Authored by Paul Dillon, Michelle Hobbs, Kasey Pittman and Michael Wronsky On Friday, Nov. 19, 2021, the House voted 220-213, along party lines, to pass the Build Back Better (BBB) Act. The potential legislation, which contains a considerable number of tax provisions, now moves to the Senate for consideration, where they are expected to begin deliberations in early December and vote before the holidays. Tax provisions included in the BBB Act Earlier in November, we covered the largest tax provisions included in the BBB Act in an alert, House passes infrastructure bill, advances Build Back Better bill. The potential legislation remains largely unchanged, with no notable changes to relevant tax provisions.  The several week delay in the BBB Act vote was not for continued negotiations, but to allow time for the Congressional Budget Office to “score” the bill, giving legislators a more accurate picture of revenue raised and spent within the bill. Next steps The BBB Act now moves to the Senate, where it will almost certainly encounter changes. At a minimum, the legislation must undergo review by the Senate parliamentarian to ensure it retains its privileged status and does not violate the Byrd rule, meaning each provision included must have a budgetary impact to be eligible for passage via reconciliation. Two Democratic senators — West Virginia’s Joe Manchin and Arizona’s Kyrsten Sinema — have been the primary drivers of recent changes to the BBB agenda. Sen. Manchin’s objections effectively cut the total cost of the proposed legislation in half from $3.5 trillion to $1.75 trillion in recent negotiations. Sen. Sinema’s objections have removed several planned revenue-raisers, namely individual and corporate tax increases.  While the current House legislation takes into account many of Sen. Manchin and Sen. Sinema’s objections, neither have publicly signaled support for the current legislative text. Consequently, we expect additional changes to the bill in the Senate beyond those required by the Senate parliamentarian. If the Senate does alter the BBB Act, it will need to go back to the House for a final vote before it can be enacted. Enactment prospects Though nothing is certain, it does seem likely some form of the BBB Act will be passed either by the end of the calendar year or in early 2022. As noted above, we expect some changes in the Senate; however, a number of items are not expected to make it into the final legislation: Increase in the cost of the BBB Act  Increase in regular tax rates  Inclusion of trust and estate changes as there doesn’t seem to be an appetite for this in the Senate We are watching two revenue-raising proposals championed by Democratic Sen. Ron Wyden of Oregon: (1) a billionaire “mark-to-market” requirement and (2) an overhaul of partnership tax rules. While these do not seem to have wide support in the Senate and are unlikely to make it into this bill, they are serious proposals authored by Sen. Wyden (the chair of the Senate Finance Committee) and could be used in future legislation. Effective dates of tax provisions If enacted as passed by the House, most tax provisions included in the BBB Act will take effect on Jan. 1, 2022. Several less pervasive tax provisions would take effect as of the date of enactment, but the current projected timeline for passage would place that date close to Jan. 1, 2022.  There is one notable exception: Section 1202 qualified small business stock gain exceptions would go into effect for all sales after Sept. 13, 2021, subject to a binding contract exception. As you approach year-end tax planning, we recommend working with your Baker Tilly tax advisor to prepare for the potential legislation and act on possible planning opportunities.

The heavily negotiated and long-awaited $1.75 trillion Build Back Better Bill finally passed the House. It now goes to the Senate where it is likely to face additional changes in order to appease every Democratic senator since all of their votes are needed to pass the bill via reconciliation.

Private Wealth

Federal Tax

State & Local Tax

Build Back Better Act passes House, moves to Senate

After conducting an internal review, the Department of Defense (DoD) announced a major change to the Cybersecurity Maturity Model Certification (CMMC) program. According to the DoD, the updated framework, now called CMMC 2.0, will: Simplify the CMMC standard and provide additional clarity on cybersecurity regulatory, policy and contracting requirements Focus the most advanced cybersecurity standards and third-party assessment requirements on companies supporting the highest priority programs Increase DoD oversight of professional and ethical standards in the assessment ecosystem   Organizations are now asking - what is changing with CMMC requirements and what stays the same? What key questions still need to be answered? Much of CMMC remains the same; however, many contractors need to evaluate these five key changes:  Preparation and timeline – According to current guidance from the DoD, CMMC 2.0 will require 9-24 months of rulemaking. Organizations should use this time and their resources wisely by implementing NIST 800-171 (which is already present in contracts as DFARS 252.204-7012). Implementing NIST 800-171 will improve the self-assessment score you post to the DoD’s Supplier Performance Risk System (SPRS), for which the DoD indicates there may be incentives for improved scores and/or early adoption of CMMC 2.0.  Annual affirmation – CMMC 2.0 calls for an annual affirmation from a senior company official. This requirement is reminiscent of Sarbanes-Oxley (SOX) 302. Additionally, the Department of Justice (DOJ) announced an intent to hold entities or individuals accountable that knowingly misrepresent their cybersecurity practices. Organizations should begin evaluating their process for completing this affirmation, determine who will sign the affirmation and what basis is required to be comfortable signing. Plan of action and milestones (POA&Ms) and waivers – Only a small number of waivers will be granted, benefiting a limited number of contractors. POA&Ms will only apply to the minor requirements after an organization achieves a higher level of compliance,  Policies and procedures – While it is true that CMMC 2.0 eliminates the process requirements, NIST 800-171 requires 49 of the 110 items to be “defined,” which is typically in the form of a policy or procedure. Further, if you make claims about your organization’s cybersecurity environment annually to the DoD, it is beneficial to have rigor and structure to ensure those statements remain accurate.   Self assessments – While organizations pursuing CMMC Level 1 will benefit from self-assessments, most contractors who have concerns about CMMC were targeting the prior Level 3 (new Level 2) and above. In CMMC 2.0, most contractors that handle controlled unclassified information (CUI) will require a third-party assessment or DoD-led assessment if the associated programs “involve information critical to national security.” How widely or narrowly this is interpreted is important to watch. However, we anticipate the DoD will err on the side of caution, meaning many contractors will have at least one such contract and are not be eligible for self-assessment.  
How will CMMC 2.0 impact your organization? Review the decision tree and consult the notes below for further insight.   Note A – While the DoD may not require CMMC 2.0, some prime contractors (prime) are pushing their supply chain to comply. Doing so makes it easier for the prime. If all preferred providers are CMMC 2.0 Level 2 or higher, they have less to worry about when sharing CUI. This behavior can drive more organizations to require CMMC 2.0 certifications. Note B – Similar to Note A, if primes require C3PAO assessments and not self-assessments that may drive organizations to seek certification who otherwise would not. This again would make it easier for the prime because they would not need to make the distinctions or fulfill/address requirements in contracts to understand when a self-assessment is permitted. Note C – Waivers appear to be very rare. If you have multiple contracts or plan to have multiple contracts in the future, it is unlikely that all would be eligible for a waiver. Note D – POA&Ms will only apply to minor items. While this might save you from a failure if you do not have one item in place, it does not mean you can be certified without addressing some of the larger, more costly aspects of NIST 800-171.
The following topics remain unchanged in CMMC 2.0. Read below to understand the impact.
The following topics change as a result of CMMC 2.0. Read below to understand the impact.
Baker Tilly is a candidate CMMC Third-Party Assessor Organization (C3PAO), ready to help you achieve CMMC readiness or official assessment objectives. 

Government Contractors

Risk Advisory

Cybersecurity Maturity Model Certification (CMMC)

Cybersecurity

Government Contracting & Compliance

CMMC 2.0: five key changes for government contractors

The COVID-19 vaccine mandate plans for government contractors and large employers introduced by President Biden in September will cover a broad spectrum of U.S. businesses and organizations. Employers need to prepare now to determine if they are included in the mandates, how they will demonstrate compliance and how they will communicate and carry out any new vaccine-related policies to their employees and clients.  Federal agencies have so far issued more official guidance to determine who is or isn’t a government contractor than guidance related to large employers, and the mandates will likely be subject to court challenges. Still, organizations need to take preliminary steps to ensure they are prepared as needed when the mandates go into effect. Government contractors By Dec. 8, 2021, government contractors and subcontractors must comply with the Biden administration’s requirement that employees be fully vaccinated for COVID-19. The vaccine mandate plan was introduced by executive order (EO) on Sept. 9, 2021, and further clarified by the Office of Management and Budget on Sept. 24, 2021. The mandate applies to new solicitations and contracts entered into after Oct. 15, 2021, as well as options, orders, extensions and renewals of existing contracts entered into after that date. The mandate is expansive and applies to all government contractors and subcontractors, including those portions of the business not who do not work directly on government contracts. (A summary of the government contractor mandate appears at the end of the story.) While there are exceptions to the order, the guidance strongly recommends applying the mandate broadly, and we have already seen GSA issue a class deviation to apply the mandate to all FSS contracts, including those for products. The White House’s Safer Federal Workforce Task Force on Sept. 24, 2021, issued guidance for covered contractors outlining their responsibilities for ensuring that covered contractor employees comply with the workplace safety protocols. The Civilian Agency Acquisition Council issued further guidance on Sept. 30, 2021, requiring federal agencies to — starting Oct. 15, 2021 — add a clause related to these COVID-19 workplace safety protocols to covered federal procurement solicitations and contracts subject to the Federal Acquisition Regulation (FAR). Next steps for government contractors Understand their portfolio of government prime and subcontracts to determine compliance Develop a compliant vaccine policy including an employee communication plan Understand system(s) required to aid in the collection of vaccination and exemption documents Determine how to share relevant vaccine compliance information with clients Here are some key questions employers should consider: Are you subject to the government contractor mandate? The government contractor mandate may cast a wider net than many companies think. A company may not consider itself a government contractor, but its relationship to a federal contractor may place it in the position of having to comply, as companies maneuver to ensure they and their suppliers meet the new requirements. Even subcontractors two or three tiers removed will be affected by this mandate, as it applies to all parties providing services pursuant to a federal contract. Does everyone at your company need to get vaccinated? A company may consider its employees are not directly involved with government contract work, perhaps because they work from home or on unrelated projects, to be unaffected by this mandate; however, this is not necessarily the case. The choice for the company is to either establish internal policies as to who and who isn’t covered by the mandate (and track the job status and prevent in-person interactions of both sets of employees accurately over time) or just require all employees to be vaccinated to minimize the resources needed to properly track compliance. One of the risks in limiting the vaccine requirement to only some employees is creating two classes of employees. The FAQs included in the White House Sept. 24, 2021, guidance note that any interactions between covered contractor employees and others in a building controlled by the covered contractor make the entire workplace a covered contractor workplace where all employees would be subject to the mandate.  In addition, remote workers who tangentially touch the covered work are considered subject to the mandate, making it difficult to ascertain whether someone is truly exempt from the requirement. How does a company communicate necessary information about the vaccine mandate to employees? As a guide, companies generally should follow the communication plan they have used related to any other type of mandate, new HR policy or HIPAA-related information collection they have put in place. While a company can’t necessarily control internal conversations about who or who isn’t vaccinated, they should treat any official vaccine mandate reporting with the same sensitivity and confidentiality as health information about intensive medical conditions, like a cancer diagnosis. They should also consult with any professional services firm they have worked with in the past on implementing new procedures to get proper guidance on complying with the vaccine mandate. How does a company discuss its compliance with the vaccine mandate with clients? A company just needs to be prepared when a client asks about how it is complying with the mandate. A company does not want to take the risk of suddenly losing a client because it has not properly followed the mandate. Some contractors are more familiar with modifying existing contracts to reflect new federal requirements. Some may simply ask a company to sign a certification noting its compliance. However a company reports on its compliance, it has to keep in mind the protection of its employees’ personal health information, especially when working with another company’s system. OSHA’s large employer mandate In addition to the government contractor vaccine mandate, the Biden administration, through the Occupational Safety and Health Administration (OSHA), will issue regulations related to its order requiring all employers with 100 or more employees to ensure that either their employees are vaccinated or tested weekly. While less than 2% of all U.S. businesses have 100 or more employees, these large companies employ about two-thirds of all workers. The OSHA regulations are in addition to what the federal government has already decided regarding government contractors, so government contractors should not wait for the OSHA regulations to be released; act now to ensure compliance, or run the risk of losing contracts. For more information on this topic, or to learn how Baker Tilly specialists can help assist, contact our team.

The COVID-19 vaccine mandate introduced by the Biden administration impacts more companies than originally thought. Start planning now to prepare your company for compliance.

Contract & Regulatory Compliance

Government Contractor Supply Chain Risk Management

Government Contractor Coronavirus Resources

Coronavirus Recovery & Growth Resources

How employers can prepare now for COVID-19 vaccine mandate compliance

Are you overwhelmed with the number of technology solutions? This e-book provides practical information and advice to evaluate, implement and successfully adopt new technologies.
Video For years, companies have looked to better enable their organizations and serve their customers by considering – if not embracing – digital technologies. The COVID-19 pandemic, which emptied buildings as employees shifted to working from home, changed the customer buying experience and had a  severe impact on production lines and supply chains. This compelled many to accelerate their search for technology or automation solutions. An organization’s ability to drive adoption of technology and embrace an innovative culture is critical. Choosing the right technology among so many choices is hard. 
For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team. 

Overwhelmed with the number of available technology solutions? Deciding which technologies to adopt is among the biggest challenges for business leaders.

Software & Technology

Baker Tilly Digital

Data Solutions

Amazon Web Services (AWS)

Cloud Services

Connected Devices

Digital Enterprise

Digital | Labs

Emerging Technologies

Intelligent Automation

Technology overload: a guide to making smarter decisions

Video Nearly 60% of organizations with strategic plans struggle to execute, according to a Gartner Strategy Agenda Poll. During this on-demand webinar, you will learn about the basics of effective strategic growth planning, how to break through internal and external barriers, how to identify key gaps across the organization, and how to improve your chances of success.  Key objectives include: A framework for developing a strategic growth plan in a post-pandemic environment Lessons from the pandemic – how to address internal and external barriers to strategic growth How to create long-term sustainable value
Presenters Gary A. Plaster Jeffrey J. Vrabel  Dr. Mark Frigo, Director Emeritus of the Center for Strategy, Execution, and Valuation and the Strategic Risk Management Lab, Kellstadt Graduate School of Business at DePaul University in Chicago For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team.

Join Baker Tilly for an informative on-demand webinar on how to break through barriers to success with strategic growth planning.

Build Back Better Act passes House, moves to Senate

CMMC 2.0: five key changes for government contractors

How employers can prepare now for COVID-19 vaccine mandate compliance

Technology overload: a guide to making smarter decisions

Break through barriers to success with strategic growth planning

Build Back Better Act passes House, moves to Senate