I did a search of the forums on discussions of FAR 52.204-21, but did not find an answer to my specific question, so here goes.
FAR 52.204-21(c) states that "The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system."
Accordingly, a prime contractor does not need to flow down FAR 52.204-21 to a subcontractor of COTS items.
However, in regards to the prime contract, FAR 4.1903 states that "The contracting officer shall insert the clause at 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal contract information residing in or transiting through its information system." There is no exemption for a prime contractor that sells a COTS item.
Hopefully the answer isn't obvious, but can anyone reconcile this discrepancy?