FAR and DFARS › DFARS Part 239: Acquisition of Information Technology › Subpart 239.76
DFARS 239.7602-2 Required storage of data within the United States or outlying areas.
The codified text (eCFR, as of 2026-10-02). Under the Revolutionary FAR Overhaul ↗, agencies follow class deviations with new text for many parts while the formal rules go through the Federal Register: check the solicitation and your contract's clauses, which rule.
In plain English
This DFARS section requires cloud computing service providers to keep Government data within the 50 states, the District of Columbia, or outlying areas of the United States when that data is not physically located on DoD premises. An exception is allowed only if the authorizing official permits it, and the contracting officer must notify the contractor in writing when data may be stored outside those locations.
Applies to: Cloud computing service providers handling Government data not on DoD premises
What it requires
- Maintain Government data within the 50 states, the District of Columbia, or outlying areas of the United States unless otherwise authorized by the authorizing official
- Wait for written notification from the contracting officer before maintaining Government data outside the 50 states, the District of Columbia, and outlying areas of the United States
Key terms: Cloud computing service providers · Government data · DoD premises · authorizing official · contracting officer
Written by AI from this section's text. A guide, not legal advice: the text below rules.
The text
(a) Cloud computing service providers are required to maintain within the 50 states, the District of Columbia, or outlying areas of the United States, all Government data that is not physically located on DoD premises, unless otherwise authorized by the authorizing official, as described in DoD Instruction 8510.01, in accordance with the SRG.
(b) The contracting officer shall provide written notification to the contractor when the contractor is permitted to maintain Government data at a location outside the 50 States, the District of Columbia, and outlying areas of the United States. See PGI 239.7602-2 for additional guidance.
Sections that refer to it
- 252.239-7010 Cloud Computing Services.
← 239.7602-1 General. · 239.7603 Procedures. →
Rule changes for DFARS Part 239
- Defense Federal Acquisition Regulation Supplement: Disclosure of Information Regarding Foreign Obligations (DFARS Case 2018-D064) ↗ · proposed 2024-11-15 · comments due 2025-01-14
Source: eCFR, 48 CFR chapters 1 and 2 (GPO GovInfo bulk data) ↗. Plain words for the terms: glossary.