“Ding ding.” – Apollo Creed,
Rocky III
September 30. All (most?) federal years end the same way, at least on paper—like a prizefight, with the clock ticking down; an agitated, uncertain crowd; a lot of money on the table; and a ref capable of stopping the match at any moment. This year will be at once both no different and a completely different beast. With ever-recent uncertainty surrounding appropriations, continuing-resolution (CR) risk, evolving Federal Acquisition Regulation (FAR) language, the tightening screws of cyber attestations, industry supply-chain and acquisition changes, and grant closeouts that always take longer than you’d think, September is not a month for contractor improvisation. It’s a month when a dedicated corner team, a game plan, and crisp execution all are paramount.
To finish this year strong, defend margin, and start the first quarter (Q1) on the front foot, the time to get ready for the seven-round bout is now. Contractors don’t need perfection; what they do need are repeatable, auditable moves that can be run under pressure. Touch gloves. Let’s work.
Round 1: Funding uncertainty (CRs, shutdowns, sweeps)
What can happen between now and September 30? Three paths dominate: (1) on-time appropriations (rare late in the game), (2) a continuing resolution that restricts new starts and clamps funding, and (3) a shutdown that pauses some activities and snarls payments. As contractors recognize every year, there’s no control over any of that. But what federal contractors can control is their readiness.
How to prepare right now:
- Map funding to performance by contract line item number and task. Be mindful of ceilings, incremental funding levels, and burn rates. Perhaps make the extra effort of color-coding where funding runs out before the period of performance (POP) does.
- Prep for deobligation sweeps. Contractors know well that agencies clear unobligated balances late in the fiscal year. Be ready by having emails, mods, and estimates at completion ready to justify keeping funds on your lines, especially if dealing with cost-type contracts.
- Line up POP extensions. Now is the time to draft no-cost extension language and potential tweaks to your delivery schedules. Don’t get caught cold and have to write these from scratch on September 29.
- Undefinitized action hygiene. Have undefinitized contract action? Ensure the timelines are being tracked along with ceiling use and definitization packages; don’t get caught with unclaimed allowable costs because of rushed paperwork.
- Invoice cadence. Be prepared to jab by shortening billing cycles. If a CR or a shutdown hits, the invoice submitted is the only one that can get paid.
Round 2: The “new FAR” rollout—don’t wait for or expect clarity
We’ve written about the changes coming to FAR 2.0 (see here and here), and everyone recognizes that change never lands evenly. So expect some clauses to appear in new requests for proposals (RFPs) immediately, while others may surface in later months. Just know that teams that win aren’t the ones who predict every detail; they’re the ones who are capable of making the switch-up and instrumenting the right kind of change. For the time being, that means taking your current clause library and mapping it to the latest interim/final texts in your target portfolios (civilian versus the Department of Defense (DoD), products versus services, commercial versus noncommercial).
Chances are that any errors in addressing these changes will be in three areas: commercial item misfit, flowdown drift, and a mismatch in representations and certifications (reps and certs). When terms shift, confirm your use of commercial terms and conditions still fits, especially anything touching intellectual property, termination, or data rights. Prevent times of flowdown drift by updating supplier packs and reissuing them to active subs with a one-page redline summary. And for subcontractors, it might be beneficial to ask for the same up the chain to better prepare. Finally, to avoid a reps and certs mismatch, make sure to align system award management/offeror representations with current proposal language to sidestep any potential or perceived contradictions.
Round 3: CMMC—the last-mile readiness (maybe?)
Even if the contract’s target program office isn’t shouting about cybersecurity maturity model certification (CMMC), the direction of travel is clear: the government expects fewer promises and much, much more evidence of compliance. This means that contractors would be wise to treat September as evidence month. Here is what contractors can do to prepare:
- Begin by scoping decisively and understanding if the company is defending the entire enterprise or running a controlled unclassified information enclave with defined boundaries. Write it down. Your system security plan (SSP) should accurately describe exactly what’s inside the fence and how data moves in and out.
- If the company is still making inroads, be sure that your plan of action and milestones are at the ready and close them when you can. If there is a long way to go, pick a small number of high-value gaps and close them before proposals go in (e.g., multifactor authentication coverage, log retention, consistent backups with restoration testing).
- Create a single index with links to policies, procedures, screenshots, configs, ticket evidence, and test results. As a litmus test to assess if the company has these, try finding them in 60 seconds. If that’s not possible, they probably don’t exist.
- Now is a good time to refresh subcontractor cyber attestations and ensure the company has incorporated minimum requirements into subcontracts and purchase orders. A key point here is to validate critical suppliers’ posture without the need to collect their entire SSP. Simply ask for attestations to specific controls.
- Finally, and this should go without saying for defense contracts, ensure supplier performance risk system scores, SSP claims, and proposal cyber language agree with the technology and information systems you will actually deliver and use. If you mention “software bills of materials,” “vulnerability service level agreements,” or logging coverage—and you very well may be required to do so—be prepared to produce each of them.
Round 4: Supply chain sanity check (BABA/TAA/889/UFPLA & friends)
As has become increasingly apparent of late, supply chain compliance is where good intentions and nasty surprises collide. It’s a corner of the ring where a catalog part quietly swaps origin, a reseller’s attestation becomes stale, an embedded module trips a telecom prohibition, or an Internet of Things widget brings in a restricted component. This means that it’s time to pressure test your weakest links:
- Country-of-origin (COO) claims. For your top revenue SKUs, revalidate COO with documentation (manufacturer letters, bills of materials where available). Keep evidence at the line-item level.
- 889 attestations. Re-attest prime and sub tiers. Ask targeted “yes/no” questions about covered telecom equipment/services—don’t make it a narrative.
- Build America, Buy America/Trade Agreements Act (BABA/TAA) triage. Identify where your justification is an exception versus where you truly meet domestic/eligible country content. The rules here are changing quickly, and there isn’t a whole lot of uniformity through the federal government. Understand the differences through the sources of funding in your contracts and make sure to avoid attempts to bank on waivers and exceptions.
- Reseller onboarding. This is a dynamic area of compliance, so for reseller onboarding, require your standard clause pack and country-of-origin proof for each stock keeping unit (SKU), then make sure to contract for strict compliance during performance. This means if a SKU’s origin changes, the reseller must notify you immediately via a defined escalation path (i.e., whom to contact, response time, and steps like pausing sales and revalidating TAA/Buy American Act, sanctions, tariffs, labeling, and pricing). In this way, the company will want to treat every catalog addition or other edit as a compliance event and hold fast on any changes until COO, restricted-country flags, and required certifications are rechecked and approved.
FY 2026 is promising to be a year of significant compliance enforcement. This means it would be wise for contractors to embed verification into their operations. Begin the process of updating supplier scorecards to include attestation freshness and response time. This is not a time when you want to wait for audits, so flag lapses with automated reminders and make sure to document follow-through.
Round 5: Labor and pricing—protect margin with limited gamesmanship
Contractors all know that in the world of federal contracting, costs move faster than award decisions. And the last weeks of the FY are when you either defend your margins or watch them leak away.
Be ready to open the bout with labor compliance and keep your guard high by first confirming if/where current Service Contract Act/Davis-Bacon wage determinations are in contracts and—if they are—whether/if they are flowed down to subs. Perform timekeeping spot checks like disciplined and repeated jabs. Have the procedures in place for daily entry, supervisor review, and documented/approved corrections. Just like ringside judges, auditors love clean timecards. Finally, if expecting overtime or prevailing wages during a late-FY surge, preplan the labor mix and approvals so as not to be improvising while on the ropes. Be prepared to document why any surge was necessary.
The end of the year (EOY) is hard when addressing/planning for labor costs, so when price pressure starts swinging, use the counterpunches available in the contract. Check for the presence and availability of economic price adjustment (EPA) clauses and be ready to assemble the necessary evidence (i.e., market indexes, supplier letters, material quotes) now to better prepare for the tight narrative needed to justify an EOY EPA request. If there’s the chance that requests for equitable adjustment (REAs) may be needed, time could be the enemy, so make sure to track in real time the impacts—dates, drivers, costs, and causation—and tie them to the right contract clauses. Even a thin but timely REA scores better than a perfect one thrown after the bell.
Round 6: Protest readiness (Pre-Award and Post-Award)
As fiscal year-end approaches, contractors know that competitors will be exiting their respective corners swinging. As a result, all competitors need to position themselves in a calm fighting stance and prepare for potential protests. In this regard, the goal is simple—preserve options, move fast, and avoid the “wish we’d documented that” punch you never saw coming.
Before the bell (before the award), contractors will want to do their footwork. Be ready, as time is of the essence. Keep an ambiguity log as you read the RFP/RFQ, noting unclear requirements, conflicting clauses, or hidden evaluation factors, why they matter, and your proposed fix. Make sure you are able to craft tight questions and answers, and be ready to save the agency’s exact clarifications. Additionally, map OCI risks. Who’s on the team? Who touched pre-solicitation work? Have there been any firewalls or staffing shifts? Know these facts so that if the team changes to mitigate risk, the company can record the performance impact and how it was covered.
After the bell rings (after the award), be ready to dance like a well-coached corner. On Day 0, calendar the debrief as soon as the agency offers, keep a professional tone, and take good notes; your protest record starts here. Don’t go in unprepared. Ask vetted debrief questions that earn signals, not shrugs. Cover questions such as: What strengths/weaknesses differentiated the awardee under Factor X? What evidence supported cost/price realism? How did the agency weigh your specific discriminators in the trade-off memo? Avoid the shadowboxing of yes/no hypotheticals. Instead, focus on documents and rationale.
Finally, be smart in picking your venue. The Government Accountability Office is the fast path and offers the automatic stay; the Court of Federal Claims can make sense for discovery, complex statutory issues, or relief beyond the Competition in Contracting Act stay. Mind protest post-award timelines with trigger discipline, especially for DoD enhanced debriefings, where the filing window runs from the end of the debriefing. When in doubt, the best course of action would be to file early and perfect later using supplemental grounds. Depending on the facts, protest counsel should be able to prepare the protest using arguments with higher chances of success, such as unreasonable technical evaluations, flawed source selections that don’t engage qualitative differences, and unreasonable cost/price analyses where realism is detached from the actual approach.
After the fight: What to watch for next quarter
Make no mistake. The bell doesn’t end a contractor’s season; it just starts the next training camp. As contractors jog into Q1, they need to keep their eyes up and hands high. Be vigilant and track appropriations posture and any continuing resolution provisions that open or close doors for new starts. When addressing the new regulatory environment, only adjust for FAR updates that truly warrant template changes. Be careful and don’t commit to flailing edits that ripple unpredictably. On the cybersecurity side, watch for CMMC “go-live” and monitor enforcement signals in RFPs, especially evidence requirements and supplier flowdowns.
Ding ding. What now?
End-of-FY success isn’t new, and it isn’t a miracle. It’s the by-product of small, predictable habits—the mapping of funding to work, refreshing the clause library, proving cybersecurity with more than just adjectives, and keeping your supply chain claims current. Nothing in that list requires heroics; it requires intentionality and a broad team that understands its role.
The well-prepared contractor is on that and ready to tape their hands, settle on the stool, and listen for the bell. Those in the other corner—be it customers or competitors—have volatility, ambiguity, and time pressure. That means your corner has to have plans, checklists, and reps that have been drilled in all season long. When the round starts, not every punch may be thrown. Just throw the right ones, at the right time, with your feet set and your chin tucked. That’s how a fight is won. And that’s how to successfully finish this fiscal year.
[View source.]
