Mission-Critical Coverage. Strategic Discipline.

× FAR Compliance

The 45% Rejection Rate No One Talks About

Here is a number the insurance industry doesn't advertise: 45-55% of all certificate of insurance submissions to federal contracting officers are rejected on the first pass. For first-time government contractors, that number climbs to 75%.

Think about what that means. You've won the contract. You've mobilized your team. You've committed resources, signed subcontractors, and started planning the work. And then everything stalls — because your insurance certificate doesn't meet the contracting officer's requirements.

The cost isn't just the rework. It's delayed contract execution. Stalled revenue. A reputation with your CO that starts in the wrong place. And in some cases, it's the difference between keeping a contract and losing it before the work even begins.

The failures are almost always the same. Missing waiver of subrogation endorsements. Incorrect additional insured language — naming the wrong entity or using the wrong form. Inadequate cancellation notice provisions that don't meet the 30-day requirement. Missing primary and noncontributory endorsements. Policy limits that fall below the contract minimums specified in FAR 52.228-5.

These aren't exotic requirements. They're standard FAR clauses that have been in place for decades. And yet brokers continue to submit non-compliant certificates because they treat government contractor insurance like commercial insurance with a few extra boxes to check.

It isn't harder to get this right. It's just intentional. It requires a broker who reads the contract before placing the coverage. Who understands the difference between FAR 52.228-3 and FAR 52.228-5. Who knows that a waiver of subrogation on workers' compensation requires a specific endorsement — not just an additional insured notation. Who structures the certificate before submission, not after the rejection.

At PFTN, we don't submit certificates that get rejected. Not because we have some secret knowledge — but because we do the work upfront that most brokers skip. We read the contract. We match every insurance requirement to a specific policy provision. We verify endorsements before binding. And we build the certificate around the CO's requirements, not around what's convenient for the carrier.

The 45% rejection rate isn't a market condition. It's a choice. And it's one your firm doesn't have to make.

× Nuclear Liability

What Price-Anderson Doesn't Cover

If you're a contractor at a DOE facility, you've probably heard the phrase "Price-Anderson covers that" more times than you can count. It's become a kind of magic incantation in the nuclear contractor world — a belief that the federal government's indemnification program eliminates the need to think seriously about insurance.

It doesn't. And the gap between what Price-Anderson actually covers and what contractors assume it covers is where firms get hurt.

The Price-Anderson Nuclear Industries Indemnity Act was enacted in 1957 to ensure that the public would be compensated in the event of a nuclear incident at a DOE facility. It provides federal indemnification currently capped at $16.6 billion per incident. That's an enormous number, and it covers an enormous scope — personal injury, property damage, evacuation costs, claims investigation, and settlement expenses arising from a nuclear event.

But here's what it doesn't cover: everything else.

Professional liability claims — when your engineering deliverable contains an error that causes project delays or rework — that's not a nuclear incident. Price-Anderson doesn't apply. Cyber breaches — when a threat actor compromises your systems and exfiltrates Controlled Unclassified Information — that's not a nuclear incident either. Pollution events that don't involve radioactive materials? Not covered. Workplace injuries from non-nuclear hazards? Your workers' compensation policy handles those, not Price-Anderson.

The distinction matters because DOE contractors face a uniquely complex risk environment. You're operating at facilities with radiological hazards, environmental contamination, classified information, sophisticated cyber threats, and high-consequence professional obligations — all at the same time. Price-Anderson addresses one dimension of that exposure. Your commercial insurance program needs to address everything else.

And yet most brokers treat DOE contractors like any other commercial account. They confirm that Price-Anderson indemnification exists, check the box, and move on to shopping your GL and workers' comp on price. They don't ask about your professional liability exposure on technical deliverables. They don't examine whether your pollution coverage extends to non-radiological contamination at legacy sites. They don't structure cyber programs around DFARS requirements and CUI handling obligations.

The result is a coverage program with a $16.6 billion nuclear indemnification sitting on top of a foundation full of gaps. It's like putting a titanium roof on a house with no walls.

At PFTN, we understand where Price-Anderson ends and your commercial exposure begins. We map every non-nuclear risk in your operation — professional liability, cyber, pollution, auto, workers' comp, umbrella — and build a program that actually protects the contractor, not just the public.

Because the $16.6 billion doesn't help you when the claim isn't nuclear.

× Cyber Risk

CMMC Compliance Is Not Cyber Insurance

There is a dangerous conflation happening in the government contracting world right now: the belief that achieving CMMC certification eliminates the need for cyber liability insurance. It's wrong, and it's expensive to learn that the hard way.

CMMC — the Cybersecurity Maturity Model Certification — is a set of technical security controls. It tells you what safeguards to put in place: multi-factor authentication, encryption, access controls, incident response procedures, audit logging. These are important. They reduce your likelihood of a breach. They are, in many cases, contractually required.

But they are not insurance. They don't pay for anything when something goes wrong.

When a breach occurs — and breaches occur to compliant organizations regularly — the costs cascade fast. Forensic investigation to determine the scope and origin. Legal counsel specializing in government data breach notification requirements. Notification to affected individuals and agencies. Credit monitoring services. Regulatory defense when the contracting officer asks why Controlled Unclassified Information ended up where it shouldn't be. Business interruption while your systems are offline and your contracts are suspended pending investigation.

CMMC doesn't cover any of that. Cyber liability insurance does.

Think of it this way: CMMC is the lock on the door. Cyber insurance is the policy that pays to rebuild the house after someone picks the lock. Both matter. Neither replaces the other.

The problem is compounded by the fact that most insurance brokers don't understand CMMC well enough to explain the distinction. They see "cybersecurity requirement" in the contract and assume the client's IT team has it handled. They don't ask what level of CMMC certification is required. They don't examine whether the cyber policy's coverage triggers align with the types of incidents most likely to affect a government contractor handling CUI. They don't verify that the policy covers regulatory defense costs specific to federal data breach obligations.

And so the contractor ends up with two things that don't talk to each other: a CMMC certification that reduces risk, and a generic cyber policy that wasn't designed for government data exposure.

At PFTN, we build cyber programs specifically for government contractors. We understand the difference between CMMC Level 1 and Level 2 requirements. We know which policy forms cover federal regulatory defense and which don't. We structure coverage triggers around the actual threat landscape that DOE, DoD, and intelligence community contractors face — not a generic small business cyber template.

Compliance is the floor. Insurance is the safety net. You need both, and you need them built to work together.

× The Commodity Trap

Good Enough

The insurance industry has become a race to the bottom. Cheaper quotes. Faster binding. Less thinking. The brokers who win are the ones who process the most volume with the least friction. And the clients? They get what the system is optimized to produce: good enough.

Good enough coverage. Good enough service. Good enough until it isn't — until a claim lands and the gaps reveal themselves, and everyone discovers that "good enough" was actually "not nearly enough."

This is the commodity trap, and it affects government contractors more acutely than almost any other segment. Federal contracts carry insurance requirements that are more complex, more specific, and more consequential than standard commercial obligations. FAR clauses. DFAR supplements. Facility-specific endorsements. Agency-specific limits. The margin for error is razor thin, and the cost of getting it wrong isn't just a denied claim — it's a terminated contract.

And yet the industry treats government contractor insurance the same way it treats everything else: shop it on price, bind it fast, and move on to the next account.

When the work is reduced to transactions, something gets lost. The meaning. The care. The recognition that behind every policy is a business with employees and families and missions that depend on getting this right.

When you build an agency that treats advisory work as craft — that sees every risk assessment as a chance to protect something worth protecting — you attract people who want to do meaningful work. Not just process transactions. Not just check boxes. But actually think about whether the coverage matches the exposure, whether the endorsements match the contract, whether the program serves the client or just satisfies the minimum.

And the light gets brighter.

PFTN was built on the conviction that "good enough" is the enemy of "actually protected." We don't process government contractor insurance. We engineer it. And we believe the difference between those two words is the difference between a firm that survives a claim and one that doesn't.

× Environmental Risk

The Pollution Exclusion That Killed a Contractor

Every standard Commercial General Liability policy in the United States contains an absolute pollution exclusion. Every single one. It's been standard since 1986, and it means exactly what it says: if a claim arises from the discharge, dispersal, seepage, migration, or release of pollutants, your CGL policy does not respond.

For most businesses, this exclusion is an academic concern. For government contractors performing work at federal sites — especially DOE environmental cleanup facilities, legacy contamination sites, and installations with decades of industrial history — it is an existential threat.

Consider the work. Environmental remediation contractors handle hazardous materials daily. They excavate contaminated soil. They manage asbestos abatement. They transport and dispose of regulated waste. They work in and around structures with known environmental contamination stretching back to the Manhattan Project. Every day on the job is a day spent handling materials that trigger the pollution exclusion.

Now consider what happens when something goes wrong. A containment failure during soil remediation releases contaminants into a neighboring water supply. A worker is exposed to hazardous dust that wasn't properly controlled. A transport vehicle is involved in an accident that releases regulated materials onto a public roadway.

The contractor calls their broker. The broker calls the carrier. The carrier points to the pollution exclusion. Claim denied.

The defense costs alone can reach seven figures. The liability — bodily injury, property damage, cleanup expenses, regulatory fines — can reach eight. And the contractor, who believed their CGL policy would protect them, discovers that the most fundamental risk in their operation was never covered at all.

This is not a hypothetical. This happens. It happens because brokers don't understand the work their clients perform, and they don't examine whether the coverage matches the exposure. They see "general liability" on the FAR requirement list, they place a standard CGL policy, and they move on.

Contractors Pollution Liability — CPL — exists specifically to fill this gap. It covers third-party bodily injury and property damage from pollution events. It covers defense costs. It covers cleanup expenses. It can be structured to cover both sudden and gradual pollution events, and it can be combined with professional liability to create comprehensive environmental coverage for firms performing technical services at contaminated sites.

If your firm performs any work at DOE environmental cleanup sites, legacy contamination facilities, or installations with known environmental history, CPL isn't optional coverage. It's the only thing standing between your firm and an uninsured claim that can end your business.

The pollution exclusion in your CGL policy isn't a technicality. It's a wall. And most brokers never tell you it's there.

× Risk as Culture

When Insurance Becomes a Discipline

A captive insurance company puts the insured in the driver's seat. That's the standard elevator pitch, and it's true as far as it goes. But it doesn't go far enough — because the real transformation isn't financial. It's cultural.

When your company funds its own first layer of risk, every person in the building has skin in the game. The safety manager isn't filling out forms for the carrier's benefit — they're protecting the company's own capital. The project manager isn't managing risk because the contract requires it — they're managing risk because every claim comes directly out of the captive that their company owns.

That shift in mindset changes everything. It changes how people think about jobsite safety. It changes how they review contracts. It changes how they manage subcontractors and how they respond to incidents. The risk isn't abstract anymore. It's personal.

For government contractors, this matters more than most. The federal contracting environment is built on compliance — layers of regulations, oversight mechanisms, and reporting requirements designed to ensure minimum standards are met. But compliance is a floor, not a ceiling. The contractors who thrive don't just meet the minimum. They build a culture where risk management is a discipline, not a checklist.

A captive structure reinforces that discipline. When your experience modification rate directly affects your captive's profitability — and that profitability flows back to your firm — the incentive to prevent losses becomes visceral. When your claims history determines your captive dividends rather than your carrier's quarterly earnings, the feedback loop tightens. You see the results of your risk management in your own financial statements, not in a carrier's annual report.

PFTN was the first firm in the Tennessee marketplace to introduce captive insurance solutions. We've designed and implemented every structure — group captives, cell captives, single-parent programs — for organizations across the spectrum, including firms operating in the federal contracting space.

The real case for a captive isn't the premium savings or the investment income or the underwriting profit. It's the culture it creates. When your company owns its risk, your people own it too. And that ownership is what separates contractors who manage risk from contractors who merely insure against it.

× Nuclear Liability

The Three Layers of Nuclear Liability No One Explains

Every DOE contractor has heard the number: $16.6 billion. That's the current per-incident liability cap under the Price-Anderson Nuclear Industries Indemnity Act, most recently reauthorized through 2065. It's a staggering figure — designed to reassure the public that nuclear incidents will be compensated and to give contractors the confidence to perform work that no private insurer would fully underwrite.

But $16.6 billion is not a single pool of money sitting in a vault. It's a three-layer system, and the mechanics of how those layers work — who pays, when, and under what conditions — matter enormously to the contractor caught in the middle of a claim.

Layer One: Primary Insurance

For commercial nuclear power plants licensed by the NRC, the first layer is a mandatory primary insurance policy of $450 million, purchased from American Nuclear Insurers (ANI). This is real, private-market insurance with premiums, policy terms, and claims procedures.

For DOE contractors, this layer works differently. DOE contractors typically don't purchase private nuclear liability insurance at all. Instead, the DOE itself provides indemnification through the contract — essentially stepping into the role that ANI plays for commercial operators. The DOE indemnification agreement covers the contractor's full liability for nuclear incidents arising from contractual activities. There is no premium. There is no deductible. The government absorbs the cost.

This is the layer most contractors understand, and it's the one that creates the false sense of total protection.

Layer Two: Retrospective Premiums

For commercial operators, if a nuclear incident exhausts the $450 million primary layer, the second layer kicks in: retrospective premium assessments levied against every licensed nuclear power reactor in the United States. Each reactor operator can be assessed up to approximately $121 million per reactor per incident, with annual installments capped at $19 million per reactor. With 93 licensed reactors, this pool generates roughly $11.25 billion in additional capacity.

DOE contractors are not part of this retrospective assessment pool. Their incidents are funded through government appropriation, not through industry mutual assessment. But the mechanics matter because they reveal an important truth: the system was designed with the understanding that nuclear incidents can overwhelm any single insurance source. The pooling mechanism exists precisely because the risk is too large for individual entities to bear.

Layer Three: The Federal Backstop

If the combined primary insurance and retrospective premium pool are insufficient — which would require damages exceeding approximately $16.6 billion from a single incident — the statute requires the President to submit a plan to Congress for additional compensation. This is not automatic. It requires legislative action. Congress must appropriate the funds.

For DOE contractors, the federal backstop is more direct. The DOE's indemnification agreement covers the contractor up to the full statutory cap. Beyond that, the same Congressional action requirement applies. But the critical point is this: between the DOE indemnification agreement and the statutory cap, the contractor is fully protected for nuclear incident liability.

Where Contractors Get Confused

The confusion isn't about whether Price-Anderson provides protection. It does — and it's extraordinarily broad. The omnibus coverage provision extends indemnification to the prime contractor, all subcontractors at any tier, suppliers, transporters, and essentially any person who may be legally liable for a nuclear incident arising from DOE contractual activities. A 2025 Federal Circuit ruling in Cotter Corp. v. United States confirmed this expansive interpretation, holding that even downstream purchasers of radioactive material can qualify for indemnification.

The confusion is about boundaries. Specifically:

Workers' compensation is expressly excluded. If your employee suffers an occupational injury — even from radiation exposure — their workers' compensation claim is not indemnified by Price-Anderson. That's your workers' comp policy. Period. The statute explicitly carved out state and federal workers' compensation acts from the definition of "public liability."

On-site property damage is excluded. If a nuclear release damages the facility itself — your equipment, your temporary structures, your materials — Price-Anderson does not cover that loss. You need property insurance, and that property policy almost certainly contains a nuclear hazard exclusion. This creates a gap that requires careful structuring.

Non-nuclear incidents are not covered. A fall from scaffolding. A vehicle accident on the access road. An electrical fire in the maintenance building that has nothing to do with radioactive materials. These are standard operational risks that require standard commercial insurance. Price-Anderson doesn't touch them.

The Combined Claim Problem

Here's where it gets genuinely complicated. Consider a scenario where a radioactive release at a DOE facility causes direct radiation exposure (Price-Anderson), triggers an evacuation that results in a vehicle accident (general liability), causes thyroid damage in employees (workers' compensation), and contaminates adjacent commercial property (potentially both Price-Anderson and property/pollution).

That single event generates claims that split across multiple coverage paths. The radiation exposure flows to Price-Anderson indemnification. The vehicle accident flows to your commercial general liability policy. The employee thyroid damage flows to workers' compensation. The off-site property contamination requires analysis — if it's radiological, Price-Anderson may apply for third-party claims; if it's mixed contamination, you may need both Price-Anderson and your pollution liability policy.

And here's the coverage trap: your standard CGL policy contains a nuclear hazard exclusion. Your pollution policy excludes radioactive materials. If a claim has concurrent nuclear and non-nuclear causation, which policy responds? Without explicit coordination language — "this coverage is in addition to and not in lieu of indemnification under the Price-Anderson Act" — your commercial carrier may deny the claim on the theory that Price-Anderson is the proper coverage path. And DOE may decline indemnification on the theory that the non-nuclear component is not a nuclear incident.

The contractor falls into the gap between two systems that each assumes the other is covering the loss.

What This Means for Your Insurance Program

Price-Anderson is not your insurance program. It's one component of your risk management architecture — an extraordinary one, but a limited one. Your commercial insurance stack needs to be built around the specific exclusions and boundaries of Price-Anderson, not as a redundant layer on top of it.

That means workers' compensation structured for radiological workplace exposure. General liability with endorsements that coordinate with — not conflict with — DOE indemnification. Professional liability with tail coverage adequate for the decades-long latency of nuclear-related claims. Pollution coverage that explicitly addresses the boundary between radioactive and non-radioactive contamination at legacy sites.

At PFTN, we build insurance programs that start where Price-Anderson ends. We map every non-nuclear exposure, structure every endorsement for federal contract compliance, and coordinate every policy with the indemnification framework your DOE contract provides. Because the $16.6 billion protects the public. Your commercial program is what protects the contractor.

× FAR Compliance

FAR 52.228: The Insurance Clauses Your Broker Should Know by Heart

The Federal Acquisition Regulation is not light reading. It's 53 parts, thousands of clauses, and an endless maze of cross-references. But buried in Part 28 — "Bonds and Insurance" — and Part 52.228 is a set of clauses that directly govern what insurance a government contractor must carry, how it must be structured, and what happens when it isn't.

If your broker can't walk you through these clauses without looking them up, they're not a government contractor specialist. They're a generalist guessing at federal requirements. And guessing is how certificates get rejected, contracts get delayed, and compliance becomes a recurring crisis instead of a baseline condition.

Here are the clauses that matter most — and what each one actually requires.

FAR 52.228-3: Workers' Compensation Insurance (Defense Base Act)

This clause requires contractors performing work outside the United States to carry workers' compensation insurance under the Defense Base Act (DBA). The DBA extends the Longshore and Harbor Workers' Compensation Act to cover employees working on military bases, public works contracts, and federally funded projects overseas.

The critical detail: DBA coverage is not standard workers' compensation. It's a federal program with its own benefit structure, reporting requirements (Form LS-202 within 10 days of injury), and dispute resolution through the Department of Labor's Office of Workers' Compensation Programs. Many domestic workers' comp carriers either don't offer DBA coverage or offer it as a poorly understood endorsement. If your contractor performs any work at overseas installations — including temporary assignments — this clause applies, and your policy must specifically provide DBA coverage.

FAR 52.228-5: Insurance — Work on a Government Installation

This is the foundational insurance clause for contractors performing work on government property. It establishes minimum coverage requirements that the contracting officer can adjust upward based on the nature of the work.

The baseline minimums under FAR 52.228-5:

Workers' compensation: As required by applicable federal and state workers' compensation and occupational disease statutes. For work subject to the Longshore and Harbor Workers' Compensation Act, coverage must meet that Act's requirements.

Employer's liability: $100,000 minimum, unless the state of performance has a higher requirement.

Bodily injury liability: $500,000 per occurrence.

Property damage liability: $500,000 per occurrence — covering both contractor operations and completed operations.

Automobile liability: $200,000 per person / $500,000 per occurrence for bodily injury, $20,000 per occurrence for property damage.

These are minimums. Contracting officers routinely require higher limits — $1 million or $2 million per occurrence for GL, $1 million combined single limit for auto — and the solicitation or contract will specify any increased requirements. The mistake brokers make is treating these as the actual requirements rather than the floor.

FAR 52.228-7: Insurance — Liability to Third Persons

This clause applies primarily to cost-reimbursement contracts and requires the contractor to maintain insurance coverage for liabilities to third persons arising out of contract performance. It's broader than 52.228-5 in scope because it addresses the reimbursability of insurance costs under cost-type contracts.

The clause requires: general liability insurance, automobile liability, and aircraft public and passenger liability (where applicable). But the real significance is in the cost allowability provisions. Under cost-reimbursement contracts, insurance premiums that comply with FAR 31.205-19 are allowable costs — meaning the government reimburses the contractor for insurance that meets these requirements. This creates both an obligation and an opportunity: the contractor must carry adequate coverage, but the cost of that coverage is a reimbursable contract expense.

The catch is FAR 31.205-19's limitations. Self-insurance is allowable only if it's more economical than purchased coverage. Insurance against defects in the contractor's own work is not allowable. And rates must be "reasonable" — which gives the contracting officer latitude to challenge premiums that appear inflated.

FAR 52.228-8: Liability and Insurance — Leased Motor Vehicles

A narrow but frequently triggered clause. When contractors lease motor vehicles for use in government contract performance, this clause requires specific insurance provisions: the contractor must maintain adequate liability insurance, include a waiver of subrogation against the government, provide 30-day cancellation notice, and accept liability for negligence-caused damage to the leased vehicle.

The detail that trips up most brokers: the waiver of subrogation must specifically name the United States Government. A generic waiver of subrogation endorsement naming the "certificate holder" is often insufficient. The endorsement must be explicit.

The Endorsement Requirements That Kill Certificates

Beyond the specific FAR clauses, government contracts typically require a set of policy endorsements that most commercial insurance programs don't include by default. These endorsements are where the 45% certificate rejection rate originates.

Additional Insured — United States of America. The government must be named as an additional insured on the contractor's general liability and auto liability policies. This isn't a simple certificate notation — it requires an actual policy endorsement (CG 20 10, CG 20 37, or equivalent). Many carriers use restrictive additional insured forms that limit coverage to "ongoing operations" but exclude "completed operations." For government contracts, both must be covered.

Waiver of Subrogation. The contractor's insurer must waive its right to subrogate against the government and any other additional insureds. This requires endorsements on CGL (CG 24 04), workers' compensation (WC 00 03 13), and auto liability. Without waiver of subrogation on workers' compensation — which is a separate endorsement from the additional insured — the carrier retains the right to pursue the government for recovery of claim payments. Contracting officers know this and will reject certificates that don't include it.

Primary and Non-contributory. The contractor's coverage must be primary to — and not seek contribution from — any insurance the government may maintain. This endorsement (CG 20 01 or policy language) ensures the contractor's insurance responds first. Without it, the contractor's carrier may argue that the government's own liability coverage should share in the loss, creating a dispute that delays claims resolution.

Cancellation Notice. A minimum 30 days' written notice to the contracting officer before any cancellation or material change in coverage. Standard ACORD certificates now include only a "best efforts" cancellation notice — which is legally meaningless. The endorsement must be added to the policy itself, not just noted on the certificate.

DFARS Supplements: Defense Contractors Face Additional Requirements

Contractors working under Department of Defense contracts face additional requirements under the Defense Federal Acquisition Regulation Supplement (DFARS). DFARS 252.228 series clauses add requirements for aircraft liability insurance, war-hazard protection, and nuclear incident indemnification specific to DoD operations.

For contractors at DOE facilities performing defense-related work — which includes most Oak Ridge operations — both FAR and DFARS requirements may apply simultaneously. The insurance program must satisfy both sets of requirements, and the certificate must demonstrate compliance with each applicable clause.

Cost Allowability: FAR 31.205-19

For cost-reimbursement contractors, insurance costs are allowable under FAR 31.205-19 if the coverage is required by the contract, required by law, or necessary for the contractor's operations. Premiums must be at rates not exceeding those generally available to the contractor. Self-insurance programs are allowable but must be approved by the contracting officer and must be more economical than purchased insurance.

The practical implication: DOE contractors on cost-plus contracts should carry the right insurance — not the cheapest insurance. The cost is reimbursable, and the protection is real. Cutting corners on insurance to reduce reimbursable costs is a false economy that saves the government pennies and exposes the contractor to dollars in uninsured liability.

The PFTN Approach

At PFTN, we don't submit certificates and hope they pass. We read the contract first — every FAR clause, every DFARS supplement, every special provision in the solicitation. We match each insurance requirement to a specific policy endorsement. We verify endorsement language before binding. And we build the certificate as a compliance document, not an afterthought.

The FAR insurance clauses aren't complicated. They're specific. And specificity is something most brokers avoid because it requires actually understanding the regulatory framework. We don't avoid it. We live in it.

× Government Contractor Risk

CMMC Flow-Down Is Now a Prime Contractor Liability Problem

The CMMC enforcement conversation has spent the last three years inside the subcontractor community. Small and mid-sized defense suppliers, trying to figure out the cost, the timeline, the gap, and the path to Level 2 certification. That conversation was always going to bend.

November 10, 2026, is when it bends.

That is the start of CMMC Phase 2. Mandatory C3PAO-assessed Level 2 certification on all new defense contracts involving Controlled Unclassified Information. Organizations not certified when a Phase 2 solicitation appears cannot compete for the award. Boeing, Lockheed Martin, RTX, and several other large primes are no longer waiting for the formal deadline — they are already conditioning new subcontract awards on Level 2 readiness and walking away from suppliers who cannot show a credible certification path.

That is a procurement story. It is also a prime contractor liability story, and the second story is the one most prime contractors have not absorbed yet.

The False Claims Act exposure runs in two directions. A prime contractor that passes CUI to a subcontractor it knows or should know is not CMMC-compliant — and continues collecting government payments on a contract that requires supply-chain compliance — has potential FCA exposure on the prime's own invoices. Not the sub's. The prime's. The DOJ's cyber-related FCA recoveries hit $52 million in FY 2025 and have tripled in each of the last two years.

The flow-down requirement is not symmetric. Subcontractors must comply with CMMC requirements in the same way as the prime, with the exception of sharing CMMC Unique Identifier data with the contracting officer. That asymmetry creates an operational responsibility for the prime that the prime cannot delegate. The prime determines the appropriate CMMC level for each subcontractor. The prime documents the determination. The prime monitors the certification status. The prime accepts the contractual and statutory consequence if the subcontractor fails to maintain that status during performance.

The supplier base is largely uncertified. Roughly 76,598 contractors and subcontractors need CMMC Level 2 certification under the rule. As of early 2026, only about 1,042 had completed Level 2. That is 1.4 percent of the affected population, against a Phase 2 deadline six months away. The math does not work. Primes are already absorbing the implication.

The insurance program is not built for this. Standard cyber liability policies typically do not respond to FCA matters — they are written for first-party breach, third-party privacy liability, business interruption, and ransomware extortion, not for affirmative misrepresentation claims under the FCA. Most D&O forms exclude FCA matters or carve them out behind significant retentions. Professional liability for government contractors varies wildly by carrier on FCA response. The contractor that walks into a 2026 renewal with the same submission file as 2024 is paying for a coverage gap on every line.

The cyber underwriter is now asking the prime two new questions. What is your supply-chain CMMC verification process. What is your written policy on CUI flow-down to subcontractors that have not completed Level 2 certification. The submission that does not have written answers gets either a coverage gap or a premium increase. Sometimes both.

The CMMC rule was always going to push compliance cost down into the supply chain. What the rule also pushed — and what most primes have not yet internalized — is the compliance verification responsibility back up into the prime. The prime is now the certification cop, the documentation custodian, and the FCA defendant of first instance. The supplier is the certification candidate. The two roles have very different risk profiles, and they need very different insurance conversations.

PFTN's 4-Step Strategic Process for federal contractors starts with Strategic Discovery: contract portfolio, agency mix, prime versus subcontractor role distribution, supply-chain depth, CUI scope, CMMC level required by active contract, SPRS attestation history, and the documented flow-down protocol. Risk Assessment quantifies cyber form FCA exclusion language, D&O form FCA exclusion language, professional liability response on attestation accuracy, and the gap between the firm's CMMC documentation and the renewal application narrative. Solution Design pairs the certifications with the policy forms so the actual claim type the DOJ is bringing has somewhere to land.

The CMMC rule was sold to primes as a supplier problem. November 10 is when it becomes a prime problem.

The mission starts months before the deadline — and never on autopilot.

× Cyber / Compliance

The Software Bill of Materials Mandate Is Here — Just Not the One Everyone Expected

The Software Bill of Materials story that most federal contractors prepared for in 2025 is not the story that landed in 2026. The Office of Management and Budget rescinded the uniform secure-software attestation requirement on January 23, 2026 — replacing the one-size-fits-all CISA Common Form with a risk-based approach in which each federal agency develops its own SBOM and software-attestation requirements.

The headline read the rescission as a deregulatory move. The contracting reality is the opposite. The SBOM mandate is now distributed across every awarding agency rather than centralized at OMB — which means the contractor's SBOM and attestation obligation depends on which agency, which contract vehicle, and which scope of work the contractor is executing.

OMB Memorandum M-26-05 replaced the Biden-administration Memorandum M-22-18. The CISA Common Form attestation that federal agencies had been required to obtain from software producers is no longer mandatory. Agencies may still use the Common Form. Agencies may also develop their own risk-based approach. Agencies may still require an SBOM.

A contractor running on DoD task orders is going to see one SBOM expectation. A contractor running on civilian agency vehicles is going to see another. A contractor delivering software for cleared-environment use is going to see a third — driven by NIST SP 800-218 and the Secure Software Development Framework references that the cleared community has not relaxed.

DOJ's Civil Cyber-Fraud Initiative remains active. Settlements under cybersecurity-related FCA cases continue to land. The OMB rescission does not insulate a contractor from FCA exposure. If a contract requires an SBOM or a secure-software attestation, and the contractor delivers one without the actual underlying secure-development practices in place, the FCA exposure is the same as it was under the prior Common Form posture.

CMMC Phase 2 enforcement still begins November 10, 2026. Contractors delivering software in support of DoD requirements still have to satisfy the CMMC Level 2 control inventory. The OMB rescission does not relieve the CMMC posture.

The contractor's cyber insurance underwriter used to be able to ask one question — "Are you compliant with the CISA Common Form attestation requirement?" — and use the answer to score the SBOM exposure. The 2026 underwriting question is more granular — which agencies, which contract vehicles, which task orders, which software components, which attestation requirements does your portfolio carry?

PFTN's govcon approach treats the SBOM file the way the contracting officer treats it. Strategic Discovery starts with the contract vehicle inventory, the agency mix, the software-development practices, and the supplier flow-down posture. Risk Assessment quantifies the agency-by-agency requirement set and the FCA exposure inside cybersecurity representations the contractor has already made. Solution Design pairs the cyber tower with practice management liability and the surety program.

The SBOM mandate is here. It just is not the one everyone expected. The shift starts with one conversation — and preferably before the next contract modification lands.

— Ryan Mefford, President & Risk Advisor

× DCAA Compliance

The DCAA Timekeeping Audit That Started Last Quarter

The DCAA labor floor check is the most discreet audit in federal contracting. The auditor walks the office at an undisclosed time, asks four or five employees what they are working on right now, what charge code they are billing to, and how they entered yesterday's time. The audit lasts twenty minutes. The findings shape the indirect rates the contractor will negotiate for the next three years.

Q1 2026 was a heavy floor-check quarter. DCAA's audit guidance for 2026 explicitly elevates labor floor checks, total time accounting verification, and audit-trail completeness on the contractor's timekeeping system. The contractors who walked into Q1 with a documented labor charging policy and an enforceable approval workflow are the contractors who passed without finding.

Total Time Accounting requires that every hour an employee works gets recorded — direct and indirect, billable and overhead, training and PTO and uncompensated overtime. Labor cost cannot be allocated correctly to a federal contract if the contractor does not capture every hour the employee actually worked. Labor mischarging is the FCA exposure the agency is most actively pursuing.

Daily time entry is the audit anchor. A timesheet submitted weekly, biweekly, or at the end of the pay period fails the DCAA daily-entry standard — because the auditor cannot test whether the employee actually entered time on the day the work was performed. The 2026 floor check explicitly asks the employee when they entered yesterday's time and whether they remember the charge code without checking notes.

DCAA expects the timekeeping system to preserve a complete record — who entered each time entry, when, what was changed, who approved the change, and what supporting documentation accompanied the correction. A contractor with a hand-edited spreadsheet timekeeping system in 2026 is a contractor the auditor is going to score as a control deficiency.

The auditor's twenty-minute walk of the office is not actually about catching a fraudulent timecard. It is about testing whether the supervisor review the contractor's policy claims to perform — actually happens. The supervisor who cannot describe what the employee is working on this week is a supervisor whose review the auditor reads as ceremonial.

Timekeeping records must be retained for at least three years after the final contract payment. The contractor whose record retention is tied to a timekeeping platform's data export schedule — and not to the contract closeout calendar — is going to discover the gap during a post-award DCMA audit, not during a floor check.

PFTN's govcon approach treats the DCAA file the way the auditor treats it. Strategic Discovery starts with the timekeeping system, the charge code library, the labor cost allocation model, and the indirect rate posture. Risk Assessment quantifies the FCA exposure inside the labor charging history. Solution Design pairs the practice management liability and the surety program with the labor compliance posture — because a floor-check finding is also an insurance event.

The DCAA auditor who walked the office in Q1 already wrote the finding. The shift starts with one conversation — and preferably before the next floor check.

— Ryan Mefford, President & Risk Advisor