Overview
This section instructs government personnel on the administrative actions required when a contractor reports the identification of prohibited Kaspersky Lab hardware, software, or services within their supply chain.
Key Rules
- Trigger: The rule applies specifically when a contractor submit a notification as required by FAR clause 52.204-23.
- Compliance Path: Contracting Officers and agency officials must adhere to their specific "agency procedures" to handle the report.
- Scope: This is part of the broader federal prohibition on any hardware, software, or services developed or provided by Kaspersky Lab and its related entities.
Practical Implications
- Contracting Officers must consult their internal agency supplements (such as the DFARS or GSAM) or specific departmental memos to determine the exact reporting chain and mitigation steps required once a prohibited item is identified.
- It ensures that there is a standardized internal communication flow to notify higher-level security or IT officials about potential vulnerabilities in the government’s supply chain.