Clauses · DFARS · Cybersecurity · provision
DFARS 252.239-7009 Representation of Use of Cloud Computing
Does the regulation require it to flow down?
No
The provision has three paragraphs — (a) definition, (b) instruction, (c) the representation itself — and none mentions subcontracts; DFARS 239.7604(a) addresses solicitations only. Primes reproduce it because they must collect from you the same answer they gave the Government: the representation asks whether cloud computing services are anticipated 'in the performance of any contract or subcontract resulting from this solicitation', and a prime cannot answer for its own supply chain without asking each tier. gdms-scm-tmp-095 (ffp commercial) places it in a representations block, which is correct placement; bae-usgova (03/2025) lists it in the same run as the clause 252.239-7010, which is how the pair is meant to travel.
A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.
Checked against acquisition.gov on 2026-08-05 · edition SEP 2015 · base v0.9.3 Read the text ↗
What it makes you produce
One item for your checklist.
Something you fill in and send back
Hours, once you know which one is missing.
- 252.239-7009(c)
One box ticked: whether cloud computing services are anticipated in performing anything that comes out of this solicitation
Owed when before award, and again if the answer changes before award
When it is used
DFARS 239.7604(a): 'Use the provision at 252.239-7009, Representation of Use of Cloud Computing, in solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services.' No dollar threshold. It is a solicitation provision — a representation the offeror makes before award — and it is the gate for DFARS 252.239-7010, Cloud Computing Services, which is the clause carrying the actual obligations (DoD provisional authorization from DISA at the appropriate level, Government data held within the United States per DFARS 239.7602-2, incident reporting) and which is already in the base at JAN 2023.
Read closely
The definition at (a) is the NIST one and it is wide — a hosted engineering, quality, file-sharing or planning tenant used to do the work counts, and so does software, infrastructure and platform as a service. A yes pulls 252.239-7010 into the resulting order, and that is where the cost sits.
The 4 templates that name it, with the line
Source: acquisition.gov, DFARS 252.239-7009, DFARS 239.7604(a), DFARS 239.7602-1 and 239.7602-2, and DFARS 212.301(f) (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.