Most contractors know about Section 889, the prohibition on certain Chinese telecommunications and video surveillance equipment and services. Fewer know that it sits alongside several other technology-related prohibitions in federal contracts, each with its own clause and its own obligations. A mid-year review of your representations is a good time to understand all of them. This is general information; the clause texts control, and a lawyer can advise on your situation.
Kaspersky Lab products and services
A provision of the National Defense Authorization Act for Fiscal Year 2018 prohibits the federal government from using hardware, software or services developed or provided, in whole or in part, by Kaspersky Lab, its successors and certain related entities. The FAR implements the prohibition with a clause that bars contractors from providing such products or services under the contract and from using them in developing data or deliverables first produced in performing it. Contractors that identify a covered product during performance, or are notified of one, must report it within short deadlines set in the clause, along with the steps taken to mitigate it.
The practical step is an inventory: security software, antivirus tools and embedded components in products you sell or use on government work.
The ByteDance covered application
A 2022 statute directed the removal of TikTok, and any successor application or service developed or provided by ByteDance or an entity it owns, from federal information technology. The FAR clause implementing it prohibits contractors from having or using the covered application on information technology used or provided under the contract, which can include equipment provided by the contractor’s employees, unless an exception is granted. Firms that let employees use personal phones or laptops for contract work should review their policies with this clause in mind. Because corporate structures can change, rely on the clause’s current definition and any agency guidance rather than on headlines.
FASCSA orders
The Federal Acquisition Supply Chain Security Act of 2018 created the Federal Acquisition Security Council and a process for issuing orders that require the exclusion or removal of specific sources or covered articles from federal supply chains. These are known as FASCSA orders. Orders can apply to particular agencies or more broadly, and each describes its own scope. FAR provisions and clauses require offerors to represent whether they will provide covered articles subject to applicable orders, and require contractors to check for applicable orders in SAM.gov, avoid providing or using covered items subject to them, report any they identify and flow the requirement down. Because orders can be issued at any time, the clause calls for periodic review during performance, not just a check at award.
Building one supply chain review
These rules overlap in practice, so many firms handle them together:
- Maintain an inventory of hardware, software, cloud services and mobile applications used on government work.
- Ask suppliers and service providers for written representations covering Section 889, Kaspersky and FASCSA orders.
- Set a recurring reminder to check SAM.gov for new FASCSA orders.
- Update device and application policies for any equipment used on contracts, including personal devices.
- Confirm that each clause appears in your subcontracts where required.
- Record what you checked and when, so you can show a reasonable inquiry.
The provisions and clauses are in FAR Part 4 at acquisition.gov, and FASCSA orders are posted on sam.gov.