Government contractors outsource customer support, data entry, and back office work for the same reasons any company does: cost, capacity, and coverage. The difference is that a federal contract comes with rules, and many of them follow the work wherever it goes. We sat down with Andy King, President of Federal Publications Seminars, one of the longest-established providers of government contracts training in the United States, training contracting professionals since 1959, to talk about what contractors should settle before handing work to a business process outsourcing (BPO) partner.
Q: What changes when a government contractor outsources back office work?
A: The obligations do not leave with the work. When a prime contractor brings in a BPO, many of its federal contract clauses flow down to that partner, and the prime still answers to the government for compliance. Amongst the clauses that come up most often are those that cover how federal contract information and controlled unclassified information (CUI) are safeguarded, privacy training for anyone who handles personal data, anti-trafficking rules for work performed overseas, and the Section 889 ban on certain telecommunications and surveillance equipment, which can reach the phones and cameras in a partner’s contact center.
Q: So what can go to a BPO, and what should stay in-house?
A: Draw the line around the data, not the job title. Customer support or data entry that never touches federal contract information or CUI is usually safe to outsource under standard vendor controls. Work that touches CUI can go only to a partner that meets the same security requirements you do. Work involving export-controlled technical data generally has to stay with authorized U.S. persons, which rules out many offshore teams. Certifications, mandatory disclosures, and cost or pricing submissions should stay with your own people, because those are representations your company signs and answers for.
Q: The Pentagon paused CMMC Phase 2 this summer. Does CUI handling still matter when choosing a BPO?
A: Yes, and this is where contractors get tripped up. The Department of Defense suspended the move to third-party assessments on July 13, 2026, and made that pause binding through a class deviation on September 3, but the underlying rules did not change. DFARS 252.204-7012 still requires the 110 security controls in NIST SP 800-171 wherever CUI is handled, and contractors still need a current CMMC status in the Supplier Performance Risk System. If a BPO’s agents or systems touch CUI, that partner is in scope and needs its own assessment. A SOC 2 report or ISO 27001 certificate shows good security habits, but neither one substitutes for NIST SP 800-171.
Q: How do subcontractor reporting and cost allowability factor in?
A: Both need to be settled before the subcontract is signed. First-tier subawards above the reporting threshold have to be reported in SAM.gov, and some contracts require the contracting officer’s consent before you subcontract at all. On cost, outsourced work is allowable only if it is reasonable, allocable, and properly documented, and DCAA auditors test all three. Keep the price or competition analysis, the statement of work, and invoices tied to the work actually performed.
Q: Unity Communications works with clients in regulated industries like healthcare and fintech. What should a government contractor ask a BPO partner, and who needs training on this?
A: Ask which FAR and DFARS clauses the partner has accepted before, where your data will be stored and who can access it, what its current SPRS score is if CUI is in scope, and how it will document time and work for your auditors. A partner that already runs HIPAA, PCI, or SOC 2 controls will answer faster. The harder gap is usually on the contractor side: knowing what to ask. Federal Publications Seminars has helped government contractors stay compliant with federal acquisition regulations for more than 65 years, and the pattern we see is consistent. The contracts, procurement, and finance staff who write the subcontract need training on FAR flow-downs, DFARS cybersecurity clauses, and cost principles, especially now, with the Revolutionary FAR Overhaul underway and clause language shifting from one contract to the next.
