Overview
This section defines the specific products ("covered articles") and organizations ("covered entities") subject to the federal prohibition on the use of Kaspersky Lab hardware, software, and services. It establishes a broad scope to ensure that the ban covers not only direct products but also those with embedded components or those provided by corporate affiliates.
Key Rules
- Kaspersky Lab Covered Article: Defined as any hardware, software, or service that is:
- Developed or provided by a Kaspersky Lab covered entity.
- Contains any hardware, software, or service developed/provided in whole or in part by such an entity.
- Contains components using hardware or software developed in whole or in part by such an entity.
- Kaspersky Lab Covered Entity: Includes a wide range of organizational structures to prevent circumvention, specifically:
- Kaspersky Lab itself.
- Any successor entity or renamed entity (e.g., "Kaspersky").
- Any entity that controls, is controlled by, or is under common control with Kaspersky Lab.
- Any entity where Kaspersky Lab holds majority ownership.
Practical Implications
- Supply Chain Diligence: Contractors must scrutinize their entire supply chain, as the prohibition applies to products containing even partial components developed by Kaspersky, regardless of the final brand name.
- Corporate Monitoring: Compliance requires staying updated on corporate mergers, acquisitions, and name changes to ensure that a "successor entity" is not inadvertently used in a federal contract.