FAR Part 40: Information Security and Supply Chain Security

In plain English

FAR Part 40 addresses broad security requirements for acquisitions, including information security and supply chain security. It specifically implements the American Security Drone Act of 2023, which prohibits the procurement and operation of unmanned aircraft systems manufactured or assembled by certain foreign entities. This matters to contractors because it restricts what drones and related services they can provide to the government, with some exemptions, exceptions, and waivers.

Key rules

• Executive agencies are prohibited from procuring a FASC-prohibited unmanned aircraft system, including extending or renewing a contract. (40.202-3)
• On or after December 22, 2025, agencies are prohibited from procuring services for the operation of a FASC-prohibited unmanned aircraft system, including extending or renewing a contract. (40.202-3)
• On or after December 22, 2025, agencies are prohibited from using Federal funds for the procurement or operation of a FASC-prohibited unmanned aircraft system. (40.202-3)
• The prohibitions do not apply to certain exemptions for specific agencies (e.g., DHS, DoD, State, DOJ, DOT) when required in the national interest or for specific purposes. (40.202-4)
• The prohibitions do not apply to exceptions for wildfire management, search and rescue, intelligence activities, and Tribal law enforcement or emergency services. (40.202-5)
• The head of the agency may waive the prohibitions on a case-by-case basis with OMB approval and congressional notification. (40.202-6)
• The contracting officer must document any exemption, exception, or waiver and ensure it is identified in the solicitation and contract. (40.202-7)
• The contracting officer must review proposals to ensure they do not propose delivery (and after December 22, 2025, operation) of a FASC-prohibited unmanned aircraft system. (40.202-7)

Who does what

In practice

• Before bidding, check SAM.gov to see if the drone manufacturer or assembler is listed as an American Security Drone Act-covered foreign entity.
• If you are providing drones or drone services, ensure they are not FASC-prohibited, or confirm that an exemption, exception, or waiver applies to your contract.
• After December 22, 2025, the prohibition extends to services for operating FASC-prohibited drones and to the use of Federal funds for such procurement or operation.

Common pitfalls

• Assuming the prohibition only applies to purchases above a certain dollar threshold; it applies to all acquisitions, including micro-purchases and commercial items.
• Overlooking that extending or renewing a contract (e.g., exercising an option) for a FASC-prohibited drone is also prohibited.
• Failing to verify that a drone is not FASC-prohibited before proposing it, as the contracting officer will review proposals for compliance.

Written by AI from this part's codified text (2026-10-04); cited sections are checked against the part. A guide, not legal advice: the regulation text, the solicitation and your contract rule.