FAR 52.204-23—Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities.

Broad definition of covered articles

A Kaspersky Lab covered article includes hardware, software, or services developed or provided by a Kaspersky Lab covered entity, including items developed in whole or in part by such an entity and items containing components using Kaspersky-developed hardware or software. This definition is intentionally broad, so contractors must look beyond the brand name and evaluate upstream development and component sourcing.

Covered entities include affiliates and successors

A Kaspersky Lab covered entity is not limited to Kaspersky Lab itself. It also includes successors, renamed entities, entities under common control, and entities in which Kaspersky Lab has majority ownership, so contractors must assess corporate relationships, not just product labels.

No provision for Government use

The contractor may not provide any Kaspersky Lab covered article that the Government will use on or after October 1, 2018. This is a direct prohibition on delivering covered items into Government use, regardless of whether the contractor intended the item for a different purpose.

No use in first-produced deliverables

The contractor may not use any Kaspersky Lab covered article on or after October 1, 2018, in developing data or deliverables first produced in performance of the contract. This means the restriction applies to the contractor’s internal development environment and not only to final delivered products.

Mandatory reporting upon identification

If the contractor identifies a covered article provided to the Government during performance, or is notified by a subcontractor or other source, it must report the issue in writing to the Contracting Officer or, for DoD, through DIBNet. The reporting duty is triggered by identification or notice, not by proof of actual harm.

Short reporting deadlines and required details

Within 3 business days, the contractor must report the contract and order numbers, supplier name, brand, model number, item description, and any readily available mitigation information. Within 10 business days after that report, the contractor must provide additional mitigation details and explain how the issue occurred and what preventive steps will be added.

Flowdown to all subcontracts

The contractor must insert the substance of the clause, including the subcontract paragraph, in all subcontracts, including subcontracts for commercial products and commercial services. This makes subcontractor compliance part of the prime contractor’s supply-chain management responsibility.

Contracting Officer

Ensure the clause is included when prescribed, receive contractor reports for non-DoD contracts, and coordinate any follow-up actions needed to address identified Kaspersky Lab covered articles during performance.

Department of Defense reporting channel (DIBNet)

Receive contractor reports for DoD contracts when a Kaspersky Lab covered article is identified, including identification of the affected contract and orders.

Contractor

Do not provide Kaspersky Lab covered articles for Government use, do not use them in developing first-produced data or deliverables, monitor performance for potential covered articles, report any identified or notified covered article within the required timeframes, provide required mitigation and explanatory information, and flow the clause down to all subcontracts.

Subcontractors

Comply with the flowed-down prohibition and reporting obligations, and promptly notify the prime contractor if a covered article is identified or suspected in the subcontract supply chain.

Agency / Government user

Avoid using covered articles in Government systems and support remediation if a contractor report reveals that a prohibited article was provided or used.