Final Contractor Basic Safeguarding Rule Issued

Yesterday, the Federal Acquisition Regulations (“FAR”) Council published the final FAR rule on Basic Safeguarding of Contractor Information Systems.1 The rule is intended to prescribe “the most basic level” of safeguards, “reflective of actions a prudent business person would employ.”

Applicability

The rule, which includes a new contract clause, will apply to all acquisitions by any federal executive agency, beginning June 15, 2016, when a contractor’s information system may contain “Federal contract information,” including acquisitions below the simplified acquisition threshold and for commercial items other than commercially available off-the-shelf (“COTS”) items.

A key factor in applying the new rule is whether a contractor’s information system contains “Federal contract information.” That term is defined intentionally broadly as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information by the Government to the public (such as that on public websites) or simple transaction information, such as that necessary to process payments.” The safeguarding requirements apply to all “covered contractor information systems,” namely, those information systems owned or operated by a contractor that process, store, or transmit Federal contract information.

The substance of the contract clause prescribed by the rule must be flowed down in all subcontracts, other than contracts for COTS items, in which the subcontractor may have Federal contract information residing in or transiting through its information systems.

Read more: Final Government Contractor Basic Data Security Rule Issued