Clauses · DFARS · Cybersecurity
DFARS 252.239-7000 Protection Against Compromising Emanations
Does the regulation require it to flow down?
No
The clause has four paragraphs, (a) through (d), and none of them mentions subcontracts; DFARS 239.7103(a) addresses only solicitations and contracts. Primes flow it down because the accreditation attaches to the hardware, not to the company: a prime cannot deliver TEMPEST-accredited information technology unless the tier that actually builds it is held to the same standard, and paragraph (c) lets the Government run additional tests at the contractor's facility notwithstanding accreditations that existed before award. lockheed-valleytech redefines the parties when it flows the clause — 'Contracting Officer' means 'Lockheed Martin', 'Government' means 'Lockheed Martin and the Government' in paragraphs (c) and (d) — the standard back-to-back device that turns a Government right into a prime right.
A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.
Checked against acquisition.gov on 2026-08-05 · edition OCT 2019 · base v0.9.3 Read the text ↗
What it makes you produce
2 items for your checklist, slowest first.
Something somebody else has to issue you
The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.
- 252.239-7000(a)
An accreditation of the information technology against the National Security Agency TEMPEST standards, or against whatever standard the order names
Owed when the order names the standard and, under (a)(2), the date through which the accreditation has to stay current — with no such specification there is nothing to accredit against
Something you write
Days to weeks, and nobody outside your company has to agree to it.
- 252.239-7000(b)
The documentation supporting that accreditation
Owed when the contracting officer requests it
When it is used
DFARS 239.7103(a): 'Use the clause at 252.239-7000, Protection Against Compromising Emanations, in solicitations and contracts involving information technology that requires protection against compromising emanations.' No dollar threshold, no contract-type restriction and no commercial carve-out is written into the prescription — the gate is purely factual: does the Government require the delivered information technology to be accredited against compromising emanations? The clause is measurable only when the contract names the standard (NSTISSAM TEMPEST 1-92, or another standard specified in the contract) and the date through which accreditation must be current — paragraph (a)(2). Absent that specification there is nothing to accredit against, which is why the corpus flows it conditionally: lockheed-valleytech-subcontract-4105206081-2021 marks it 'Applicable if classified work is required.'
Read closely
Paragraph (c) lets the Government run further tests at your own facility during inspection and acceptance even where the equipment carried a valid accreditation before award, and (d) adds a one-year correct-or-replace duty at no cost, restarting on any modification. The laboratory testing is the money here, and it has to be current rather than historical.
The 3 templates that name it, with the line
Source: acquisition.gov, DFARS 252.239-7000, DFARS 239.7103(a) and DFARS 212.301 (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.