FAR 8.608—Protection of classified and sensitive information.
Plain-English Summary
FAR 8.608 restricts agencies from awarding contracts with Federal Prison Industries (FPI) that would let inmate workers access certain protected information. The section covers three categories of information: classified data; geographic data showing the location of critical infrastructure and utilities, including communications, water, electrical power distribution, pipelines, and other utilities; and personal or financial information about private citizens, including information about a person’s real property, unless the individual has given prior consent. Its purpose is to prevent security, privacy, and infrastructure-risk exposures that could result from inmate access to sensitive government or private-sector information. In practice, this means agencies must screen proposed FPI work carefully before award and ensure contract requirements do not create access paths to protected data. Contractors and agency personnel working with FPI must understand that the restriction is categorical: if inmate workers would have access to these protected categories, the contract may not be entered into as written. The rule is especially important for information security, critical infrastructure protection, and privacy compliance in procurement planning and contract administration.
Key Rules
No inmate access to classified data
Agencies may not enter into an FPI contract that allows inmate workers access to classified data. This is an absolute prohibition and requires agencies to structure the work so classified information is not exposed to inmate personnel.
No access to critical infrastructure locations
Agencies may not use an FPI contract that gives inmate workers geographic data about the location of communications, water, or electrical distribution infrastructure, pipelines, or other utilities. The rule is aimed at preventing disclosure of information that could be used to disrupt essential services.
No access to private citizen information
Agencies may not enter into an FPI contract that allows inmate workers access to personal or financial information about any private citizen, including information relating to that person’s real property, unless the individual has given prior consent. This protects privacy and limits disclosure of sensitive personal data.
Prior consent exception
For personal or financial information about a private citizen, access may be permitted only if the individual has provided prior consent. Agencies must be able to document that consent before allowing any such access under an FPI contract.
Applies at contract formation
The restriction is on entering into the contract itself, not just on later performance. Agencies must evaluate the scope of work and data access before award to ensure the contract does not authorize prohibited inmate access.
Responsibilities
Agency
Must review proposed FPI contracts to ensure inmate workers will not have access to classified data, protected infrastructure-location data, or private citizen personal or financial information without prior consent. The agency must structure the contract and performance controls to avoid prohibited access.
Contracting Officer
Must not award or enter into an FPI contract that would permit prohibited inmate access. The contracting officer must verify the work requirements, data handling arrangements, and any consent documentation before proceeding.
Federal Prison Industries (FPI)
Must perform only work that does not expose inmate workers to the prohibited categories of information, and must ensure its operations and staffing arrangements comply with the contract’s access limitations.
Inmate Worker
May not be given access to classified data, protected infrastructure-location data, or private citizen personal or financial information unless the limited consent-based exception applies to the personal/financial information category.
Individual Private Citizen
May provide prior consent if access to personal or financial information is otherwise necessary under the contract; without consent, the information must remain off-limits to inmate workers.
Practical Implications
Agencies need to screen FPI requirements early, because the restriction can make certain data-processing or records-handling tasks unsuitable for FPI performance.
A common pitfall is overlooking indirect access, such as inmate workers handling files, databases, maps, or documents that contain protected information even if the contract does not expressly call for it.
For personal or financial information, agencies should not rely on informal permission; they need clear, prior consent from the individual and a record showing that consent exists.
Contracts involving utilities, pipelines, or infrastructure mapping require special attention because geographic data alone can create a prohibited access issue even when the work seems administrative.
If prohibited information is present in the work environment, agencies should consider segregation, redaction, or alternative performance arrangements rather than assuming FPI can perform with unrestricted access.
Official Regulatory Text
Agencies shall not enter into any contract with FPI that allows an inmate worker access to any- (a) Classified data; (b) Geographic data regarding the location of- (1) Surface and subsurface infrastructure providing communications or water or electrical power distribution; (2) Pipelines for the distribution of natural gas, bulk petroleum products, or other commodities; or (3) Other utilities; or (c) Personal or financial information about any individual private citizen, including information relating to such person’s real property however described, without the prior consent of the individual.