52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities
Source: FAR 52.204-23 on acquisition.gov
Contractors must not provide or use any Kaspersky Lab hardware, software, or services in federal contracts and must promptly report any such use or provision if discovered.
Overview
FAR 52.204-23 prohibits federal contractors from providing or using hardware, software, or services developed or provided by Kaspersky Lab or its covered entities in the performance of government contracts. This prohibition is rooted in national security concerns and applies to all contracts where the clause is included. Contractors must not provide or use any Kaspersky Lab covered articles for government use or in the development of contract deliverables after October 1, 2018. If a contractor discovers or is notified that a Kaspersky Lab covered article has been provided or used, they must report this to the Contracting Officer (or via the DOD's DIBNet for DOD contracts) within specified timeframes and provide detailed information about the incident and mitigation actions. The clause must also be flowed down to all subcontractors, including those providing commercial products or services.
Key Rules
- Prohibition on Kaspersky Lab Covered Articles
- Contractors are strictly prohibited from providing or using any hardware, software, or services from Kaspersky Lab covered entities in government contracts after October 1, 2018.
- Mandatory Reporting
- Contractors must report any identification or notification of Kaspersky Lab covered articles within 3 business days, and provide follow-up information within 10 business days.
- Subcontractor Flowdown
- The substance of this clause must be included in all subcontracts, regardless of tier or whether the products/services are commercial.
Responsibilities
- Contracting Officers: Ensure the clause is included in applicable contracts and receive required reports from contractors.
- Contractors: Avoid providing or using Kaspersky Lab covered articles, report any incidents promptly, and flow down the clause to all subcontractors.
- Agencies: Oversee compliance and respond to contractor reports as necessary.
Practical Implications
- This clause exists to protect government information systems from potential cybersecurity threats posed by Kaspersky Lab products.
- Contractors must have robust supply chain controls and due diligence processes to avoid inadvertent use or provision of prohibited articles.
- Failure to comply can result in contract remedies, reputational harm, and potential legal consequences.
As prescribed in 4.2004 , insert the following clause:
Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities. (Dec 2023)
(a) Definitions. As used in this clause—
Kaspersky Lab covered article means any hardware, software, or service that–
(1) Is developed or provided by a Kaspersky Lab covered entity;
(2) Includes any hardware, software, or service developed or provided in whole or in part by a Kaspersky Lab covered entity; or
(3) Contains components using any hardware or software developed in whole or in part by a Kaspersky Lab covered entity.
Kaspersky Lab covered entity means–
(1) Kaspersky Lab;
(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”;
(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or
(4) Any entity of which Kaspersky Lab has a majority ownership.
(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115-91) prohibits Government use of any Kaspersky Lab covered article. The Contractor is prohibited from—
(1) Providing any Kaspersky Lab covered article that the Government will use on or after October 1, 2018; and
(2) Using any Kaspersky Lab covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract.
(c) Reporting requirement.
(1) In the event the Contractoridentifies a Kaspersky Lab covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil" target="_blank">https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil" target="_blank">https://dibnet.dod.mil.
(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:
(i) Within 3 business days from the date of such identification or notification: the contract number; the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended.
(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a Kaspersky Lab covered article, any reasons that led to the use or submission of the Kaspersky Lab covered article, and any additional efforts that will be incorporated to prevent future use or submission of Kaspersky Lab covered articles.
(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts including subcontracts for the acquisition of commercial products or commercial services.
(End of clause)