SpendQueryBeta

FAR and DFARS › DFARS Part 239: Acquisition of Information Technology › Subpart 239.71

DFARS 239.7102-3 Information assurance contractor training and certification.

The codified text (eCFR, as of 2026-10-02). Under the Revolutionary FAR Overhaul ↗, agencies follow class deviations with new text for many parts while the formal rules go through the Federal Register: check the solicitation and your contract's clauses, which rule.

In plain English

This section assigns responsibilities to the requiring activity for information assurance contractor training and certification. Before award, the requiring activity must give the contracting officer a list of information assurance functional responsibilities and the required training and certifications. After award, the requiring activity must ensure contractor personnel certifications comply with DoD 8570.01-M and are tracked.

Applies to: DoD requiring activities for acquisitions involving information assurance functional services or contractor access to DoD information systems

What it requires

  • Provide the contracting officer a list of information assurance functional responsibilities by category and level
  • Provide the contracting officer the required information assurance training, certification, certification maintenance, and continuing education or sustainment training
  • After award, ensure contractor personnel certifications comply with DoD 8570.01-M and are identified, documented, and tracked

Key terms: information assurance functional services · DoD information systems · requiring activity · DoD 8570.01-M · certification maintenance

Written by AI from this section's text. A guide, not legal advice: the text below rules.

The text

(a) For acquisitions that include information assurance functional services for DoD information systems, or that require any appropriately cleared contractor personnel to access a DoD information system to perform contract duties, the requiring activity is responsible for providing to the contracting officer—(1) A list of information assurance functional responsibilities for DoD information systems by category (e.g., technical or management) and level (e.g., computing environment, network environment, or enclave); and

(2) The information assurance training, certification, certification maintenance, and continuing education or sustainment training required for the information assurance functional responsibilities.

(b) After contract award, the requiring activity is responsible for ensuring that the certifications and certification status of all contractor personnel performing information assurance functions as described in DoD 8570.01-M, Information Assurance Workforce Improvement Program, are in compliance with the manual and are identified, documented, and tracked.

(c) The responsibilities specified in paragraphs (a) and (b) of this section apply to all DoD information assurance duties supported by a contractor, whether performed full-time or part-time as additional or embedded duties, and when using a DoD contract, or a contract or agreement administered by another agency (e.g., under an interagency agreement).

(d) See PGI 239.7102-3 for guidance on documenting and tracking certification status of contractor personnel, and for additional information regarding the requirements of DoD 8570.01-M.

← 239.7102-2 Compromising emanations—TEMPEST or other standard. · 239.7103 Contract clauses. →

Rule changes for DFARS Part 239

Source: eCFR, 48 CFR chapters 1 and 2 (GPO GovInfo bulk data) ↗. Plain words for the terms: glossary.

DFARS 239.7102-3 Information assurance contractor training and certification · SpendQuery