48 CFR 839.106-70 - 839.106-70 Information security and privacy contract clauses.

Regulations last checked for updates: Feb 16, 2025

Title 48 - Federal Acquisition Regulations System last revised: Oct 18, 2025

View all text of Subpart 839.1 [839.101 - 839.106-70]

839.106-70 - 839.106-70 Information security and privacy contract clauses.

(a) Contracting officers shall insert the clause at 852.239-70, Security Requirements for Information Technology Resources, and the clause at 852.239-71, Information System Security Plan and Accreditation, in all solicitations, contracts, and orders exceeding the micro-purchase threshold that include information technology services.

(b) Contracting officers shall insert the clause at 852.239-72, Information System Design and Development, in solicitations, contracts, orders, and agreements where services to perform information system design and development are required.

(c) Contracting officers shall insert the clause at 852.239-73, Information System Hosting, Operation, Maintenance or Use, in solicitations, contracts, orders, and agreements where services to perform information system hosting, operation, maintenance, or use are required.

(d) Contracting officers shall insert the clause at 852.239-74, Security Controls Compliance Testing, in solicitations, contracts, orders, and agreements, when the clause at 852.239-72 or 852.239-73 is inserted.

authority: 38 U.S.C. 5723-5724,5725; 40 U.S.C. 121(c), 11319(b)(1)(C); 41 U.S.C. 1121(c)(3), 1303 and 1702; and 48 CFR 1.301 through 1.304

source: 88 FR 4746, Jan. 25, 2023, unless otherwise noted.

cite as: 48 CFR 839.106-70