Clauses · FAR · Cybersecurity
FAR 52.240-93 Basic Safeguarding of Covered Contractor Information Systems
Does the regulation require it to flow down?
Yes
Paragraph (c): 'The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products, other than commercially available off-the-shelf items, or commercial services), in which the subcontractor may have Federal contract information residing in or transiting through its information system.' No dollar threshold. The two conditions that limit it are the COTS exclusion and the factual question of whether FCI touches the supplier's system at all.
- Form
- substance, including paragraph (c) itself — self-perpetuating
- Reaches
- all tiers, through every supplier whose system may hold or carry Federal contract information
Checked against acquisition.gov on 2026-08-05 · edition No date designation has been issued — the model text reads '(Deviation Date)' (unconfirmed; read 2026-08-05). Exists only under deviation: for DoD, Class Deviation 2026-O0025, effective 2026-02-01, Revision 2 dated 2026-07-16. It is the RFO successor to 52.204-21 (NOV 2021). · base v0.9.3 Read the text ↗
What it makes you produce
One item for your checklist.
A program you have to be running
You are either running it or you are not, and what the prime asks for is the date it started.
- 52.240-93(b)(1)
Fifteen named controls running on any system of yours that holds or carries the buyer's contract information — access limits, authentication, media sanitization, boundary protection, timely patching and malware scanning
Owed when federal contract information resides in or transits your own information system; commercially available off-the-shelf work is outside the clause under 40.303-1
When it is used
RFO FAR 40.303-2: insert in solicitations and contracts when the contractor OR a subcontractor at any tier may have Federal contract information residing in or moving through its information system. RFO 40.303-1 sets the reach: all acquisitions, including commercial products and commercial services, OTHER THAN commercially available off-the-shelf items. No dollar threshold — micro-purchases included. Federal contract information is information not intended for public release, provided by or generated for the government under a contract to develop or deliver a product or service; it excludes public-website material and simple transactional information such as what is needed to process payments. Paragraph (b)(2) is explicit that this is a floor, not a ceiling: it does not relieve you of CUI requirements under EO 13556 or any other agency safeguarding requirement — for DoD that means DFARS 252.204-7012 and NIST SP 800-171 sit on top.
Read closely
Paragraph (b)(2) says out loud that this is a floor: it does not stand in for the controlled unclassified information requirements, which on DoD work are 252.204-7012's. There is no score and nothing to submit — the controls are contract terms. The number exists only under the class deviations DoD contracting officers have used since 2026-02-01; the codified clause is 52.204-21, and the deviation wording is printed in the overhaul's Part 52 model text rather than on the Part 40 page, which carries only the prescription at 40.303-2.
The 3 templates that name it, with the line
Source: acquisition.gov RFO model text, FAR 40.300, 40.301, 40.303-1, 40.303-2 and 52.240-93, at /far-overhaul/far-part-deviation-guide/far-overhaul-part-40 and /far-overhaul-part-52; RFO model 52.244-6(b)(2) table (absence confirmed); DoD Class Deviation 2026-O0025 Revision 2 (acq.osd.mil/dpap/dars); codified FAR 52.204-21 for the contrast (verified 2026-08-05)
This is research, not legal advice. It states what the regulation says about this clause and cites the paragraph behind it. It does not rule on your order, and it does not rule on whether a prime's markings are correct.