Cyber clauses in the FAR overhaul: 27 clauses, 16 changed
Cybersecurity and information safeguarding clauses: the FAR and DFARS clauses the dataset files under this topic, each with its three numbers and its disposition. 2 renumbered: the deviation text carries it under a new number, 3 replaced: a DFARS class deviation carries a clause with the identical title under a new number, 5 not carried forward in the deviation text, 5 new in the overhaul, no codified number, 1 not in the official tables we hold, 11 same number in the deviation text. As at 27 Sep 2026.
Changed under the overhaul
16| Codified | Title | Under the deviation | Proposed | Disp. |
|---|---|---|---|---|
| 52.204-2 | Security Requirements | 52.240-92 | 52.240-4 | Renum. |
| 52.204-21 | Basic Safeguarding of Covered Contractor Information Systems | 52.240-93 | 52.240-5 | Renum. |
| 52.239-1 | Privacy or Security Safeguards | not carried forward | proposed for removal | Rem. |
| none | Security Requirements | 52.240-92 | 52.240-4 | New |
| none | Basic Safeguarding of Covered Contractor Information Systems | 52.240-93 | 52.240-5 | New |
| none | none | 52.240-6 | New | |
| none | none | 52.240-7 | New | |
| 252.204-7019 | Notice of NIST SP 800-171 DoD Assessment Requirements | not in the official tables we hold | no DFARS proposed rule in the Federal Register | Unv. |
| 252.204-7020 | NIST SP 800-171 DoD Assessment Requirements | 252.240-7997 | no DFARS proposed rule in the Federal Register | Repl. |
| 252.225-7007 | Prohibition on Acquisition of Certain Items from Communist Chinese Military Companies | not carried forward | no DFARS proposed rule in the Federal Register | Rem. |
| 252.225-7023 | Preference for Products or Services from Afghanistan | not carried forward | no DFARS proposed rule in the Federal Register | Rem. |
| 252.225-7024 | Requirement for Products or Services from Afghanistan | not carried forward | no DFARS proposed rule in the Federal Register | Rem. |
| 252.225-7026 | Acquisition Restricted to Products or Services from Afghanistan | not carried forward | no DFARS proposed rule in the Federal Register | Rem. |
| 252.242-7006 | Accounting System Administration | 252.242-7999 | no DFARS proposed rule in the Federal Register | Repl. |
| 252.244-7001 | Contractor Purchasing System Administration | 252.244-7998 | no DFARS proposed rule in the Federal Register | Repl. |
| none | Alternate A, Administration of Cost Accounting Standards | 252.230-7998 | no DFARS proposed rule in the Federal Register | New |
Same number under the deviation
11| Codified | Title | Under the deviation | Proposed | Disp. |
|---|---|---|---|---|
| 52.224-3 | Privacy Training | 52.224-3 | 52.224-3 | Kept |
| 252.204-7008 | Compliance with safeguarding covered defense information controls | 252.204-7008 | no DFARS proposed rule in the Federal Register | Kept |
| 252.204-7009 | Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information | 252.204-7009 | no DFARS proposed rule in the Federal Register | Kept |
| 252.204-7012 | Safeguarding Covered Defense Information and Cyber Incident Reporting | 252.204-7012 | no DFARS proposed rule in the Federal Register | Kept |
| 252.204-7021 | Contractor Compliance With the Cybersecurity Maturity Model Certification Level Requirements | 252.204-7021 | no DFARS proposed rule in the Federal Register | Kept |
| 252.204-7025 | Notice of Cybersecurity Maturity Model Certification Level Requirements | 252.204-7025 | no DFARS proposed rule in the Federal Register | Kept |
| 252.215-7011 | Requirements for Submission of Proposals to the Administrative Contracting Officer and Contract Auditor | 252.215-7011 | no DFARS proposed rule in the Federal Register | Kept |
| 252.223-7007 | Safeguarding Sensitive Conventional Arms, Ammunition, and Explosives | 252.223-7007 | no DFARS proposed rule in the Federal Register | Kept |
| 252.239-7009 | Representation of use of cloud computing | 252.239-7009 | no DFARS proposed rule in the Federal Register | Kept |
| 252.239-7010 | Cloud Computing Services | 252.239-7010 | no DFARS proposed rule in the Federal Register | Kept |
| 252.245-7003 | Contractor Property Management System Administration | 252.245-7003 | no DFARS proposed rule in the Federal Register | Kept |
Which number a given contract carries depends on the deviation its awarding agency has adopted and the date of the solicitation or the modification: a contract carries the deviation number only where its agency adopted that deviation and it applies at that date. The finder shows all three numbers and names the source; it does not decide for you. Confirm which deviation your contracting officer's agency has adopted.