Raytheon TC-003 — Supplement 2: Government Contract Provisions from the DFARS

Its 60 clauses can ask you for 117 things.

1. A program you have to be running14e.g. A purchasing process that goes to the original manufacturer or its authorized supplier first DFARS 252.246-7008(b)

   You are either running it or you are not, and what the prime asks for is the date it started.

   • The NIST SP 800-171 security requirements, in the version in effect when the solicitation was issued, running on every system of yours that holds or moves the covered information

     Owed when the system is your own — (b)(1) sends an information technology service operated on the Government's behalf to the contract's own terms instead

     252.204-7012(b)(2)(i)

   • A marking process and the equipment behind it, putting a MIL-STD-130 data matrix and human-readable text on every item the contract calls out

     DFARS 252.211-7003(c)

   • An estimating system that is reliable, consistently applied, and produces verifiable, supportable, documented and timely cost estimates

     DFARS 252.215-7002(b)

   Show 11 moreShow fewer

   • A plant run to DoD Manual 4145.26, the contractors' safety manual for ammunition and explosives — siting and quantity-distance, grounding, storage and training

     DFARS 252.223-7002(b)(1)

   • Physical security to DoD Manual 5100.76 for the listed arms, ammunition and explosives — approved storage, access control, inventory and controlled movement, as the statement of work specifies

     DFARS 252.223-7007(c)

   • Access controls that keep controlled technical data away from foreign persons, your own foreign employees included, and a license for anything that leaves the country

     DFARS 252.225-7048(b)

   • An earned value management system meeting the thirty-two ANSI/EIA-748 guidelines, producing timely, reliable and verifiable data for the contract performance report and the integrated master schedule

     DFARS 252.234-7002(b)

   • Administrative, technical and physical safeguards at the level the DoD Cloud Computing Security Requirements Guide sets

     Owed when cloud computing is used to provide information technology services in performing the order, unless the contracting officer notifies you that the DoD Chief Information Officer has waived it

     252.239-7010(b)(2)

   • Hosting that keeps Government data inside the United States or an outlying area

     Owed when the data is not physically located on DoD premises and no written notification from the contracting officer allows another location

     252.239-7010(b)(3)

   • A working practice for knowing who each information technology component came from, and being able to show that trail on demand

     DFARS 252.239-7018(b)

   • A material management and accounting system that forecasts material requirements, ties purchased and fabricated material cost to valid time-phased requirements, and costs material transactions on consistent, unbiased logic

     DFARS 252.242-7004(b)(1)

   • An acceptable property management system — records, receipt and identification, physical inventories, loss reporting, maintenance and disposition, to the criteria in FAR 52.245-1(b) and (f)

     DFARS 252.245-7003(b)

   • A documented counterfeit electronic part detection and avoidance program covering the twelve areas the clause lists — training, inspection and testing, traceability, quarantine, and reporting among them

     DFARS 252.246-7007(c)

   • A purchasing process that goes to the original manufacturer or its authorized supplier first, then to a supplier you have approved, and a documented route for the times neither is available

     DFARS 252.246-7008(b)
2. Something somebody else has to issue you17e.g. Mill certificates giving the country of melt for every specialty metal incorporated in the item DFARS 252.225-7009

   The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

   • The DoD fraud, waste and abuse hotline poster in effect at award — printed by the DoD Inspector General, displayed in the common work areas of the segments doing the work

     DFARS 252.203-7004(b)(1)(i)

   • The Homeland Security fraud hotline poster alongside it, printed by the DHS Inspector General

     Owed when the work is paid for in whole or in part with DHS disaster relief funds and performed in the United States

     DFARS 252.203-7004(b)(2)

   • A DoD-approved medium assurance certificate, bought from an outside certificate authority

     Owed when an incident has to be reported — the certificate is what the reporting channel authenticates against, so it is held before the incident rather than obtained after it

     252.204-7012(c)(3)

   Show 12 moreShow fewer

   • A cloud service provider meeting security requirements equivalent to the FedRAMP Moderate baseline, and complying with (c) through (g) on reporting and forensics

     Owed when covered information sits on a cloud service you did not build — the paragraph reaches an external provider only

     252.204-7012(b)(2)(ii)(D)

   • Country-of-origin statements from the suppliers of those components — the origin is fixed at their plant, and the prime asking for them sets what is enough

     DFARS 252.225-7001

   • A mill certificate naming the country where the metal was melted or produced, from the mill or the service center that sold it — evidence the prime weighs, not paper the clause names

     DFARS 252.225-7008

   • Mill certificates giving the country of melt for every specialty metal incorporated in the item, gathered back through the bill of material — evidence the prime weighs, not paper the clause names

     DFARS 252.225-7009

   • Origin statements for the fiber, yarn, fabric or food ingredient in what you supply, from whoever grew, spun, wove or processed it — evidence the prime weighs, not paper the clause names

     DFARS 252.225-7012

   • An origin declaration from the bearing maker or distributor covering where the bearing was manufactured and the cost share of its components — a datasheet does not say where the ring was forged, and the prime asking for it sets what is enough

     DFARS 252.225-7016

   • A letter of authorization generated from that system and signed by the contracting officer, which is what gets a person into theater and onto meals, transport and medical support

     DFARS 252.225-7040(c)

   • The preliminary personnel requirements (e) lists as one set — clearances, medical, dental and psychological fitness, required immunizations, theater-specific qualifications, passports and visas, and the training the paragraph names

     DFARS 252.225-7040(e)

   • An origin declaration from the supplier of each covered material — samarium-cobalt and neodymium-iron-boron magnets, tantalum, tungsten powder, and tungsten heavy alloy — naming where it was melted or produced, and the prime asking for it sets what is enough

     DFARS 252.225-7052

   • A license from the owner of any copyrighted material built into a deliverable, obtained for the Government, plus written approval and a statement of the license on the transmittal

     Owed when copyrighted material you do not own is going into technical data you will deliver

     252.227-7013(e)

   • A license from the owner of any copyrighted software or documentation you did not write, obtained for the Government before delivery

     Owed when third-party copyrighted software or documentation is going into what you will deliver

     252.227-7014(e)

   • A license from the owner of any third-party copyrighted data or software you are building in, obtained for the Government before delivery

     Owed when copyrighted material you do not own is going into a deliverable

     252.227-7018(e)

   and 2 more, each on its clause's page

3. A state you have to be in, in a government system4e.g. Registration with the Department of State under the ITAR DFARS 252.225-7048(b)

   The record has to be posted before the prime can see it, and posting is not the same day as being ready.

   • An account in the Government's electronic submission system, with each item's record posted through it into the item unique identification registry

     DFARS 252.211-7003(f)

   • Every deployed person entered in the Synchronized Predeployment and Operational Tracker, with the record kept current for the whole deployment

     DFARS 252.225-7040(g)

   • Registration with the Department of State under the ITAR, which the clause names in its own words, for a shop that manufactures or exports defense articles

     DFARS 252.225-7048(b)

   Show 1 moreShow fewer

   • An authorized radio frequency allocation for the device, which is what lets it be tested or operated at all

     DFARS 252.235-7003(a)
4. Something you write51e.g. Every drawing 252.227-7013(g)(1)

   Days to weeks, and nobody outside your company has to agree to it.

   • A subcontracting plan with separate dollar and percentage goals by category — small, veteran-owned, service-disabled veteran-owned, HUBZone, small disadvantaged and women-owned small business concerns — and the other items paragraph (d) enumerates

     FAR 52.219-9(d)

   • A written notice to employees, in the language most of the workforce speaks, of their whistleblower rights under 10 U.S.C. 4701

     DFARS 252.203-7002(a)

   • A written request naming the information, the medium and the purpose, filed with the buyer at least 10 business days before the planned release

     DFARS 252.204-7000(b)

   Show 12 moreShow fewer

   • A system security plan for each of those systems, and a plan of action for the requirements not yet in place

     Owed when the same systems (b)(2)(i) reaches — the plan and the plans of action are named by NIST SP 800-171 itself rather than by the clause's own words

     252.204-7012(b)(2)(i)

   • A written request to vary from a security requirement, for a DoD Chief Information Officer representative to adjudicate

     Owed when a NIST SP 800-171 requirement is not implemented and you are asking to vary from it

     252.204-7012(b)(2)(ii)(B)

   • A copy of an approval you already hold, provided when you ask for that earlier adjudication to be recognized on this order

     Owed when a DoD Chief Information Officer representative has already ruled that a requirement is not applicable to you, or that an alternative measure is equally effective

     252.204-7012(b)(2)(ii)(C)

   • A written disclosure of the estimating system to the administrative contracting officer

     Owed where paragraph (c) reaches you — it applies paragraphs (d) and (e) only to a large business meeting one of the two further tests in that paragraph

     DFARS 252.215-7002(d)(1)

   • A written request for exception in place of certified cost or pricing data

     DFARS 252.215-7010(b)(1)

   • Certified cost or pricing data and supporting attachments prepared in the FAR Table 15-2 format

     DFARS 252.215-7010(c)(1)

   • Uncertified cost data in the form your accounting regularly maintains it

     Owed where uncertified data is what the acquisition calls for, rather than certified data under paragraph (c)

     DFARS 252.215-7010(d)(2)

   • A written notice to the administrative contracting officer naming the firm that took the place of a small business named in the plan

     Owed when a small business concern named in the subcontracting plan is replaced by a firm that is other than small

     DFARS 252.219-7003(e)

   • A hazard warning label on the unit container of every hazardous item shipped, in the form the OSHA Hazard Communication Standard sets at 29 CFR 1910.1200

     DFARS 252.223-7001(b)

   • A copy of the hazard warning label itself, sent before award with the safety data sheet

     Owed by the apparently successful offeror, for every hazardous material not listed at (c)

     DFARS 252.223-7001(d)

   • Immediate notice to the contracting officer — the fastest clock in this clause

     Owed as soon as a mishap involving ammunition or explosives occurs

     DFARS 252.223-7002(d)(1)

   • A written report to the contracting officer, with the investigation (d)(2) requires behind it

     Owed after the same mishap, once the investigation the contract or the contracting officer calls for is under way

     DFARS 252.223-7002(d)(3)

   and 36 more, each on its clause's page

5. Something you fill in and send back17e.g. A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident 252.204-7012(c)(1)(ii)

   Hours, once you know which one is missing.

   • The Individual Subcontract Report and the Summary Subcontract Report, filed through the electronic subcontracting reporting system

     FAR 52.219-9(d)(10)

   • A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident

     Owed when an incident affecting a covered system, the covered information on it, or your ability to perform the order is discovered

     252.204-7012(c)(1)(ii)

   • A Certificate of Current Cost or Pricing Data as prescribed by FAR 15.406-2

     DFARS 252.215-7010(c)(2)

   Show 12 moreShow fewer

   • The Individual Subcontract Report and the Summary Subcontract Report, filed through the electronic subcontracting reporting system

     DFARS 252.219-7003(f)

   • The list, filled in at offer, of which hazardous materials will instead be labeled under the pesticide, food and drug, consumer product, hazardous substances or alcohol statutes

     DFARS 252.223-7001(c)

   • The place of performance for all ammunition and explosives work, written into the Place of Performance provision at offer

     DFARS 252.223-7003(a)

   • The customs entry forms, completed and submitted to the District Director of Customs with a copy to the DCMA St. Louis Duty Free Entry Team, which executes the duty-free entry certificates

     Owed when the shipment is not consigned directly to a military installation — those are released under sections 10.101 and 10.102 of the Customs regulations instead

     DFARS 252.225-7013(f)(1)(i)

   • A request for the incentive payment, 5 percent of the estimated cost, target cost or fixed price of the subcontract

     Owed when you place a subcontract with an Indian organization, an Indian-owned economic enterprise or a Native Hawaiian small business concern, and program funds are available

     DFARS 252.226-7001(f)

   • A written representation of eligibility, which the buyer may rely on in good faith unless an interested party challenges the status

     Owed when you are yourself an Indian organization, an Indian-owned economic enterprise or a Native Hawaiian small business concern

     DFARS 252.226-7001(c)

   • The attachment listing the technical data you will hand over with restrictions on it

     Owed when you intend to deliver technical data with a restrictive marking — nothing may be delivered marked unless it is on that list, and (f)(3) is the route for an assertion found after award

     252.227-7013(f)(2)

   • The attachment listing the software and documentation you will hand over with restrictions on it

     Owed when you intend to deliver software with a restrictive marking — nothing may be delivered marked unless it is on that list

     252.227-7014(f)(2)

   • The assertions table, signed by someone who can bind the company: what will be delivered with restrictions, the basis for each, the rights category asserted and who is asserting it — your suppliers' assertions as well as your own

     Owed when the contract will require delivery of technical data or software with less than unlimited rights, to the extent known when the offer goes in

     252.227-7017(d)

   • The attachment identifying what will be delivered with restrictions on use, release or disclosure

     Owed when you intend to deliver with a restrictive marking — nothing carries a marking it is not listed for

     252.227-7018(f)

   • The nondisclosure agreement at DFARS 227.7103-7, completed and signed before the marked data reaches them

     Owed when you pass Government-furnished data carrying a government purpose rights legend, or a specially negotiated legend under (b)(3), to a supplier or prospective supplier

     252.227-7025(b)(2)

   • An attachment to the offer identifying that data — the contract it was produced under, who received it most recently, and the limits on the Government's rights, including the earliest date any limitation expires

     Owed when you intend to deliver data or software with less than unlimited rights that is identical or substantially similar to something already produced for or delivered to the Government

     DFARS 252.227-7028

   and 2 more, each on its clause's page

6. Nothing to send now14They are terms that decide what money moves later, rules you follow while you work or numbers with no text behind them.