Clauses · FAR · Banned sources and products
FAR 52.240-91 Security Prohibitions and Exclusions
Does the regulation require it to flow down?
Yes
Paragraph (j): 'The Contractor shall insert the substance of this clause, including this paragraph (j) but excluding subparagraphs (d)(1) and (i)(1), in all subcontracts and other contractual instruments, including subcontracts for acquiring commercial products or commercial services.' No dollar threshold, no COTS carve-out. The two carve-outs are deliberate: (d)(1) is the company-wide 889(a)(1)(B) use ban, which the statute imposes on the entity the government contracts with rather than on suppliers, and (i)(1) is the quarterly SAM review duty. All three GDMS templates reproduce the exclusion correctly, citing the clause as '52.240-91 (excluding subparagraphs (d)(1) and (i)(1))'.
- Form
- substance, including paragraph (j) itself but EXCLUDING subparagraphs (d)(1) and (i)(1) — self-perpetuating
- Reaches
- all tiers — 'all subcontracts and other contractual instruments'
Checked against acquisition.gov on 2026-08-05 · edition No date designation has been issued — the model text reads '(Deviation Date)' and its Alternate I reads '(DATE XXXX)' (unconfirmed; read 2026-08-05). Exists only under deviation: for DoD, Class Deviation 2026-O0025, effective 2026-02-01, Revision 2 dated 2026-07-16. · base v0.9.3 Read the text ↗
What it makes you produce
2 items for your checklist, slowest first.
Something you write
Days to weeks, and nobody outside your company has to agree to it.
The reasonable inquiry into what you provide and what you use, run on your own records rather than by audit, and whatever you keep to show it was done
FAR 52.240-91(f)
Something you fill in and send back
Hours, once you know which one is missing.
- FAR 52.240-91(h)(1)
A report to the contracting office — contract and order number, the covered article or source, the order it breaches, and the identifying detail listed at (h)(1)(iii) through (ix)
Owed when you find, or a lower-tier supplier tells you, that something covered got through — the report is due within 72 hours of that
When it is used
RFO FAR 40.205(b): insert in all solicitations and contracts. No threshold, no commercial or COTS carve-out — paragraph (j) expressly reaches subcontracts for commercial products and commercial services and says nothing about COTS. Alternate I (40.205(c)) in Federal Supply Schedules, GWACs and multi-agency contracts, and where the program office tells the contracting officer to select specific FASCSA order types. Prohibitions carried: (b)(1) TikTok / any ByteDance covered application on government-owned or contract-used IT, including employee-provided equipment; (b)(2) Kaspersky Lab-covered articles; (b)(3) covered telecommunications equipment or services as a substantial or essential component or as critical technology (889(a)(1)(A)); (c) American Security Drone Act — no delivering a FASC-prohibited unmanned aircraft system, and since 2025-12-22 no operating one in performance and no using federal funds to procure or operate one; (d)(1) the company-wide 889(a)(1)(B) use prohibition; (d)(2) OFAC restrictions (Cuba, Iran, Sudan); (d)(4) the Iran prohibition; (e) FASCSA exclusion and removal orders. The only substantive escapes are the two at (b)(3)(i)-(ii) and (d)(1)(ii)(A)-(B): third-party backhaul, roaming or interconnection service, and equipment that cannot route or redirect user data or see into packets.
Read closely
The prohibitions themselves produce nothing to send: no ByteDance application on government information technology or on any information technology used for the work including employee phones, no Kaspersky article, no covered telecommunications equipment or service as a substantial or essential component or as critical technology, no drone from a covered foreign entity — and since 2025-12-22 no operating one in performance — plus the sanctions bans at (d) and the supply chain exclusion and removal orders at (e). Paragraph (j) carries the substance, including itself, into all subcontracts and other instruments, commercial ones included, leaving out (d)(1) and (i)(1): the company-wide use ban the statute places on the entity the government contracts with, and the quarterly SAM review. It exists only under the FAR overhaul deviations; absent one, the live clauses are FAR 52.204-23, 52.204-25, 52.204-27, 52.204-30 and 52.240-1.
Alternates
Alt I · (DATE XXXX) — the model text placeholder was never filled in (unconfirmed)
RFO FAR 40.205(c): Federal Supply Schedules, Governmentwide acquisition contracts and multi-agency contracts; and where the program office or requiring activity instructs the contracting officer to select specific types of FASCSA orders.
Alternate I substitutes paragraph (e)(1) so the applicable supply chain orders are read off three checkboxes in the contract — Homeland Security, Defense, National Intelligence — instead of following the awarding agency; the inquiry and the 72-hour report are unchanged.
The 3 templates that name it, with the line
Source: acquisition.gov RFO model text, FAR 40.205, 40.201, 40.204-1 and 52.240-91 (basic and Alternate I), at /far-overhaul/far-part-deviation-guide/far-overhaul-part-40 and /far-overhaul-part-52; RFO model 52.244-6(b)(2) table; DoD Class Deviation 2026-O0025 memo and Revision 2 memo (acq.osd.mil/dpap/dars); codified FAR 40.202-8 and 52.240-1 for the contrast (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.