Clauses · FAR · Banned sources and products
FAR 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities
Does the regulation require it to flow down?
Yes
All subcontracts, including COTS
- Form
- substance
- Reaches
- all tiers
Checked against acquisition.gov on 2026-08-09 · edition Dec 2023 · base v0.9.3 Read the text ↗
What it makes you produce
One item for your checklist.
Something you fill in and send back
Hours, once you know which one is missing.
- FAR 52.204-23(c)
A report — contract number, supplier, brand, model number and item description — with mitigation detail and the prevention steps taken and planned within 10 business days after it
Owed when you identify a Kaspersky Lab covered article in what you supply or use — the first report is due within three business days of that
When it is used
All contracts, no threshold, including commercial/COTS.
Read closely
Paragraph (b) is the prohibition on providing such an article or using one in developing a deliverable, and paragraph (d) carries the substance into all subcontracts, commercial ones included. The check itself is a software inventory. Reports on a defense order go to dibnet.dod.mil. The model text for the FAR overhaul prints this number as reserved and consolidates the prohibition into FAR 52.240-91.
The 17 templates that name it, with the line
Source: acquisition.gov, FAR 52.204-23, codified text read at FAC 2026-01 (effective 2026-03-13), prescribed at 4.2004 with designation (Dec 2023), and printed [Reserved] in the RFO Part 52 disposition table (verified 2026-08-09)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.