Cybersecurity programs and policy

Featured announcements

Implementation of Federal Acquisition Supply Chain Security Act Orders

• The Federal Register published this interim rule effective December 4, 2023. The rule applies prospectively, and when a contracting officer modifies an existing contract to include the new clause.
• FAR case 2020-011 implements section 1323 of the SECURE Technology Act, which created the Federal Acquisition Security Council, or FASC, and authorized the Secretary of Homeland Security, the Secretary of Defense, and the Director of National Intelligence to issue removal orders and exclusion orders.
• You can submit comments directly in Regulations.gov up to February 5, 2024, to potentially influence the final publication of this FAR rule.
• This message [PDF - 408 KB] to our industry partners includes a quick guide on GSA’s implementation plan.
• There are currently no outstanding FASCSA orders that need to be implemented.
• Most FASCSA orders will be viewable on SAM.gov. There are currently no FASCSA orders to view on SAM.gov. To learn how to download the FASCSA orders file, watch this short training video or read this knowledge article.​​
• Send your questions about the operation of the FASC to fasc.pmo@omb.eop.gov.

Partial implementation of Executive Order 14028

• The Federal Register published two proposed cybersecurity FAR rules.
  • Cyber Threat Incident Reporting and Information Sharing: FAR case 2021-017 is proposed to amend the FAR to increase the sharing of information about cyber threats and incident information between the government and information technology and operational technology service providers.
  • Standardizing Cybersecurity Requirements for Unclassified Federal Information Systems: FAR case 2021-019 is proposed to amend the FAR to standardize cybersecurity contractual requirements across federal agencies for unclassified federal information systems.

Implementation of the No TikTok on Government Devices Act

• FAR 52.204-27, established by a FAR interim rule on June 2, prohibits the presence or use of TikTok as well as any successor application or service developed by ByteDance Limited or an entity owned by ByteDance Limited on executive agency IT, including certain equipment used by federal contractors.
• This clause is included in solicitations issued, and in awards made, on or after June 2. Existing indefinite delivery vehicles had the clause added via modification by July 3.
• All other contracts and orders will have the clause added if a modification is executed to extend the period of performance.