The debate over CUI is revealing a larger struggle over how government buys technology

Guest:	Emily Murphy
Title:	Senior fellow at the George Mason University Baroni Center for Government Contracting and former GSA Administrator
Summary:	The government says it wants greater access to commercial technology and innovation. But cybersecurity requirements, data protections and agency-specific policies can make the federal marketplace difficult to navigate.

The Federal Drive with Terry Gerton provides expert insights on current events in the federal community. Read more interviews to keep up with daily news and analysis that affect the federal workforce. Reach out to Terry and the Federal Drive producers with feedback and story ideas at FederalDrive@federalnewsnetwork.com.

Interview transcript

Terry Gerton I am going to try to really pick your brain today because I want you to take us from the trees of the technology landscape out to the forest view. There’s so much happening in this space. It’s easy to get fixated on each particular policy, but I think there’s a larger story here, so I’m really going to count on you to give us the roadmap here. Let’s start with this idea of buying commercial. We’ve got all kinds of different guidance from all kinds of different organizations. GSA’s got some, DoD’s got some, AI’s in the mix there. Let’s start with the first question. Does the government really want to buy technology the way the commercial world buys technology?

Emily Murphy Yes, to a point, and this is the problem, we always say we want the government to act more like a business, but at the end of the day, the government isn’t a business. The government has unique requirements that are going to be government-specific, and there’s always going to this tension between, we want to buy commercial solutions, we want be leveraging the innovation that takes place in the market, we want to be seizing on this breadth of opportunities that will bring down prices and give us new creative ways of solving our problems, but we also realize it’s the government. There are additional cyber requirements. There are trade policy matters, socioeconomic small business policy matters. There always are going to be things that the government looks at and says, okay, yeah, we have to do that differently. Even down to when commercial companies buy, they don’t run competitions that you can protest to a court if you don’t think they followed their own rules. They get to decide what’s in their best interest. The government has always said, no, we’re going to hold ourselves to a different standard. And we’re gonna tell you exactly how we’re to decide who wins. And if we don’t live up to that, you have the right to challenge us and a court can overturn that decision. So there’s always been that tension there and we’re seeing it play out right now because there’s such a push towards commercial, but there also are these new threats that are coming into play.

        Discover how federal agencies are applying AI to strengthen cybersecurity, improve operational efficiency and deliver measurable mission outcomes while balancing innovation, governance and human expertise.

Terry Gerton Well, let’s take a specific example, controlled unclassified information. We’ve got the DoD with its CMMC requirements, 10 years in the making, now on temporary hold. We’ve got the FAR council working on CUI requirements and agencies are pursuing their own approaches. So why is it so hard for the government to settle on one set of expectations here?

Emily Murphy That all ignores the fact that it’s actually a government standard, the NIST standards that we’re trying to implement with both the CUI, GSA, Part 40, and the CMMC. So there’s a standard that the government, through its standard-making body, has agreed upon, and then the question is, how do agencies implement it? And to a certain extent, it makes sense that the Department of War is saying, even within the government we’re not like the rest of the government. We have unique requirements because of our mission. We’re all fighting wars. We are a target in a different way. We have a different type of industrial base. But then they’re hitting that moment of we’ve got a different industrial base that we need to protect. And CMMC, as it was originally drafted and implemented and was scheduled to go into effect this fall, maybe what they were signaling is that they think it’s going to limit their access to that industrial base, not necessarily just in the cyber maturity space, but if they’re looking at really just the materials that they need and the parts, and how do they play that out. But then you’ve got GSA looking at this and saying, all right, we do a lot of work on behalf of the Department of War, so we need to make sure we’re at least meeting their standards. We also do work on behalf of the intelligence community, on behalf the Department of Homeland Security and all these other agencies. So we want to try and come up with a unifying standard that we think is going to meet all their needs. And we’re going to put that into our contracts so that when we’re doing work on behalf of others, we’re not having to go in and constantly customize. So I think that’s what they were trying to do with their version of the CUI policy, while also keeping in mind that they’ve got their own unique requirements around buildings and things along those lines. And then you’ve got part 40 of the FAR and the new proposed part 40 that’s out right now. And, alright, let’s take all of these different requirements around supply chain and whether it’s section 8089 or CUI or any of those, let us pull those together. And it’s going to be interesting to see if that’s adjusted at all based on the signals we’re getting from the Pentagon or from what GSA’s own experience and listening sessions are bringing out and the comments they are getting back. Because, while some of the requirements end up becoming a case by case, what contract needs what and policy, you don’t always want to leave that just to the contracting officer’s discretion because you need to have be signaling to your industrial base. Here’s the standard we want you to meet because otherwise you’re going to be having them making best efforts to meet a certain level and then being told that that’s not sufficient for this contract or it’s overplayed for this contract and a company that didn’t do as much as they did is going to have a competitive advantage because they don’t have the same costs. So this is all, we’re seeing it play out right now, that tension between we want to do things in a unified way, while realizing that the government has its own unique requirements and even within the government, the requirements are not always going to be unified.

Terry Gerton Emily Murphy is senior fellow at the George Mason University Baroni Center for Government Contracting. Emily, let’s take that to the commercial providers right now. If you’re running a commercial tech company, what’s that experience like? How are you trying to figure out how to navigate all of these rules that are constantly changing?

Emily Murphy So if I’m a commercial company that hasn’t been doing business in the government space right now, you’d have to convince me pretty hard to do something other than working through like a CSO, a commercial solutions opening, something that gives me a little bit more protection against these changing requirements. Otherwise I’d be saying, wait a second here, as I evaluate this market, you’re changing the rules on me day to day. I need to pause and make sure that this is the right thing for my company. Now that’s not going to be good for the government. Because that’s going to mean the government’s going to be lagging behind the technology that they could actually access. But it also, it sort of shows us why the government has the problem it has now, where it says that it, the government is quick to complain that the companies it does business with are very bureaucratic and they set themselves up in these ways and the other, but they set themself up the way the government has them to set themselves up. I always use CAS as the example. No company ever said, let me come up with a new accounting system just because I think it’ll be fun. They did it because the government asked them to do it and that adds cost and then the government comes back and says, well, that added cost, you cost more than your commercial counterparts. Sure enough, they do because they did exactly what the government asks them to do. So if I’m a commercial company right now who hasn’t been doing work in the government space, I’m probably thinking twice about it. If I’m a newer company in that government space. I’m probably pushing back pretty hard because I’ve just made an investment and I’m being told that investment needs to change again. If I’m a traditional company that’s done business in the government before, I’m concerned because I want to make sure that I understand how I’m going to be asked to change, but I’m also probably more prepared for those changes to be coming and more concerned that are the changes going to come in a way that it boxes me out because I’d done what the government’s asked me to do in the past.

Terry Gerton I have the sense that this is not surprising to you, where we are given your experience, but you know, to be fair, agencies aren’t making this stuff up just for fun. They’re really trying to figure out the best way to do it. Do you have a sense that is just part of the learning curve of a new administration or is there something else going on?

Emily Murphy I think this is just the inherent tension in being in the government. The government has competing policy interests and competing security interests and supply chain interests that it’s always trying to meet. And I’ll use small business as an example, because we’ve had small business going now and small business programs since the 1950s. And it still remains a tension of do we want the broadest round of competition where we let everyone compete for something. Or do we think that there’s a case for setting things aside for small business and limiting the competition so we grow part of our industrial base? So we’ve always had these tensions in there. And we see that playing out now, which when we talk about things like the role of the 8(a) company or a women-owned small businesses or service-stable, veteran-owned small business. So that, it’s always played out in the government space. The instances we’re seeing play out now are on cyber security, AI policy. Some of this is new, some of it’s not. I still remember the old Y2K provisions we put in government contracts 20, 30 years ago to try and get government contractors ready for Y2k. And then we had to take those out because we then left those provisions in. So we were continuing to require companies to be prepared for Y2K after Y2K. That’s where the government has its greater issue is that they will adopt a standard. But it’s much harder for the government to change and evolve their standards than it is for the private sector. And it’s much harder for them, they’re trying to meet both a national security interest, an industrial base economic interest, and a, we’ve just got to get something purchased so we can get something done interest with all of their purchasing. So they’ve got different competing interests and there’s a constant tension as they try to reconcile those.

Terry Gerton Do you have the feeling that this instability, especially in the tech space, is just the new normal given the rate of change of technology and the difficulty of finding an enduring standard?

        Sign up for our daily newsletter so you never miss a beat on all things federal

Emily Murphy I think some of it is because we’re in the cusp of such a transformation in the space of AI, the President’s executive order on quantum, and how fast we’re going to be transitioning to quantum. So I think that the constantness is going to change.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.