FAR_52.20423.pdf

52.204–23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities. As prescribed in 4.2004, insert the following clause: Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (a) Definitions. As used in this clause— Covered article means any hardware, software, or service that— (1) Is developed or provided by a covered entity; (2) Includes any hardware, software, or service developed or provided in whole or in part by a covered entity; or (3) Contains components using any hardware or software developed in whole or in part by a covered entity. Covered entity means— (1) Kaspersky Lab; (2) Any successor entity to Kaspersky Lab; (3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (4) Any entity of which Kaspersky Lab has a majority ownership. (b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year 2018 (Pub. L. 115–91) prohibits Government use of any covered article. The Contractor is prohibited from— (1) Providing any covered article that the Government will use on or after October 1, 2018;

and (2) Using any covered article on or after October 1, 2018, in the development of data or deliverables first produced in the performance of the contract. (c) Reporting requirement. (1) In the event the Contractor identifies a covered article provided to the Government during contract performance, or the Contractor is notified of such by a subcontractor at any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in the case of the Department of Defense, to the website at https://dibnet.dod.mil. For indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of Defense, identify both the indefinite delivery contract and any affected orders in the report provided at https://dibnet.dod.mil. (2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause: (i) Within 1 business day from the date of such identification or notification: The contract number;

the order number(s), if applicable; supplier name; brand; model number (Original Equipment Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description; and any readily available information about mitigation actions undertaken or recommended. (ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: Any further available information about mitigation actions undertaken or recommended. In addition, the Contractor shall describe the efforts it undertook to prevent use or submission of a covered article, any reasons that led to the use or submission of the covered article, and any additional efforts that will be incorporated to prevent future use or submission of covered articles. (d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts, including subcontracts for the acquisition of commercial items. (End of clause) https://dibnet.dod.mil/ https://dibnet.dod.mil/