Clauses · FAR · Cybersecurity
FAR 52.239-1 Privacy or Security Safeguards
Does the regulation require it to flow down?
No
No mandate — there is no subcontracts paragraph, and 39.106 addresses the contracting officer, not the prime. Primes flow it down to mirror two rights onto the party that actually runs the system: the non-disclosure of safeguard details in (a), and the Government access-for-inspection right in (b). It has also simply never been removed — it has sat in Section I clause lists since 1996 and rides along in templates as recent as l3harris-lgl-50-f1 (Feb 2026)
A clause can reach your subcontract without a mandate. Once it is in your document, it is a contract term all the same. The missing mandate is a fact about the regulation. It is not a ruling on your order.
Checked against acquisition.gov on 2026-08-05 · edition Aug 1996 · base v0.9.3 Read the text ↗
What it makes you produce
One item for your checklist.
Something you fill in and send back
Hours, once you know which one is missing.
- 52.239-1(c)
An immediate notice to the other side, naming the threat or the safeguard that has stopped working
Owed when a new or unanticipated threat or hazard is discovered, or an existing safeguard has ceased to function — whoever discovers it is the one who raises it
When it is used
Prescribed at FAR 39.106, and note the unusual wording: the contracting officer inserts "a clause substantially the same as the clause at 52.239-1" — tailoring is contemplated, unlike the verbatim-flow-down clauses in the cyber family. The condition is solicitations and contracts for information technology which require security of information technology, and/or which are for the design, development, or operation of a system of records using commercial information technology services or support services. No dollar threshold, no contract-type restriction, no commercial or COTS carve-out. The clause is three paragraphs long and specifies no controls, no framework, no assessment and no reporting deadline — it predates FISMA, NIST SP 800-171, the FAR CUI regime and CMMC by decades. l3harris-lgl-50-f1 (Feb 2026) reproduces the 39.106 condition as an applicability note, which is the correct treatment; bae-usgova (Mar 2025), caci-corvus (2020) and perspecta-corvus (2018) list it flat with no condition at all.
Read closely
The other two paragraphs are running restrictions rather than deliverables: the details of any safeguard stay unpublished without the contracting officer's written consent ((a)), and the Government gets access to facilities, operations, records and databases for its inspection program ((b)). The clause names no control baseline, no framework, no assessment and no deadline — it predates all of them. Where federal contract information sits on your systems the controls are 52.204-21's; where the information is controlled unclassified information on DoD work they are 252.204-7012's.
The 2 templates that name it, with the line
Source: acquisition.gov, FAR 52.239-1 and FAR 39.106 (verified 2026-08-05); removal proposal read at govinfo, FR 2026-12559, published 2026-06-23; FAR 52.240-5 confirmed nonexistent (HTTP 404 on acquisition.gov, 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.