whatbindsCheck your order

Clauses · DFARS · Supply chain and sourcing

DFARS 252.239-7018 Supply Chain Risk

Does the regulation require it to flow down?

No

The DEC 2022 text has only (a)–(d), with no flowdown paragraph (verified in the current text). Primes include it in IT subs because the prescription reaches any IT 'in support of' a covered system and because they want to preserve against the sub the same exclusion authority the government holds against them

A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.

Checked against acquisition.gov on 2026-08-11 · edition DEC 2022 · base v0.9.3 Read the text ↗

What it makes you produce

One item for your checklist.

  1. A program you have to be running

    You are either running it or you are not, and what the prime asks for is the date it started.

    • A working practice for knowing who each information technology component came from, and being able to show that trail on demand

      DFARS 252.239-7018(b)

When it is used

Applies in all contracts, including FAR Part 12, for information technology (as a service or as supplies) that is a covered system, part of one, or in support of one — covered system = national security system, per 239.7301 (prescription 239.7306(b)). No dollar threshold. It only reaches the sub if the prime includes it — the clause has no flowdown mandate.

Read closely

(b) is one sentence — mitigate supply chain risk in what is provided to the Government — and it names no program elements, so what it takes is a reading of that duty rather than a list in the clause. (d) is the half that carries a cost nobody reimburses: an exclusion reached on information the contractor will not see is not reviewable at the GAO or in federal court, and the swap lands on the supplier.

The 11 templates that name it, with the line

Source: acquisition.gov, DFARS 252.239-7018. CODIFIED REGIME, read 2026-08-11 on the part-252 page at DFARS Change 5/7/2026: "As prescribed in 239.7306(b), use the following clause:" with designation SUPPLY CHAIN RISK (DEC 2022). DEVIATION REGIME: the part-39 memo prints "Subpart 239.71-239.73 [Reserved]" in place of the subpart, the string 239.7306 appears in it zero times, 252.239-7018 appears zero times, and no clause numbered in the range 252.239-7900 to 252.239-7999 appears in it. Two independent negatives against the whole memo, which is the playbook's bounded-body rule. TO RE-DERIVE WITHOUT REDOING THE RESEARCH: fetch acquisition.gov/sites/default/files/page_file_uploads/DoD_RFO_Deviation_Part-39.pdf (599072 bytes, 29 pages, DARS Tracking Number 2026-O0024, "Effective February 1, 2026, contracting officers shall use"), run pdftotext -layout over it, and grep for 252.239-7018 — 0 occurrences on 2026-08-11, poppler pdftotext. The successor range is the same read: grep -oE "252[.]239-79[0-9]{2}" returns nothing, and "Subpart 239.71-239.73 [Reserved]" is on page 3. (verified 2026-08-11)

This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.