The Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS) are the two rulebooks that govern almost every obligation you take on when selling to the federal government. The FAR sets a single baseline for all executive agencies. The DFARS adds a defense-specific layer on top for any contract with the Department of Defense. If you want to understand FAR and DFARS requirements for government contractors, the practical picture is this: register in SAM.gov, read the clauses your contract incorporates by reference, and treat the defense-specific overlay (cybersecurity certification, domestic sourcing, tighter audits) as non-negotiable if the buyer wears a uniform.
How FAR and DFARS Fit Together
The FAR is codified at Title 48, Chapter 1 of the Code of Federal Regulations, and its stated purpose is to establish “uniform policies and procedures for acquisition by all executive agencies.”1Acquisition.GOV. 1.101 Purpose A contractor selling cybersecurity services to one agency faces roughly the same procurement rules as a contractor selling office furniture to another.
The DFARS lives in Title 48, Chapter 2, and applies to the Department of Defense, including the Army, Navy, Air Force, Marine Corps, and other defense agencies.2Cornell Law Institute. 48 CFR Chapter 2 – Defense Acquisition Regulations System, Department of Defense It fills gaps where the FAR is silent on defense-specific issues (protecting controlled unclassified information, sourcing critical supplies domestically, running decades-long weapons programs) and tightens FAR provisions that need more specificity for military contexts.
The FAR authorizes agencies to issue supplements, but those supplements cannot conflict with it unless the agency has obtained a formal deviation.3Acquisition.GOV. Part 1 – Federal Acquisition Regulations System4Acquisition.GOV. Subpart 1.4 – Deviations From the FAR When a conflict appears in a Defense contract and no deviation has been granted, the FAR language generally controls. So if you are reading a DoD solicitation, you are always reading two layers at once.
Registering Before You Can Bid
You cannot receive a federal award without an active registration in the System for Award Management at SAM.gov. Registration assigns you a Unique Entity Identifier (UEI) and makes your company visible to contracting officers.5SAM.gov. Get Started With Registration and the Unique Entity ID It must be renewed every 365 days. Letting it lapse means no new awards until you fix it.
For defense work, the same registration produces a Commercial and Government Entity (CAGE) code, which DoD uses to track suppliers across its logistics systems.6Defense Logistics Agency. Commercial and Government Entity Code Without both identifiers, your proposal will not survive the initial administrative check.
Reading the Clauses in Your Contract
Government contracts do not reprint the full text of every regulation. They incorporate clauses by reference: the contract lists the clause number and title, and the clause has the same legal force as if printed in full.7eCFR. 48 CFR 52.252-2 – Clauses Incorporated by Reference The full text is available on request from the contracting officer and on acquisition.gov.
The numbering tells you where each clause comes from. FAR clauses sit in Part 52 and carry numbers starting with 52 (for example, 52.203-13 for the ethics clause). DFARS clauses sit in Part 252 and use a four-digit sequential number in the 7000 series.8Acquisition.GOV. Part 252 – Solicitation Provisions and Contract Clauses Scanning the clause list for 252-series entries tells you immediately which defense-specific obligations are attached.
The moment you sign, every incorporated clause binds you, including ones you never read. A clause requiring 72-hour cyber incident reporting or domestic sourcing does not lose force because it appeared only as a reference number on page 47.
Dollar Thresholds That Change the Rules
Two thresholds shape the process, and both were raised effective October 1, 2025. The micro-purchase threshold rose from $10,000 to $15,000. The simplified acquisition threshold (SAT) rose from $250,000 to $350,000.9Federal Register. Inflation Adjustment of Acquisition-Related Thresholds
Below the micro-purchase threshold, an agency can buy on a government purchase card with minimal documentation. Between the micro-purchase threshold and the SAT, streamlined procedures apply: some competition, far less formality. Above the SAT, the full FAR framework kicks in, with formal solicitation, evaluation criteria, and complete documentation. Where your contract falls tells you how much process to expect.
Contract Types and Where Risk Sits
The FAR splits contracts into two families that allocate cost risk very differently. Under a firm-fixed-price contract, the price does not adjust based on actual spending. The contractor bears “maximum risk and full responsibility for all costs and resulting profit or loss.”10Acquisition.GOV. Federal Acquisition Regulation Part 16 – Types of Contracts Finish under budget and you keep the difference; go over and you absorb the loss.
Cost-reimbursement contracts flip that. The government pays allowable incurred costs up to a negotiated ceiling.10Acquisition.GOV. Federal Acquisition Regulation Part 16 – Types of Contracts The tradeoff is heavier oversight: cost-reimbursement contractors must maintain an accounting system the government can audit and face tighter spending reports.
For commercial products and services already sold in the private market, the FAR pushes agencies toward firm-fixed-price contracts and streamlined procedures.11Acquisition.GOV. Part 12 – Acquisition of Commercial Products and Commercial Services Cost Accounting Standards do not apply to firm-fixed-price commercial acquisitions, which removes a substantial compliance burden.
Domestic Sourcing Requirements
Buy American Act
The Buy American Act applies to all federal agencies. Under current FAR rules, an end product qualifies as domestic if the cost of its domestic components exceeds 65 percent of total component cost for items delivered between 2024 and 2028, rising to 75 percent starting in 2029.12Acquisition.GOV. Part 25 – Foreign Acquisition Products made predominantly of iron or steel face a stricter test: foreign iron and steel content must stay below 5 percent of component cost.
When comparing bids, contracting officers add 20 percent to a lower foreign offer (30 percent if the domestic bidder is a small business) before comparing prices.12Acquisition.GOV. Part 25 – Foreign Acquisition A domestic supplier can win at a somewhat higher price. The preference has been waived for commercial off-the-shelf (COTS) items.
Berry Amendment
The Berry Amendment, at 10 U.S.C. ยง 4862, applies only to defense spending and goes further. It prohibits DoD from using appropriated funds to buy certain items unless they are grown, reprocessed, reused, or produced in the United States.13Office of the Law Revision Counsel. 10 USC 4862 – Requirement To Buy Certain Articles From American Sources Covered items include food, clothing and its component materials, tents and tarpaulins, natural and synthetic fibers, hand and measuring tools, stainless steel flatware, dinnerware, and U.S. flags. The DFARS implements this restriction at Subpart 225.7002.14Acquisition.GOV. 225.7002-1 Restrictions
The Buy American Act is a price preference; a foreign product can still win if the domestic alternative costs enough more. The Berry Amendment is closer to an outright ban for its covered items, with narrow exceptions. Defense contractors in any covered category need to trace their supply chains carefully.
Cybersecurity for Defense Contractors
If you handle Controlled Unclassified Information on a defense contract, you must meet the 110 security controls in NIST Special Publication 800-171 Revision 2. DFARS clause 252.204-7012 already requires this, and contracting officers verify compliance through self-assessment scores posted in the Supplier Performance Risk System (SPRS).15Acquisition.GOV. 252.204-7020 NIST SP 800-171 DoD Assessment Requirements
The Cybersecurity Maturity Model Certification (CMMC) 2.0 program layers third-party verification on top of that. Phase 1 began November 10, 2025, and covers Level 1 and Level 2 self-assessments. Phase 2 begins November 10, 2026, and will start requiring Level 2 certification by an authorized third-party assessment organization (C3PAO) for applicable solicitations.16DoD CIO. About CMMC Assessments are valid for three years, with annual affirmations in between. Contracting officers will not award a contract to an offeror that does not meet the CMMC level specified in the solicitation.
Ethics Code and Mandatory Disclosure
FAR clause 52.203-13 requires contractors on larger, longer-duration contracts to maintain a written code of business ethics, an internal control system to detect violations, and a process for employees to report concerns without retaliation.17Acquisition.GOV. 52.203-13 Contractor Code of Business Ethics and Conduct The obligation flows down to subcontractors above the same thresholds.
The mandatory disclosure piece is the one that catches contractors most often. If you find credible evidence that anyone associated with your contract has committed fraud, bribery, a conflict-of-interest violation, a False Claims Act violation, or received a significant overpayment, you must report it in writing to the agency’s Office of Inspector General and the contracting officer. Failing to disclose is itself grounds for suspension or debarment.
Audits and Contract Administration
The FAR delegates a long list of administration functions to a Contract Administration Office, typically the Defense Contract Management Agency (DCMA) on defense contracts. Those functions include reviewing accounting systems, approving progress payments, monitoring financial condition, and ensuring timely reporting of cost overruns on cost-reimbursement work.18Acquisition.GOV. Contract Administration Functions
On the financial side, the Defense Contract Audit Agency (DCAA) audits defense contractors to verify that claimed costs are allowable, that accounting systems meet government standards, and that indirect cost rates are properly calculated.19Defense Contract Audit Agency (DCAA). Audit Process Overview – Information for Contractors If you hold a cost-reimbursement contract, DCAA audits are close to certain. Getting the accounting system right from day one is much easier than reconstructing compliant records once an audit notice lands.
Small Business Set-Asides
The FAR dedicates a full part to small business programs. Set-aside rules require contracting officers to restrict certain procurements to small businesses, and separate programs exist for service-disabled veteran-owned businesses, women-owned businesses, firms in economically disadvantaged areas, and companies in the Small Business Administration’s mentorship programs.20Acquisition.GOV. Part 19 – Small Business Programs Confirming your size status and any applicable certifications before bidding narrows the competitive field considerably.
If Something Goes Wrong: Protests and Disputes
Two very different processes handle problems, and each has a strict clock.
A bid protest challenges an award or a flawed solicitation. The Government Accountability Office is the most common forum, and protests must be filed within 10 days after you knew or should have known the basis for your challenge.21eCFR. 4 CFR 21.2 – Time for Filing All new protests go through GAO’s Electronic Protest Docketing System (EPDS), and GAO aims to decide within 100 days.22U.S. GAO. Bid Protests Waiting two weeks to consult counsel can mean losing the right to protest at all.
Contract disputes during performance follow the Contract Disputes Act. Every claim goes in writing to the contracting officer, and claims over $100,000 require a formal certification that the claim is made in good faith and the supporting data are accurate.23Office of the Law Revision Counsel. 41 USC 7103 All claims must be filed within six years of accrual. For claims of $100,000 or less, the officer must decide within 60 days of a written request for a decision; for larger claims, the officer has 60 days to decide or to provide a timeline. Missing the deadline is treated as a denial.
Appeals go to the relevant agency Board of Contract Appeals or the U.S. Court of Federal Claims, and you have 90 days from the contracting officer’s decision to file with the board.24Acquisition.GOV. Subpart 33.2 – Disputes and Appeals
Debarment and Suspension
The government’s most severe administrative remedy is debarment, which bars a contractor from receiving new federal contracts, typically for three years. Debarment is government-wide, so losing eligibility with one agency means losing it with all of them. The grounds include:
- Conviction for fraud, bribery, embezzlement, theft, forgery, making false statements, or tax evasion connected to a government contract
- Conviction for violating federal or state antitrust laws in connection with bid submissions
- Willful failure to perform under a contract, or a pattern of unsatisfactory performance
- Intentionally marking a foreign-made product as domestically produced
- Knowingly failing to report criminal violations, False Claims Act violations, or significant overpayments on a government contract
- Owing more than $10,000 in delinquent federal taxes
Suspension uses the same grounds but requires only “adequate evidence” and can be imposed while an investigation is still open. Before debarment becomes final, you receive written notice and 30 days to respond with arguments and evidence. Domestic-sourcing and cybersecurity reporting failures can also trigger False Claims Act liability, where the government recovers three times its damages plus per-claim penalties.26United States Department of Justice. The False Claims Act Given that exposure, every incorporated clause in your contract deserves the same attention you would give a signed personal guarantee.