Federal Contracting in 2026: A Rewritten FAR, a Paused CMMC and New 8(a) Rules

For small businesses that sell to federal agencies, 2026 has been a year of moving targets. The rulebook is being rewritten, a major cybersecurity deadline was set and then suspended, small business programs are being reshaped, and agencies are running on short-term funding.

None of this changes the basics of winning work: find the right opportunities, prove you can deliver and be easy to vet. But it does change the timing, the paperwork and where owners should spend their time. Here is where things stand as of late October 2026.

The FAR is being rewritten from the ground up

The Federal Acquisition Regulation, the rulebook agencies follow when buying from the private sector, is in the middle of what the government calls the Revolutionary FAR Overhaul. It stems from Executive Order 14275, "Restoring Common Sense to Federal Procurement," signed in April 2025. According to the official overhaul site on acquisition.gov, the goal is to return the FAR to its statutory roots, rewrite it in plain language and remove most non-statutory rules, with practical advice moved into separate, non-regulatory buying guides.

The overhaul has now entered formal rulemaking. On June 23, 2026, the FAR Council published its first four proposed rules, covering parts that include acquisition planning, market research, public notice of contract opportunities, ethics and contract termination. The SBA's Office of Advocacy noted that these proposals update the bid protest process, establish a unified cybersecurity framework and consolidate procurement forms onto one website. The rules themselves acknowledge a significant decline over the past 20 years in the number of businesses, especially small businesses, participating in the federal supplier base.

A second set of four proposed rules followed on September 18, 2026, reaching commercial buying, simplified acquisitions, negotiated procurements, Federal Supply Schedules, contract types, multiple-award contracts and task orders, construction, and SBIR and STTR coverage. Comments closed October 19. The SBA describes these as the second of four planned sets, so more is coming. Neither set so far has covered FAR Part 19, the part that governs small business programs.

What it means for small firms

In the short term, the overhaul adds a learning curve. Clause numbers, thresholds and procedures may shift, and solicitations may cite rewritten parts while formal rules are still being finalized. In the longer term, a shorter, plainer FAR could lower the cost of entry, which is the stated intent.

Contractors handling this well read new solicitations closely instead of assuming familiar clauses still apply, follow the overhaul pages on acquisition.gov, and comment on proposed rules that affect them directly. The SBA's advocacy office specifically invited small businesses to weigh in.

CMMC: Phase 2 is on hold, but the obligations are not

For defense contractors, the biggest story of the year is the Cybersecurity Maturity Model Certification (CMMC) program. Phase 2 was scheduled to begin November 10, 2026, making third-party Level 2 certification a standard condition of award for many contracts involving Controlled Unclassified Information.

On July 13, 2026, the Department of Defense (which now also uses the name Department of War) suspended the Phase 2 third-party and government-led assessment mandates and launched a 60-day, top-to-bottom review by a new CMMC Reform Task Force. The department's memo pointed to the heavy burden the current program places on many contractors. Active solicitations and contracts that already included Level 2 or Level 3 assessment requirements are to be amended.

What did not change is just as important. According to legal analysis of the memos, contractors still must meet:

DFARS 252.204-7012 safeguarding and incident-reporting requirements.
The basic safeguarding clause at FAR 52.204-21.
NIST SP 800-171 Revision 2, including system security plans and plans of action.
Score postings in the Supplier Performance Risk System and annual affirmations.
CMMC Phase 1 self-assessment requirements, which remain in force.

The department also said no CMMC waivers would be granted during the review. At the Cyber AB's September town hall, the accreditation body stressed that the program itself is still operating: third-party assessors are still conducting Level 2 certifications, and the task force's recommendations still had to go through internal review before any public release, with no set timeline. As of this writing, no new Phase 2 date has been announced.

How contractors are responding

The firms on the strongest footing are treating the pause as extra time, not a reprieve. They are keeping their NIST SP 800-171 documentation current, checking that their posted assessment scores are accurate, and asking prime contractors whether any CMMC flow-down requirements in their subcontracts still stand. Those who were preparing for a third-party assessment are weighing whether to proceed now, since certifications are still being issued, or wait for the task force's outcome.

Small business programs are shifting

Small businesses still won a large share of federal spending. According to the SBA's fiscal year 2025 scorecard, the government awarded nearly 28 percent of prime contract dollars to small businesses, about $179 billion, against a statutory goal of 23 percent. Including subcontracts, small businesses received nearly $273 billion.

The 8(a) Business Development Program, though, is going through significant change. The SBA launched what it describes as the first audit of the program in its history and began termination proceedings for nearly 800 firms that it said failed to meet program requirements or did not provide requested financial documents. Awards to 8(a) firms fell to 3.7 percent of prime contract dollars in FY 2025, or $24.3 billion, a $1.5 billion decrease from the prior year.

On August 11, 2026, the SBA published a final rule removing the presumption of social disadvantage for certain groups in the 8(a) program. Under the new standard, individual applicants must show that discrimination or bias, including bias based on race, ethnicity, sex or disability, materially harmed them. The rule took effect September 10, 2026, applies to new and pending applicants rather than current participants, and covers only individually owned firms. Firms owned by tribes, Alaska Native Corporations, Native Hawaiian Organizations and Community Development Corporations are not affected.

For many small firms, the practical response is diversification: not relying on a single set-aside program, pursuing other certifications where they qualify, competing in full-and-open or small business set-aside work, and building subcontracting relationships with primes.

Funding uncertainty is the new normal

Federal budgeting has added its own volatility. Fiscal year 2026 opened in fall 2025 with the longest government shutdown in U.S. history, at 43 days, and the funding that ended it was itself temporary. During a lapse, affected agencies stop issuing new contracts and modifications, invoices go unpaid until it ends, and contracting officers may issue stop-work orders. Deadlines for claims and bid protests are not automatically extended.

This fiscal year started more smoothly. Congress passed a continuing resolution, signed September 2, 2026, that funds the government through December 11, 2026, pushing final fiscal 2027 decisions past the November elections. That avoided an October shutdown but leaves another deadline weeks away.

Experienced contractors build this rhythm into their planning. They review their contracts for stop-work, funding and delay clauses, settle open items like deliverable approvals and invoices before a deadline hits, get any stop-work direction in writing, and document added costs so they can seek an equitable adjustment later. Many also keep a cash cushion and a mix of public and private clients so a pause in one agency does not stall the whole business.

Finding work and building credibility still comes first

With so much in flux, the fundamentals matter more, not less. The SBA's own guidance lays out the core tools: SAM.gov, where agencies must post contracts over $25,000; the Small Business Search (formerly the Dynamic Small Business Search), which agencies use to find small contractors and which is populated from your SAM profile; the Federal Procurement Data System and USASpending.gov for researching who buys what; agency procurement forecasts; and each agency's small business office. The SBA also points to SubNet for subcontracting opportunities with large primes.

Buyers want proof that a firm has delivered before, so past performance carries real weight, and winning a first prime contract can take a long time. That is one reason many newer firms start as subcontractors to build a record. The SBA also encourages marketing directly to agencies and primes by learning what they need and showing how your business can fill it.

Credibility also gets checked informally. When a contracting officer or prime contractor does market research, they look at your SAM profile, your capability statement and your website. Those three should tell the same story: clear NAICS codes and core competencies, relevant past performance, certifications, and an easy way to reach a real person. An outdated or vague web presence can quietly take a firm out of the running before a solicitation is ever posted.

A short checklist for the months ahead

Keep your SAM registration and Small Business Search profile complete and current.
Read every new solicitation for rewritten FAR language rather than relying on templates.
Maintain NIST SP 800-171 compliance and your posted assessment score while CMMC is reviewed.
Track your funding exposure ahead of the December 11 deadline.
Refresh your capability statement and website so they match what agencies will find elsewhere.

Where we fit

Yotta Design builds websites and apps for small government contractors, with a focus on presenting capabilities, past performance and certifications clearly to the agencies and primes doing their homework. If your online presence no longer reflects the firm you have become, you can see how we work on our government contractors page.

Sources

Ready to put this into action?

Schedule a Consultation