FAR/DFARS Gotchas

Every federal contract is governed by the Federal Acquisition Regulation (FAR) and, for DoD work, the Defense FAR Supplement (DFARS). These rules run to thousands of pages and contain obligations that activate automatically on award — regardless of whether you read them. Here are the ten that catch new contractors most often.

1. Trade Agreements Act / Buy American Act

What it is: Federal law requires that products delivered under most federal contracts originate from the United States or a Trade Agreements Act (TAA) designated country. China, India, Russia, and most of Southeast Asia are non-compliant sources.

Where it trips you: Supply chain country-of-origin. If you're distributing medical or pharmaceutical products sourced from a non-designated country, you're in violation even if you didn't manufacture the product. The obligation flows through your entire supply chain.

The fix: Add country-of-origin attestation requirements to every Purchase Order issued to a supplier. Document the vendor's country of manufacture at order time, not at delivery.

2. DFARS 252.204-7012 — Cyber Incident Reporting

What it is: When you handle CUI (Controlled Unclassified Information) on a DoD contract, you take on a continuous obligation to protect it and report any breach to DoD within 72 hours via the DIBNet portal.

Where it trips you: This isn't a one-time compliance check — it's a permanent operating requirement from Day 1. If your cloud environment doesn't meet FedRAMP Moderate equivalency, you're technically out of compliance the moment CUI touches it. Most contractors don't know what their cloud environment's authorization status is.

The fix: Define your CUI boundary before the contract starts. Keep CUI in a FedRAMP Moderate-authorized environment (Microsoft GCC High, AWS GovCloud, or an encrypted layer like PreVeil). Document this in your System Security Plan (SSP).

3. Limitation on Subcontracting

What it is: On set-aside contracts (SDVOSB, 8(a), HUBZone, WOSB), you must self-perform a minimum percentage of the work: at least 50% of the cost of services, or at least 15% of the cost of manufacturing.

Where it trips you: The ostensible subcontractor rule. If a non-SDVOSB partner is performing the primary and vital work of the contract, SBA can determine the award is being performed by a non-eligible firm — resulting in loss of award, disqualification, and potential debarment. False Claims Act exposure is real.

The fix: Track self-performed labor hours and cost monthly against this threshold. Never let a subcontractor perform the work that makes you the right contractor for this award.

4. Organizational Conflict of Interest (OCI)

What it is: If you provided advice, helped write the statement of work, or accessed proprietary information during the government's planning process, you may be disqualified from bidding the resulting contract.

Where it trips you: Pre-solicitation engagement. If a CO invites you to review their draft requirements document to help them understand the landscape, you may have just disqualified yourself from the competition — even though that wasn't anyone's intent.

The fix: Before providing any assistance to an agency in planning or requirements development, document your concern in writing. Ask the CO directly whether participation creates an OCI. Get the answer in writing.

5. Option Year Pricing

What it is: Most contracts have option years — the government's right (not obligation) to extend performance at pre-agreed prices, often for 3–4 additional years after a base period.

Where it trips you: If you underprice year 1 to win, you're locked into option-year rates (typically fixed with small escalation percentages) for the full life of the contract. Labor costs rise. Your margin collapses in years 3–5. This is the most common reason first-contract winners don't survive to Year 3.

The fix: Use the Department of Labor Employment Cost Index as a baseline for labor escalation. Price all option years to be profitable, not just the base year.

6. CAS — Cost Accounting Standards

What it is: A set of 19 accounting standards governing how costs are measured and allocated. Modified CAS coverage triggers when a single cost-reimbursable contract exceeds $2M. Full CAS applies at $50M+ in covered awards per year.

Where it trips you: Most small businesses on fixed-price contracts never trigger CAS. But the moment you win a cost-reimbursable (T&M or cost-plus) contract over $2M, you need to know your CAS obligations and have accounting systems that comply. Most don't know until DCAA shows up.

The fix: Build CAS-aware direct/indirect cost segregation into your accounting system from Day 1. If fixed-price only, this is low urgency but good hygiene. If you're pursuing T&M or cost-plus work, it's an immediate requirement.

7. Data Rights (FAR 52.227)

What it is: Federal contracts specify what rights the government has to data (technical data, software, reports) developed or delivered under the contract. "Unlimited rights" means the government can share your deliverables with competitors. "Limited rights" protects data developed exclusively at private expense.

Where it trips you: If you develop an algorithm or software tool using government-funded contract time and deliver it under the contract, the government may have unlimited rights to it — including the right to give it to your competition. Many contractors give away their IP without realizing it.

The fix: Before signing, explicitly identify what was "developed exclusively at private expense" (limited rights) versus what will be developed under the contract (potentially unlimited rights). Negotiate data rights clauses before award, not during performance.

8. Subcontractor Flow-Downs

What it is: Many FAR/DFARS clauses must be "flowed down" to your subcontractors — meaning your subs are also bound by the same obligations you are.

Where it trips you: If you are the prime and your subcontractor handles CUI without DFARS 252.204-7012 compliance, you — the prime — are legally responsible for that breach. You cannot disclaim liability by pointing at the sub.

The fix: Every Zeroth subcontract must include the required FAR/DFARS flow-down clauses. Use a standard subcontract template validated against your prime contract terms before you bring on any subcontractor.

9. Government-Furnished Equipment (GFE)

What it is: Sometimes the government provides equipment, facilities, or data for use in performing the contract. You are accountable for it from receipt to return.

Where it trips you: GFE must be tracked on a formal inventory log, not used for any purpose outside the contract, and returned at contract end. Losing or damaging GFE makes your company financially liable. Most contractors treat GFE like free equipment. It isn't.

The fix: Maintain a formal GFE inventory log from Day 1. Confirm the accountability terms in your contract. Never commingle GFE with your own assets.

10. CPARS and the Performance Rating Trap

What it is: Every federal contract over $150K will result in a CPARS rating recorded in the federal database, visible to future contracting officers and prime contractors for years.

Where it trips you: Not reading the performance measures in the contract before you sign. Quality, Schedule, Cost Control, and Business Relations are all rated. If the contract says "weekly status reports due every Monday at 5pm ET" and you deliver on Tuesday, that's a schedule finding — and it goes in your record.

The fix: Map every deliverable to a performance standard before signing. Request informal COR feedback monthly — not just at formal rating time. Address concerns in writing. When the formal rating period opens, read every word and respond if you disagree.