On March 24, 2025, the Federal Risk and Authorization Management Program (“FedRAMP”) announced a major overhaul of the program, which is being called “FedRAMP 20x.” The FedRAMP 20x announcement stated there are no immediate changes to the existing authorization path based on agency sponsorship and assessment against the FedRAMP Rev 5 baseline.[1] However, once
Update: On February 22, Maryland District Court Judge Adam Abelson issued a Preliminary Injunction halting the rollout and enforcement of the several provisions in the EO. Relevant here, the PI prohibits the Federal Government from requiring any contractor or grantee to make any certification required by the EO; and prohibits the Federal Government from bringing any
In the Fiscal Year 2025 National Defense Authorization Act (“FY25 NDAA”), Congress included some important provisions related to the bid protest process at the U.S. Government Accountability Office (“GAO”). These provisions (1) raise the dollar threshold for task order protests of Department of Defense (“DoD”) procurements and (2) task DoD and GAO with exploring processes
Over the last few years, the Federal Risk and Authorization Management Program (“FedRAMP”) Program Management Office (“PMO”) has released two draft guidance documents related to defining the applicable boundary for security assessments of cloud service offerings, but final versions were never released. On January 16, 2025, FedRAMP released another draft authorization boundary guidance document (RFC-0004).
On January 8, 2025, the Department of Justice (“DOJ”) published its final rule addressing Executive Order (E.O.) 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.” With the final rule, the DOJ National Security Division’s Foreign Investment Review Section (“FIRS”) defines prohibited and restricted data transactions,
In the ever-evolving world of cybersecurity, even organizations that meet stringent security standards can be victims of sophisticated cyberattacks. A notable example of this is the December 8, 2024 cybersecurity incident involving the U.S. Department of the Treasury and its third-party cloud service provider, BeyondTrust. This incident underscores some critical lessons for entities (both government
The wait is finally over! After more than 14 years of anticipation, the Federal Acquisition Regulation (“FAR”) Proposed Rule on Controlled Unclassified Information (“CUI”) was released on January 15, 2025 and comes as part of the Government’s broader efforts to identify, detect, and respond to ever-evolving threats targeting Federal contractors.
Important Update: On January 28, 2025 the U.S. District Court for the District of Columbia granted an Administrative Stay enjoining OMB from enforcing OMB Memorandum M-25-13 until the Court can hear full arguments, scheduled for February 3. We continue to monitor developments.
With President Donald Trump commencing his second term, significant changes are anticipated across global industries. His series of sweeping executive actions have already sparked pushback and legal challenges.
To kick off the New Year (and as is now tradition, since we put out a similar Recap & Forecast last year), Sheppard Mullin’s Governmental Practice Cybersecurity & Data Protection Team has prepared a cybersecurity-focused 2024 Recap (highlighting major updates and including links to the resources we put out over the past year) and a
