FASCSA Orders in Federal IT Procurement

Compliance reviewed by Onur Oncer, SDVOSB Materials compliance lead.

A Federal Acquisition Supply Chain Security Act (FASCSA) order is a removal or exclusion order that can bar a named source, or a named covered article, from federal procurement. It binds the contractor, not only the agency. SDVOSB Materials Technology & Supply LLC treats it as a standing duty on every federal information technology scope.

The Second Exclusion Regime Most Buyers Miss

Ask a federal technology buyer what keeps a prohibited product off a government network and most name Section 889 of the Fiscal Year 2019 National Defense Authorization Act. That is half the picture. Federal Acquisition Regulation (FAR) Subpart 4.23 implements a second regime: the Federal Acquisition Supply Chain Security Act of 2018, title II of Pub. L. 115-390, and the Federal Acquisition Security Council rule at 41 CFR part 201-1.

Section 889 works from producers named in the regulation. A FASCSA order works from an issuing official's decision, and can reach equipment already in a rack. That set is not static, which is why checking it is a recurring duty, not a one-time representation. FAR 4.2300 puts an end date on the authority: December 31, 2033, under 41 U.S.C. 1328. Our federal IT infrastructure procurement guide covers the wider scope these clauses attach to.

Three Officials Issue Them, and Only Some Reach You

An order requires removal of covered articles from agency information systems, or exclusion of named sources or covered articles from procurement actions. Who signed it decides whether it binds you.

• The Secretary of Homeland Security, for civilian agencies.

• The Secretary of Defense, for the Department of Defense and for national security systems other than sensitive compartmented information systems.

• The Director of National Intelligence, for the intelligence community and sensitive compartmented information systems.

The default at FAR 4.2304(a)(1): civilian agency awards carry Department of Homeland Security orders, Department of Defense awards carry Department of Defense orders. Where a program office instructs otherwise, the clause arrives with its Alternate I.

What Counts as a Covered Article

The definition at 41 U.S.C. 4713(k) is wider than most bills of material assume. A covered article is any of four things.

• Information technology as defined at 40 U.S.C. 11101, including cloud computing services of all types.

• Telecommunications equipment or service as defined in section 3 of the Communications Act of 1934, at 47 U.S.C. 153.

• Processing of information on a federal or non-federal system subject to the Controlled Unclassified Information program at 32 CFR part 2002.

• Hardware, systems, devices, software or services that include embedded or incidental information technology.

The fourth item catches integrators. A badge reader, a building automation controller, an audiovisual switcher, a laboratory instrument with a network port: each carries incidental information technology and sits inside the definition. Passive cable does not, which is why the line between cable plant and active gear matters. Our federal versus commercial structured cabling specification comparison shows where it falls.

Clause 52.204-30 Keeps Running After Award

FAR 4.2303(c) says orders are located in the System for Award Management (SAM) by searching the phrase "FASCSA order," and that some never appear there and must be named in the solicitation instead. Two places, neither optional.

The prohibition clause is FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders, Prohibition, dated December 2023. Paragraph (b) bars providing or using a prohibited covered article or source in performance, absent a waiver. Paragraph (c) does what a representation cannot: it survives award. The contractor reviews SAM.gov at least once every three months, or as the contracting officer directs, and runs a reasonable inquiry when a new order could touch its supply chain.

If it finds one was delivered or used, reporting runs in two stages. Within three business days: contract and order numbers, product or service name, covered article or source name, the supplying vendor with its Commercial and Government Entity (CAGE) code and unique entity identifier where known, brand, model number, item description, and mitigation information to hand. Within ten business days: further mitigation detail and what will change to prevent a repeat. Department of Defense contracting offices take the report at dibnet.dod.mil; every other office takes it through the contracting officer.

Three business days is not enough time to build a parts list. It is enough time to read one you already keep. Price model-level inventory into the contract instead of discovering the need mid-performance.

Flow-Down, Removal, and Who Gets the Waiver

Paragraph (e) requires the substance of the clause, excluding the quarterly review at (c)(1), in all subcontracts and other contractual instruments, including those for commercial products and services. A supplier who never received it is not a supplier who is exempt.

Paragraph (d) surprises holders of orders under a Federal Supply Schedule, governmentwide acquisition contract or multi-agency contract. On notification during performance, the contractor promptly makes the changes needed to remove the affected product or service. Removal, not a stop on future buys.

Waivers belong to the agency. Under FAR 4.2305 it asks the issuing official in writing, and no award may be made until approval comes back. A contractor can disclose and ask the government to seek a waiver, but cannot grant itself one.

Three Obligations, One Solicitation

The comparison below runs three columns in order: the authority, the question it asks, and the duty it creates.

• FAR Subpart 4.23, FASCSA orders. Is this source or article named in an order that reaches my contract?. Search SAM.gov quarterly, inquire, report in three business days, remove on notice.

• FAR Subpart 4.21, Section 889. Is this covered telecommunications or video surveillance equipment, by producer?. Represent at offer and report use, against a list fixed in the regulation.

• National Institute of Standards and Technology (NIST) SP 800-171 and Cybersecurity Maturity Model Certification (CMMC). Are the controls protecting Controlled Unclassified Information in place?. Implement, document, and where required have an accredited assessor verify.

Keep them on separate specification lines, each citing its own authority. Where the Controlled Unclassified Information side is live, our NIST SP 800-171 and CMMC subcontractor readiness comparison covers what a subcontractor must show.

Frequently Asked Questions

Does a FASCSA order ban equipment from a particular country?

No. An order names a source or a covered article. Country of manufacture is a domestic-content question under a different clause set. Match on the named source or article.

Do we have to audit our network before we can answer?

No. FAR 4.2301 defines reasonable inquiry as one designed to uncover information already in the entity's possession about covered articles or about products and services from a source, and states that it excludes the need for an internal or third-party audit.

Does an order issued after award apply automatically?

Not the prohibition itself. Under paragraph (b)(4), an order issued after the solicitation date applies only if added by amendment or modification. The notice and reporting duty in paragraph (c) runs regardless.

How is this different from Section 889?

Section 889 names producers of specified telecommunications and video surveillance equipment in the regulation. A FASCSA order names whatever the issuing official names, can force removal from systems already in service, and changes as new orders publish.

Who files the report, the prime or the subcontractor?

The contractor reports to the contracting office, including where the identification came by notification from a subcontractor at any tier. Because the clause flows down, a subcontractor's duty is to notify upward fast enough for the prime to meet three business days.

Working a Federal IT Requirement With a Supply Chain Clause?

SDVOSB Materials Technology & Supply LLC scopes and installs voice, data, video, audiovisual, information technology and physical security infrastructure for federal facilities through its technology infrastructure division, tracking producer and model because the definition operates there. More detail sits on the technology infrastructure services page.

The company is certified by the Small Business Administration (SBA) as a Service-Disabled Veteran-Owned Small Business, an SBA HUBZone small business and a Small Disadvantaged Business, verifiable on its SBA Small Business Search profile. It holds no General Services Administration (GSA) Schedule of its own; GSA orders run through GSA-registered partner vendors. It holds The Interlocal Purchasing System (TIPS) contract 230701. Registered North American Industry Classification System (NAICS) codes sit on its SAM.gov entity record. UEI K39HBMPLN4B3, CAGE 7YX60, EIN 82-2895228.

Need a bill of materials checked against the FASCSA orders that reach your contract? Send the solicitation through our contact page or call (917) 216-9400. We will tell you which orders apply and where you need somebody who is not us.