On December 23, 2024, President Biden signed The National Defense Authorization Act (NDAA) for Fiscal Year 2025 (P.L. 118-159) into law. The legislation authorizes $895.2 billion in funding for Department of Defense (DoD) and Department of Energy (DOE) national security programs. Beyond authorizing spending and setting other priorities, NDAA introduces a range of provisions – some effective immediately and others requiring implementing regulations – that impact procurement practices for government contractors and have broad implications on national security. Below are the provisions most significant to companies across various industries – including defense, technology, life sciences, and commercial items – engaging in U.S. government contracting.
Federal acquisition policy and administration-related changes
Acquisition provisions
Sections 804, 805, and 861 establish new acquisition authorities for expedited contracting and streamline the acquisition of innovative technologies.
Section 804 codifies – at 10 U.S.C. section 3602 – a new Middle Tier of Acquisition authority for rapid prototyping and rapid fielding. This authority will allow DoD to conduct expedited acquisitions within the rapid prototyping pathways if the operational capability is fielded within five years and meets other requirements under section 804.
Section 805 enhances DoD’s existing software acquisition pathway by authorizing use of the pathway for the procurement of commercial or non-developmental hardware in which software acquired via the pathway is embedded.
Section 861 directs DoD to create a pilot program aimed at expediting the acquisition of innovative technologies through competitive, merit-based solicitations, with preferences for small businesses and nontraditional contractors.
Bid protest provisions
Under Section 885, the U.S. Government Accountability Office (GAO) and DoD must develop a proposal to change several existing practices and submit their recommendations by June 1, 2025. Combined with another attempt by Congress to make protestors pay for unsuccessful bid protests, the most important protest-related change is an increase to the threshold for GAO protests of task orders under DoD indefinite delivery, indefinite quantity (IDIQ) contracts from $25 million to $35 million, effectively limiting the number of DoD task orders eligible for protest. Section 885 also requests a process for enhanced pleading standards for GAO protests prior to production of the agency report.
Additionally, Section 885 requires a proposal for recouping certain protest costs, which is to include the average costs of protests to DoD and GAO based on the value of the contract being protested and lost profits for the awarded contractor while contract performance is stayed, as well as a process for unsuccessful protesters to pay the government and the awarded contractor.
Nontraditional defense contractor provisions
Section 815 amends 10 U.S.C. section 3702(a)(3) to allow nontraditional defense contractors to submit recent price history instead of cost or pricing data for subcontracts under $5 million.
Section 863 extends the pilot program for streamlining awards for innovative technology projects to small businesses and nontraditional defense contractors from October 1, 2025, as set in the FY 2022 NDAA, until October 1, 2029.
Section 864 requires DoD to establish a pilot program that allows contracting officers to use an alternative, capability-based analysis to determine the reasonableness of proposed prices or fees of commercial products or services offered by nontraditional defense contractors.
Section 888 requires DoD to establish a process to track other transaction awards to small businesses and nontraditional defense contractors.
Small business provisions
Sections 871, 874, and 876 require DoD to establish pilot programs and initiatives geared toward small businesses.
Section 871, which amends section 9 of the Small Business Act, 15 U.S.C. section 638, requires DoD to establish a pilot program allowing military research and educational institutions to participate in the Small Business Technology Transfer program.
In accordance with section 874, DoD must establish a pilot program that streamlines access for small businesses and higher learning institutions to shared classified commercial infrastructure. This aims to increase small business participation in classified contracts by increasing access to shared classified commercial infrastructure and to simplify the process for small businesses and higher education institutions to apply for and maintain facility clearances.
Under the pilot program, DoD must update or establish policies and regulations governing commercial classified infrastructure and determine how small business contractors may obtain necessary facility sponsorship, authorization, and accreditations. The pilot program will expire on September 20, 2030.
In addition to pilot programs, section 876 directs DoD’s Small Business Integration Group to develop a Small Business Bill of Rights for DoD and its components.
Contract administration provisions
Section 803 amends 10 U.S.C. section 3372(b) to clarify that a DoD contracting officer’s unilateral definitization of an undefinitized contract action is a final decision that may be directly appealed to the Armed Services Board of Contract Appeals (ASBCA) or the United States Court of Federal Claims. Congress’s change is contrary to recent decisions of the ASBCA and United States Court of Appeals for the Federal Circuit that required a contractor seeking to challenge a unilateral definitization to first submit a separate claim to the contracting officer. The provision will increase efficiency in claims resolution as it enables contractors to directly challenge the contracting officer’s decision without additional procedural hurdles.
Section 824 amends section 822 of the FY 2023 NDAA, which permitted contractors and subcontractors impacted by inflation to file claims for relief. This same amendment also clarifies that DoD may use appropriated funds to pay contractors’ and subcontractors’ claims for relief and extends the authority to provide relief to December 31, 2024.
Other key acquisition provisions
Turning to commerciality determinations, section 814 requires that a product or service previously acquired using Federal Acquisition Regulation (FAR) part 12 procedures qualifies as having a prior commerciality determination, even if minor modifications are made after the initial determination. To disregard this determination, the contracting officer must submit a writtendetermination explaining why the product or service is not commercial, which, in turn, puts the decision in the hands of the senior procurement executive of the military department concerned.
Under section 881, which amends FAR subpart 9.503 (Waiver), requests for organizational conflict-of-interest waivers must include a written justification, and this provision also prohibits delegation of the waiver authority below the deputy head of an agency.
National security-related changes
China-related provisions
Section 839 expands upon the reporting requirements of section 855 of the NDAA FY 2022 for contractors to disclose employees, including affiliates, who perform work “for, or are subject to the laws or control of the People’s Republic of China on covered contracts.” “Covered contracts” are now any “contract or subcontract for, or including, any information and communications technology,” including contracts for commercial products or services. Certain contractors must also make disclosures regarding any required vulnerability disclosures to a Chinese government entity.
Section 851 prohibits DoD from contracting with an entity or its parent or subsidiary companies if that entity is party to a contract with a “covered lobbyist,”[1] effective June 30, 2026. “Covered lobbyist” is defined as any entity that engages in lobbying activities – as described in the Lobbying Disclosure Act – for any entity on the Chinese Military Companies List (CMC List). But there is an exception for contractors that conduct “reasonable” due diligence into their lobbyists’ activities.
Section 853 prohibits DoD from entering into or renewing a contract for “covered semiconductor products and services” with any entity that “knowingly provides covered semiconductor products or services: to Huawei” and its affiliates or subsidiaries. This section further directs DoD to create a process for a “covered semiconductor products and services” provider to certify that it is not providing such services to Huawei and, therefore, is not subject to the prohibition. Additionally, the Secretary of Defense (SecDef) can waive the ban in certain instances where the provider is the only entity that can provide the services and it is necessary for DoD’s “national security systems or priority missions.”
Section 1346 outlines modifications of public reporting of Chinese military companies operating in the United States, and now requires SecDef to include the justification for each entity’s inclusion on the unclassified version of the CMC List. Section 1346(4) requires that before December 31, 2026, SecDef is also required to submit a report to the House and Senate Armed Services Committees “on the status of DoD procurement restrictions on entities included” on the CMC List.” Additionally, under the revised definition of “Chinese military company,” all subsidiaries who are held, 50% or more, by a CMC List entity will be considered a Chinese military company, and, as such, DoD procurement-related restrictions would apply to those subsidiaries.
Cybersecurity provisions
Section 1502 restructures command of DoD’s Information Network to improve cybersecurity and designates the Joint Force Headquarters-Department of Defense Information Network as a subordinate unified command under the United States Cyber Command.
Section 1504 mandates that, within the next year, the Assistant Secretary of Defense for Cyber Policy must establish and conduct a “Cyber Threat Tabletop Exercise Program” to prepare DoD and the defense industrial base for cyberattacks preceding or during times of conflict or wars.
Section 1514 establishes that, by no later than June 21, 2025, SecDef, through the DoD Chief Information Officer, must develop a strategy for the management and cybersecurity of the multi-cloud environments of the Department.
Section 1515 requires SecDef to carry out a detailed evaluation of the cybersecurity products and services for mobile devices to identify products and services that may improve the cybersecurity of mobile devices used by DoD, including mitigating the risk to DoD from cyberattacks.
Supply chain provisions
Section 162 requires DoD to identify risks and increase the resiliency of the supply chain for small unmanned aerial systems through the disassembly and analysis of commercially available foreign drone aircraft.
Section 848 establishes that, on an annual basis, the Under Secretary of Defense for Acquisition and Sustainment shall develop and maintain a list of all domestic nonavailability determinations, submit the list to Congress, and develop a plan for sharing such list with industry partners.
Reed Smith’s Government Contracts and National Security practices will closely monitor the implementation of the NDAA and are prepared to help your company navigate the direct and indirect implications of this law.
[1] This provision appears to be missing critical language. While we have outlined the presumptive intent of section 851, titled “Prohibition on Contracting with Covered Entities that Contract with Lobbyists for Chinese Military Companies,” Congress and DoD should address any ambiguity before it takes effect on June 30, 2026.