Federal Acquisition Circular 2005-99, issued June 15, contains two interim rules amending the Federal Acquisition Regulation. Item I—Use of Products and Services of Kaspersky Lab (FAR Case 2018-010) implements section 1634 of the National Defense Authorization Act for Fiscal Year 2018 (PL 115-91) and goes into effect on July 16, 2018. Item II—Violations of Arms Control Treaties or Agreements with the United States (FAR Case 2017-018) implements section 1290 of the NDAA FY 2017 (PL 114-328) and has a June 15, 2018, effective date. Comments on both interim rules are due by August 14, 2018. The FAC also contains a Small Entity Compliance Guide, which indicates that a regulatory flexibility analysis was prepared for each rule.
The FAR Case 2018-010 interim rule prohibits the government from using hardware, software, and services of Kaspersky Lab and its related entities beginning on or after October 1, 2018. The rule adds a new FAR Subpart 4.20, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab, consisting of FAR 4.2001, Definitions, FAR 4.2002, Prohibition, and FAR 4.2003, Notification. FAR 4.2004 prescribes the associated contract clause at FAR 52.204-23. This clause prohibits contractors from providing any hardware, software, or services developed or provided by Kaspersky Lab or its related entities, or using any such hardware, software, or services in the development of data or deliverables first produced in the performance of a contract. The contractor must also report any such hardware, software, or services discovered during contract performance.
Although this prohibition does not apply until October 1, 2018, agencies and contractors must begin to take steps immediately to meet this deadline. In this regard, covered articles include hardware, software, and services acquired before October 1, 2018, that the government will use on or that date. Because so many IT products and services are used for more than a few months, it is critical that contractors be placed on notice as soon as possible of this prohibition so that agencies can ensure that they comply with the law and avoid acquisitions of covered articles that the government will continue to use on or after October 1, 2018.
The interim rule in FAR Case 2017-018 prohibits contracting with entities involved in activities that violate arms control treaties or agreements with the United States. The rule adds a new section, FAR 9.109, to set forth the prohibition. FAR 9.109-1 provides the citation to the applicable statute (22 U.S.C. 2593e). Pursuant to FAR 9.109-2, contracting officers may not award, renew, or extend a contract for the procurement of products or services with an entity identified as excluded in the System for Award Management database on the basis of involvement in activities that violate U.S. arms control treaties or agreements. FAR 9.109-3 sets out the statutory exception from the contracting prohibition for the procurement of products or services along a major route of supply to a zone of active combat or a major contingency operation. FAR 9.109-4 requires an offeror certification and provides remedies for submission of a false certification. In addition, FAR 4.109-5 prescribes a new solicitation FAR 52. 209-13, for use in each solicitation for the acquisition of products or services (including construction) that exceeds the simplified acquisition threshold, other than solicitations for the acquisition of commercial items.
The implementation of this rule will protect against doing business with entities that engage in any activity that contributed to or is a significant factor in a country’s failure to comply with arms control treaties or agreements with the U.S. The government will not consider the offer of an offeror that has not provided the certification required by FAR 52.209-13, unless the offeror provides with its offer information that the President has waived application under 22 USC 2593e(d) or (e) or determined under 22 USC 2593e(g)(2) that the entity has ceased all activities for which measures were imposed under 22 USC 2593e(b).