8.608
Protection of classified and sensitive information
Agencies must not award FPI contracts that allow inmate workers access to classified, sensitive infrastructure, or private citizen information without proper consent.
Overview
FAR 8.608 establishes strict limitations on the types of information that may be accessed by inmate workers under contracts with Federal Prison Industries (FPI). Specifically, agencies are prohibited from awarding contracts to FPI that would allow inmate workers to access classified data, sensitive geographic information about critical infrastructure, or personal and financial information about private citizens without explicit consent. This regulation is designed to protect national security, critical infrastructure, and individual privacy when contracting with FPI for goods or services.
Key Rules
- No Access to Classified Data
- Inmate workers under FPI contracts must not be given access to any classified information.
- No Access to Sensitive Geographic Data
- Inmate workers cannot access geographic data related to the location of critical infrastructure, including communications, water, electrical power, pipelines, and other utilities.
- No Access to Personal or Financial Information
- Inmate workers must not access personal or financial information about private citizens, including real property data, unless the individual has given prior consent.
Responsibilities
- Contracting Officers: Must ensure that FPI contracts do not provide inmate workers access to prohibited information and verify compliance before contract award.
- Contractors: Must comply with restrictions on information access and implement safeguards to prevent unauthorized access.
- Agencies: Must oversee contract terms and monitor compliance to protect sensitive and classified information.
Practical Implications
- This section exists to mitigate risks to national security, critical infrastructure, and personal privacy when using inmate labor through FPI contracts.
- Contracting professionals must carefully review contract scopes and deliverables to ensure compliance.
- Failure to comply can result in security breaches, privacy violations, and significant legal or reputational consequences.