Subpart 4.20
Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab
Federal contracts are strictly prohibited from including Kaspersky Lab hardware, software, or services, and contractors must promptly notify the government if such products are identified.
Overview
FAR Subpart 4.20 establishes a government-wide prohibition on contracting for hardware, software, and services developed or provided by Kaspersky Lab or its related entities. This regulation is designed to protect federal information systems from cybersecurity threats associated with Kaspersky Lab products. It defines key terms, outlines the scope of the prohibition, details notification requirements if a contractor identifies covered products or services during contract performance, and mandates the inclusion of a specific contract clause to ensure compliance.
Key Rules
- Definitions (4.2001)
- Provides definitions for terms such as "Kaspersky Lab," "covered article," and "covered contractor information system."
- Prohibition (4.2002)
- Prohibits agencies from procuring or obtaining hardware, software, or services developed or provided by Kaspersky Lab or its related entities.
- Notification (4.2003)
- Requires contractors to notify the government if they identify any covered Kaspersky Lab products or services during contract performance.
- Contract Clause (4.2004)
- Mandates inclusion of a specific clause in solicitations and contracts to enforce the prohibition and notification requirements.
Responsibilities
- Contracting Officers: Must ensure solicitations and contracts include the required clause and monitor compliance.
- Contractors: Must avoid providing or using Kaspersky Lab products/services and promptly notify the government if any are identified.
- Agencies: Must oversee compliance and respond to contractor notifications.
Practical Implications
- This subpart exists to mitigate cybersecurity risks posed by Kaspersky Lab products.
- Contractors must carefully review their supply chains and IT systems to ensure compliance.
- Failure to comply can result in contract termination or other penalties.