FAR Overhaul Clause CrosswalkAs at 27 Sep 2026 ยท codified, deviation and proposed numbers

FAR overhaul clause crosswalk: every clause that moved, with the template to check your own list

The overhaul gives many clauses up to three numbers: the codified number, the number under the class deviations and the proposed permanent number. The dataset holds 1,007 distinct clauses, published under 1,047 old and new clause-number pages (638 FAR clauses, 369 DFARS): 760 keep their number, 38 are renumbered, 21 merged, 129 removed, 51 are new in the deviation text and 8 are not settled by the official tables. As at 27 Sep 2026.

Download the clause list template (CSV)Paste a list now

The template

The CSV carries the five columns the finder reads: Clause, Title, Date, Alternate, Deviation, with four example rows. Fill it from a Section I list, a flow-down exhibit or a proposal compliance matrix, one clause per row, then paste it back on the landing page; the header row is read and skipped. Titles, dates, alternates and deviation markers are optional.

The cyber and flow-down clauses

29
CodifiedTitleUnder the deviationProposedDisp.
52.204-2Security Requirements52.240-9252.240-4Renum.
52.204-21Basic Safeguarding of Covered Contractor Information Systems52.240-9352.240-5Renum.
52.204-23Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities52.240-9152.240-3Mrgd.
52.204-24Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment52.240-9052.240-2Mrgd.
52.204-25Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment52.240-9152.240-3Mrgd.
52.204-26Covered Telecommunications Equipment or Services-Representation52.240-9052.240-2Mrgd.
52.204-27Prohibition on a ByteDance Covered Application52.240-9152.240-3Mrgd.
52.212-5Contract Terms and Conditions Required To Implement Statutes or Executive Orders-Commercial Products and Commercial Servicesnot carried forwardproposed for removalRem.
52.213-4Terms and Conditions-Simplified Acquisitions (Other Than Commercial Products and Commercial Services)52.213-452.213-4Kept
52.224-3Privacy Training52.224-352.224-3Kept
52.239-1Privacy or Security Safeguardsnot carried forwardproposed for removalRem.
52.244-6Subcontracts for Commercial Products and Commercial Services52.244-652.244-6Kept
noneSecurity Prohibitions and Exclusions Representations and Certifications52.240-9052.240-2New
noneSecurity Prohibitions and Exclusions52.240-9152.240-3New
noneSecurity Requirements52.240-9252.240-4New
noneBasic Safeguarding of Covered Contractor Information Systems52.240-9352.240-5New
nonenone52.240-6New
nonenone52.240-7New
252.204-7008Compliance with safeguarding covered defense information controls252.204-7008no DFARS proposed rule in the Federal RegisterKept
252.204-7009Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information252.204-7009no DFARS proposed rule in the Federal RegisterKept
252.204-7012Safeguarding Covered Defense Information and Cyber Incident Reporting252.204-7012no DFARS proposed rule in the Federal RegisterKept
252.204-7019Notice of NIST SP 800-171 DoD Assessment Requirementsnot in the official tables we holdno DFARS proposed rule in the Federal RegisterUnv.
252.204-7020NIST SP 800-171 DoD Assessment Requirements252.240-7997no DFARS proposed rule in the Federal RegisterRepl.
252.204-7021Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements252.204-7021no DFARS proposed rule in the Federal RegisterKept
252.204-7024Notice on the Use of the Supplier Performance Risk System252.204-7024no DFARS proposed rule in the Federal RegisterKept
252.204-7025Notice of Cybersecurity Maturity Model Certification Level Requirements252.204-7025no DFARS proposed rule in the Federal RegisterKept
252.239-7009Representation of use of cloud computing252.239-7009no DFARS proposed rule in the Federal RegisterKept
252.239-7010Cloud Computing Services252.239-7010no DFARS proposed rule in the Federal RegisterKept
252.244-7000Subcontracts for Commercial Products or Commercial Services252.244-7999no DFARS proposed rule in the Federal RegisterRepl.

By part

Which number a given contract carries depends on the deviation its awarding agency has adopted and the date of the solicitation or the modification: a contract carries the deviation number only where its agency adopted that deviation and it applies at that date. The finder shows all three numbers and names the source; it does not decide for you. Confirm which deviation your contracting officer's agency has adopted. The rows come from the official texts named on each clause page; a DFARS renumbering read by an identical title carries medium confidence and says so.