Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities
Contractors must not provide or use any Kaspersky Lab hardware, software, or services in federal contracts and must promptly report any such use or provision if discovered.
Overview
FAR 52.204-23 prohibits federal contractors from providing or using hardware, software, or services developed or provided by Kaspersky Lab or its covered entities in the performance of government contracts. This prohibition is rooted in national security concerns and applies to all contracts where the clause is included. Contractors must not provide or use any Kaspersky Lab covered articles for government use or in the development of contract deliverables after October 1, 2018. If a contractor discovers or is notified that a Kaspersky Lab covered article has been provided or used, they must report this to the Contracting Officer (or via the DOD's DIBNet for DOD contracts) within specified timeframes and provide detailed information about the incident and mitigation actions. The clause must also be flowed down to all subcontractors, including those providing commercial products or services.
Key Rules
- Prohibition on Kaspersky Lab Covered Articles
- Contractors are strictly prohibited from providing or using any hardware, software, or services from Kaspersky Lab covered entities in government contracts after October 1, 2018.
- Mandatory Reporting
- Contractors must report any identification or notification of Kaspersky Lab covered articles within 3 business days, and provide follow-up information within 10 business days.
- Subcontractor Flowdown
- The substance of this clause must be included in all subcontracts, regardless of tier or whether the products/services are commercial.
Responsibilities
- Contracting Officers: Ensure the clause is included in applicable contracts and receive required reports from contractors.
- Contractors: Avoid providing or using Kaspersky Lab covered articles, report any incidents promptly, and flow down the clause to all subcontractors.
- Agencies: Oversee compliance and respond to contractor reports as necessary.
Practical Implications
- This clause exists to protect government information systems from potential cybersecurity threats posed by Kaspersky Lab products.
- Contractors must have robust supply chain controls and due diligence processes to avoid inadvertent use or provision of prohibited articles.
- Failure to comply can result in contract remedies, reputational harm, and potential legal consequences.