4.2004
Contract clause
All government contracts and solicitations must include a clause prohibiting the use of Kaspersky Lab hardware, software, or services to mitigate cybersecurity risks.
Overview
FAR 4.2004 requires contracting officers to include the clause at 52.204-23 in all solicitations and contracts. This clause prohibits the government from contracting for hardware, software, or services that are developed or provided by Kaspersky Lab or its covered entities. The regulation is part of the government’s efforts to mitigate cybersecurity risks associated with certain foreign technology providers.
Key Rules
- Mandatory Clause Inclusion
- Contracting officers must insert FAR 52.204-23 in every solicitation and contract, regardless of contract type or value.
- Prohibition Scope
- The clause enforces a ban on acquiring hardware, software, or services from Kaspersky Lab and its affiliates.
Responsibilities
- Contracting Officers: Must ensure the clause is included in all solicitations and contracts.
- Contractors: Must comply with the prohibition and ensure their offerings do not include Kaspersky Lab products or services.
- Agencies: Should oversee compliance and address any violations or disclosures related to Kaspersky Lab products.
Practical Implications
- This regulation exists to protect government information systems from potential cybersecurity threats posed by Kaspersky Lab products.
- Contractors must carefully review their supply chains and offerings to ensure compliance.
- Failure to comply can result in contract termination or other penalties, making due diligence essential.