Clauses · FAR · Cybersecurity
FAR 52.240-92 Security Requirements
Does the regulation require it to flow down?
Yes
Paragraph (d) requires it in all subcontracts under the contract that involve access to classified information. The exclusion of the Changes-clause reference is the point: at prime level, a government-directed change in classification level or security requirements is compensable through an equitable adjustment under (c); the mandated subcontract version strips that cross-reference, so the sub does not automatically get the same adjustment mechanism. Paragraph (e) adds a separate duty: every cleared subcontractor must be identified with a CAGE code on the DD Form 254, one unique CAGE per performance location listed (or the agency location code where work is at a government facility), the CAGE must be in place before award, and the prime must keep subcontractor CAGE codes current for the life of the contract.
- Form
- substance — 'terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause'
- Reaches
- all tiers, through every subcontract that involves access to classified information
Checked against acquisition.gov on 2026-08-05 · edition No date designation has been issued — the model text reads '(Deviation Date)' for the basic clause and for both alternates (unconfirmed; read 2026-08-05). Exists only under deviation: for DoD, Class Deviation 2026-O0025, effective 2026-02-01, Revision 2 dated 2026-07-16. It is the RFO successor to 52.204-2 (MAR 2021). · base v0.9.3 Read the text ↗
What it makes you produce
3 items for your checklist, slowest first.
A program you have to be running
You are either running it or you are not, and what the prime asks for is the date it started.
- 52.240-92(b)(1)
The security program the operating manual at 32 CFR part 117 requires — a facility security officer, cleared people, storage, marking, transmission and reporting
Owed when the same access (a) limits the clause to, and it follows any revision of the manual you are given notice of
A state you have to be in, in a government system2
The record has to be posted before the prime can see it, and posting is not the same day as being ready.
- 52.240-92(b)(1)
A facility clearance under the National Industrial Security Program, carried by a signed DD Form 441 security agreement
Owed when the order actually involves access to information classified Confidential, Secret or Top Secret — paragraph (a) limits the clause to that extent
- 52.240-92(e)
A CAGE code for each location where you will perform, given with your name and location address
Owed when you need access to classified information under the order — the code is required prior to award, one for each performance location listed on the DD Form 254, or the agency location code where the work is at a Government facility
When it is used
RFO FAR 40.302-3(a): in solicitations and contracts when the contract MAY require access to classified information. Paragraph (a) is self-limiting — the clause 'applies to the extent that this contract involves access to information classified Confidential, Secret, or Top Secret' — so unclassified work gives it nothing to reach even when a template flows it. Alternate I (40.302-3(b)) for a cost contract for research and development with an educational institution; Alternate II (40.302-3(c)) for a construction or architect-engineer contract where employee identification is required for security reasons. The program it implements is the National Industrial Security Program under EO 12829, operating through the NISPOM at 32 CFR part 117 and DoD Manual 5220.22 Volume 2 (RFO 40.302-1).
Read closely
Paragraph (e) is new against 52.204-2 and it can hold an award on its own, because the code has to exist before award and stay alive for the life of the contract. Paragraph (c) prices a Government change in classification as an equitable adjustment and (d) strips the Changes reference from the version that reaches a subcontract. The number exists only under the class deviations DoD contracting officers have used since 2026-02-01; the codified clause is 52.204-2, and the deviation wording is printed in the overhaul's Part 52 model text rather than on the Part 40 page, which carries only the prescription at 40.302-3.
Alternates
Alt I · (Deviation Date) — placeholder never filled in (unconfirmed)
RFO FAR 40.302-3(b): a cost contract for research and development with an educational institution.
Alternate I adds paragraphs (f) to (h), and (f)(2) produces paper the basic clause does not: a written notice to the contracting officer that performance is not practical at the raised classification, with everything still safeguarded while it is worked through.
Alt II · (Deviation Date) — placeholder never filled in (unconfirmed)
RFO FAR 40.302-3(c): a construction or architect-engineer contract where employee identification is required for security or other reasons.
Alternate II adds paragraph (f), and with it two things nobody produces under the basic clause: identification furnished to and displayed by each employee on the work, and fingerprints of everyone employed on the project when the contracting officer requires them.
The 3 templates that name it, with the line
Source: acquisition.gov RFO model text, FAR 40.302-1, 40.302-2, 40.302-3 and 52.240-92 (basic, Alternate I, Alternate II), at /far-overhaul/far-part-deviation-guide/far-overhaul-part-40 and /far-overhaul-part-52; RFO model 52.244-6(b)(2) table; DoD Class Deviation 2026-O0025 Revision 2 (acq.osd.mil/dpap/dars); codified FAR 52.204-2 for the contrast (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.