52.204-23 Prohibition on Contracting for

Hardware, Software, and Services Developed

or Provided by Kaspersky Lab Covered

Entities.

As prescribed in 4.2004 , insert the following clause:

Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by

Kaspersky Lab Covered Entities. (Dec 2023)

(a) Definitions. As used in this clause—

Kaspersky Lab covered article means any hardware, software, or service that–

(1) Is developed or provided by a Kaspersky Lab covered entity;

(2) Includes any hardware, software, or service developed or provided in whole or in part by a

Kaspersky Lab covered entity; or

(3) Contains components using any hardware or software developed in whole or in part by a

Kaspersky Lab covered entity.

Kaspersky Lab covered entity means–

(1) Kaspersky Lab;

(2) Any successor entity to Kaspersky Lab, including any change in name, e.g., “Kaspersky”;

(3) Any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or

(4) Any entity of which Kaspersky Lab has a majority ownership.

(b) Prohibition. Section 1634 of Division A of the National Defense Authorization Act for Fiscal Year

2018 (Pub. L. 115-91) prohibits Government use of any Kaspersky Lab covered article. The

Contractor is prohibited from—

(1) Providing any Kaspersky Lab covered article that the Government will use on or after October 1,

2018; and

(2) Using any Kaspersky Lab covered article on or after October 1, 2018, in the development of data

or deliverables first produced in the performance of the contract.

(c) Reporting requirement.

(1) In the event the Contractoridentifies a Kaspersky Lab covered article provided to the

Government during contract performance, or the Contractor is notified of such by a subcontractor at

any tier or any other source, the Contractor shall report, in writing, to the Contracting Officer or, in

the case of the Department of Defense, to the website at https://dibnet.dod.mil. For indefinite

delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite delivery
contract and the Contracting Officer(s) for any affected order or, in the case of the Department of

Defense, identify both the indefinite delivery contract and any affected orders in the report provided

at https://dibnet.dod.mil.

(2) The Contractor shall report the following information pursuant to paragraph (c)(1) of this clause:

(i) Within 3 business days from the date of such identification or notification: the contract number;

the order number(s), if applicable; supplier name; brand; model number (Original Equipment

Manufacturer (OEM) number, manufacturer part number, or wholesaler number); item description;

and any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the report pursuant to paragraph (c)(1) of this clause: any

further available information about mitigation actions undertaken or recommended. In addition, the

Contractor shall describe the efforts it undertook to prevent use or submission of a Kaspersky Lab

covered article, any reasons that led to the use or submission of the Kaspersky Lab covered article,

and any additional efforts that will be incorporated to prevent future use or submission of Kaspersky

Lab covered articles.

(d) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph

(d), in all subcontracts including subcontracts for the acquisition of commercial products or

commercial services.

(End of clause)

Parent topic: 52.204 [Reserved]