FAR and DFARS › FAR Part 40: Information Security and Supply Chain Security
FAR 40.000 Scope of part.
The codified text (eCFR, as of 2026-10-02). Under the Revolutionary FAR Overhaul ↗, agencies follow class deviations with new text for many parts while the formal rules go through the Federal Register: check the solicitation and your contract's clauses, which rule.
In plain English
This section explains that FAR Part 40 sets out broad security requirements for buying products and services, including managing information security and supply chain security. It also points you to other FAR parts for related or different policies, such as Part 39 for ICT-specific security and Parts 4, 24, and 46 for other information and supply chain security matters. It matters because it tells you where the security rules live and that they can apply to many acquisitions, not just ICT.
Applies to: Acquisitions of products and services, including but not limited to information and communications technology (ICT)
Key terms: security requirements · information security · supply chain security · information and communications technology (ICT) · acquisitions
Written by AI from this section's text. A guide, not legal advice: the text below rules.
The text
(a) This part addresses broad security requirements that apply to acquisitions of products and services. It prescribes policies and procedures for managing information security and supply chain security when acquiring products and services that include, but are not limited to, information and communications technology (ICT).
(b) See part 39 for security-related policies and procedures that only apply to ICT.
(c) See parts 4, 24, and 46 for additional policies and procedures related to managing information security and supply chain security.
(d) Information and supply chain policies and procedures that are unrelated to security are covered in other parts of the FAR (e.g., part 22 for labor and human trafficking risks and part 23 for climate-related risks).
Rule changes for FAR Part 40
- Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53 ↗ · proposed 2026-06-23 · comments due 2026-07-23
- Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and Services ↗ · proposed 2026-02-17 · comments due 2026-04-20
- Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities ↗ · final rule 2024-12-30
- Federal Acquisition Regulation: Prohibition on Unmanned Aircraft Systems From Covered Foreign Entities ↗ · final rule 2024-11-12 · effective 2024-11-12
- Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and Services ↗ · proposed 2024-06-26 · comments due 2024-08-02
- Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and Services; Correction ↗ · proposed 2024-05-15
- Federal Acquisition Regulation: Prohibition on Certain Semiconductor Products and Services ↗ · proposed 2024-05-03 · comments due 2024-07-02
- Federal Acquisition Regulation: Establishing Federal Acquisition Regulation Part 40 ↗ · final rule 2024-04-01 · effective 2024-05-01
Source: eCFR, 48 CFR chapters 1 and 2 (GPO GovInfo bulk data) ↗. Plain words for the terms: glossary.