The Revolutionary FAR Overhaul is the federal government's effort to rewrite its entire procurement rulebook — and on June 23, 2026, it moved from policy to proposed law. The FAR Council published its first four proposed rules, with public comments due July 23. Nothing is final yet, but the direction is set. Here is what it means for a small IT or cyber contractor.

The Federal Acquisition Regulation (FAR) is the rulebook every federal agency uses to buy goods and services. The Revolutionary FAR Overhaul — launched by Executive Order 14275 ("Restoring Common Sense to Federal Procurement," April 2025) and steered by OMB Memorandum M-25-26 — aims to strip it back to what statute requires, rewrite it in plain language, and remove decades of accumulated non-statutory rules.

The mechanism is a series of twelve proposed rules that together will revise the FAR in its entirety. The stated goal is a leaner, faster, more navigable rulebook — and, explicitly, a lower barrier to entry: the proposed rules note the steep decline over the past two decades in the number of companies willing to do business with the government. For a small firm, that intent matters: less administrative drag is the whole point.

The FAR Council issued the first four of those twelve proposed rules, which together touch 20 FAR parts:

Comments on all four are due July 23, 2026 — a 30-day window, the statutory minimum, which signals the Council intends to finalize quickly, most likely within 2026. One point to hold onto: these are proposed rules, not final ones. Nothing here is in effect, and nothing changes your obligations today.

Almost everything relevant to a cyber-focused firm sits in FAR Case 2026-001. Four changes are worth your attention.

A new FAR Part 40 consolidates the security rules. The proposed rule creates Part 40, "Information Security and Supply Chain Security," and relocates into it the security requirements, prohibitions, and exclusions that are currently scattered across FAR Part 4. That includes supply-chain risk processing (FASCSA orders), the Section 889 prohibition on certain telecommunications and video-surveillance equipment, and information-safeguarding requirements — including those tied to Controlled Unclassified Information. The practical effect for now is consolidation, not repeal: the security obligations you already meet don't vanish; they move to one place and get harmonized.

FAR Part 39 is retitled and trimmed. Part 39 becomes "Acquisition of Information and Communication Technology." The proposed rule deletes duplicative provisions — including FAR 39.105 (Privacy) and the clause at 52.239-1 (Privacy or Security Safeguards) — folds in the NICE Workforce Framework for Cybersecurity, and adds guidance on Position, Navigation, and Timing services. If you sell IT or cyber services, this is the part that governs how that work is bought.

SAM.gov registration gets lighter. The Part 4 changes eliminate roughly half of the information previously required to register an entity on SAM.gov — a deliberate move to reduce burden and bring new entrants into the market.

The automatic sunset is gone — replaced by review. The earlier class deviation made all non-statutory FAR language expire automatically after four years. That concept is removed. Under the proposed FAR 1.109, non-statutory provisions instead remain in effect until the FAR Council removes them through formal rulemaking, subject to periodic review. Rules no longer disappear on a timer; they have to be actively retired.

Outside Case 2026-001, the changes are less IT-specific but worth knowing as context:

This is the reassurance to internalize: the FAR Overhaul does not touch CMMC. Your cybersecurity-certification obligations are governed by 32 CFR Part 170 and the DFARS — not the FAR parts in this batch — and none of the June 23 proposed rules alter them. The Phase 2 deadline of November 10, 2026 still stands. If you have not completed a gap assessment, posted an SPRS score, or started preparing for an assessment, those remain your most immediate priorities, regardless of what happens with the FAR.

One detail worth tracking, not acting on: the FAR's basic safeguarding clause for federal contract information (FAR 52.204-21 — the FCI baseline that CMMC Level 1 maps to) is among the Part 4 items proposed to move into the new Part 40. That is a relocation to watch when the rule finalizes, not a change to what you must do today.

Only 4 of the 12 rules are out. The single most consequential piece for small businesses — FAR Part 19, small-business set-asides — is not in this batch. It is slated for a later package. Until it publishes, the set-aside framework you operate under is unchanged: 8(a), SDVOSB, HUBZone, WOSB, and the Rule of Two all stand as they are. When the Part 19 rule lands, it will be the development to watch, and we will cover it in full.

Is the FAR Overhaul in effect now? No. The rules published on June 23, 2026 are proposed rules. They invite public comment (due July 23, 2026) and do not change any contractor obligation until the FAR Council issues final rules — widely expected later in 2026, though no effective date is stated.

Does the FAR Overhaul change my CMMC requirements? No. CMMC is governed by 32 CFR Part 170 and the DFARS, not the FAR parts in this batch. None of the June 23 proposed rules alter CMMC, and the Phase 2 deadline of November 10, 2026 remains in place.

What is the new FAR Part 40? Part 40, "Information Security and Supply Chain Security," is a new part proposed in FAR Case 2026-001. It consolidates security requirements, prohibitions, and exclusions — supply-chain risk, the Section 889 telecom prohibition, and information safeguarding including CUI — that are currently spread across FAR Part 4.

Will the FAR Overhaul change small-business set-asides? Eventually, possibly — but not yet. FAR Part 19, which governs set-asides, is not in this first batch of proposed rules. It is expected in a later package. Until then, the set-aside framework is unchanged.

How do I comment on the proposed rules? Submit comments through regulations.gov on or before July 23, 2026, citing the relevant FAR Case number (for the IT/cyber changes, that is FAR Case 2026-001, Docket No. FAR-2026-0001).

All primary. Verified as of June 27, 2026.