Jump to content

FAR 52.204-21


dak9204

Recommended Posts

I did a search of the forums on discussions of FAR 52.204-21, but did not find an answer to my specific question, so here goes.

FAR 52.204-21(c) states that "The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial items, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system."

Accordingly, a prime contractor does not need to flow down FAR 52.204-21 to a subcontractor of COTS items. 

However, in regards to the prime contract, FAR 4.1903 states that "The contracting officer shall insert the clause at 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal contract information residing in or transiting through its information system."  There is no exemption for a prime contractor that sells a COTS item.

Hopefully the answer isn't obvious, but can anyone reconcile this discrepancy?

Link to comment
Share on other sites

I don't see a discrepancy.  You may be conflating prime contracts and subcontracts.

PRESCRIPTION FOR PRIME CONTRACTS

FAR 4.1903 says the contracting officer shall insert the clause at 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal contract information residing in or transiting through its information system.

·       If you’re awarding a contract covered by FAR Subpart 4.19, you follow those instructions for the award of the prime contract – you include the clause in the solicitation and the contract.

·       However, if you’re awarding a contract for commercial items, then FAR 12.301(d) trumps 4.1903, and you follow the instructions at 12.301(d)(3) – you include the clause in the solicitation and contract except for acquisitions of COTS items.

PRESCRIPTION FOR SUBCONTRACTS

Para. (c) of the clause at FAR 52.204-21 gives instructions for including the clause in subcontracts.

Edited by ji20874
changed FAR 12.302 to 12.301
Link to comment
Share on other sites

3 minutes ago, ji20874 said:

I don't see a discrepancy.  You may be conflating prime contracts and subcontracts.

PRESCRIPTION FOR PRIME CONTRACTS

FAR 4.1903 says the contracting officer shall insert the clause at 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal contract information residing in or transiting through its information system.

·       If you’re awarding a contract covered by FAR Subpart 4.19, you follow those instructions for the award of the prime contract – you include the clause in the solicitation and the contract.

·       However, if you’re awarding a contract for commercial items, then FAR 12.302(d) trumps 4.1903, and you follow the instructions at 12.302(d)(3) – you include the clause in the solicitation and contract except for acquisitions of COTS items.

PRESCRIPTION FOR SUBCONTRACTS

Para. (c) of the clause at FAR 52.204-21 gives instructions for including the clause in subcontracts.

Maybe I missed it, but how does FAR 12.302(d) apply?  There doesn't appear to be a FAR 12.302(d)(3).

In regards to FAR Subpart 4.19, I'm still not clear why it doesn't contain a COTS exemption in the same way as FAR 52.204-21(c).  Why would there be a COTS exemption for subcontracts, but not a COTS exemption for prime contracts?

Link to comment
Share on other sites

As a follow on question, even where FAR 52.204-21 is included in a prime contract or subcontract for a "commercial item," could an argument be made that it still would not apply?

The clause states that Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

FAR 52.204-21 could be read that the FCI must be necessary to develop or deliver a product or service to the Government.  If a company already sells access to an information system to its commercial customers, this means that any information provided by the government might never qualify as FCI because it's not necessary to deliver that service to the government.

I'm aware that FAR 52.204-21 represents a baseline set of security controls, and government customers are free to impose additional controls (e.g., NIST SP 800-171 for CUI; NIST SP 800-53 r4 for FISMA High, etc....)  However, it would seem that a government customer could be in for a rude awakening if it relies only on FAR 52.204-21 in the acquisition of a commercial item.

Link to comment
Share on other sites

Guest Vern Edwards
1 hour ago, dak9204 said:

FAR 52.204-21 could be read that the FCI must be necessary to develop or deliver a product or service to the Government. 

No, it couldn't, because the plain language of the clause doesn't say that. The word "necessary" appears in that clause only once and only in connection with "simple transactional information".

If you disagree, then explain how you would justify your inferential interpretation in court.

Link to comment
Share on other sites

14 hours ago, Vern Edwards said:

No, it couldn't, because the plain language of the clause doesn't say that. The word "necessary" appears in that clause only once and only in connection with "simple transactional information".

If you disagree, then explain how you would justify your inferential interpretation in court.

Vern,

Thanks for your reply.  I've found your answers to numerous questions to be very helpful over the years.

I see your point about implying the word "necessary" in the first part of the definition of FCI.  Unfortunately, I've seen several COs insist on including FAR 52.204-21 in prime contracts because they are unaware (or ignore) the COTS exemption, and commercial sales organizations will simply agree in order to close a deal.  My question was in this context and if the clause could be deemed self-deleting if improperly included by a CO.

Link to comment
Share on other sites

Guest Vern Edwards
2 hours ago, dak9204 said:

Unfortunately, I've seen several COs insist on including FAR 52.204-21 in prime contracts because they are unaware (or ignore) the COTS exemption, and commercial sales organizations will simply agree in order to close a deal. 

I don't understand. See the clause prescription in FAR 4.1903:

Quote

The contracting officer shall insert the clause at 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal contract information residing in or transiting through its information system.

Emphasis added. The COTS exemption does not affect a CO's determination whether to include FAR 52.204-21 in a prime contract. If the (prime) contractor or any subcontractor may have Federal contract information in or passing through its system, then the CO "shall' (must) include the clause in the prime contract. The CO has no choice. But the prime contractor must determine whether the COTS exemption applies to its subcontractors before flowing the clause down.

If the CO includes the clause even though neither the prime nor any sub will have Federal contract information in or passing through its system, then the clause will be inoperative.

Link to comment
Share on other sites

Vern,

I think dak9204 is referring to FAR 12.301(d)(3) which reads:

Quote

Insert the clause at 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, in solicitations and contracts (except for acquisition of COTS items), as prescribed in 4.1903.

dak9204 should have provided that reference when he/she made the statement.

Link to comment
Share on other sites

  • 3 weeks later...

Quick follow up to this thread.  Could anyone point me in the direction of a court decision or FAR Council notice about contracting officers including clauses that should not have been included in a prime contract?  Specifically, what remedy (or argument) could be made if a contracting officer included FAR 52.204-21 in a contract for the sale of COTS products/services?

I found the following Wifcon thread on the concept of self-deleting FAR clauses:

 

 

 

Link to comment
Share on other sites

4 hours ago, dak9204 said:

Could anyone point me in the direction of a court decision or FAR Council notice about contracting officers including clauses that should not have been included in a prime contract? 

Sorry I can not.

4 hours ago, dak9204 said:

Specifically, what remedy (or argument) could be made if a contracting officer included FAR 52.204-21 in a contract for the sale of COTS products/services?

Argument would be the prescription in the FAR for use of the clause and its applicability to the contract or not.  Remedy would be a supplemental agreement to the contract removing or retaining the clause as applicable.  The latter based on the ideal that both parties agreed to the contract and therefore the CO and contractor agreed to its inclusion.   If there is disagreement as to its inclusion now then seek the remedy based on the argument.

Link to comment
Share on other sites

Guest Vern Edwards
6 hours ago, dak9204 said:

Could anyone point me in the direction of a court decision or FAR Council notice about contracting officers including clauses that should not have been included in a prime contract? 

Yes. See, for example, Johnson Management Group GFC, Inc. v. Martinez, 308 F.3d 1245 (Fed. Cir. 2002) (CO not authorized to include special clause); Charles Beseler Co., ASBCA 22669, 78-2 BCA ¶ 13,483 (CO improperly included clause prohibited by regulation); and Guard-All of America, ASBCA 22167, 80-2 BCA ¶ 14462 (CO arbitrarily, capriciously, and by abuse of discretion included short-form termination clause). There are several such decisions.

Link to comment
Share on other sites

Thank you.  A quick Google search for the Beseler decision turned up some relevant DoD materials, an excerpt of which is below:

http://www.dtic.mil/dtic/tr/fulltext/u2/a469274.pdf

Clauses included in a contract in violation of statutory or regulatory criteria will be read out of a contract. Carrier Corp., GSBCA No. 8516, 90-1 BCA ¶ 22,409; Charles Beseler Co., ASBCA No. 22669, 78-2 BCA ¶ 13,483 (where contracting officer acts beyond scope of actual authority, Government not bound by his acts)

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
×
×
  • Create New...