional law (nor even any kind of legal scholar), I am fairly confident that an Executive Order means very little until it is codified in an agency regulation. We’ll talk more about that in Part 2, coming soon.

 


Page 13 of 278

Newsflash

Effective January 1, 2019, Nick Sanders has been named as Editor of two reference books published by LexisNexis. The first book is Matthew Bender’s Accounting for Government Contracts: The Federal Acquisition Regulation. The second book is Matthew Bender’s Accounting for Government Contracts: The Cost Accounting Standards. Nick replaces Darrell Oyer, who has edited those books for many years.