The Revolutionary FAR Overhaul moved the government’s contract security requirements into a new FAR Part 40 and collapsed twelve Part 4, Part 25 and Part 40 clauses into four. If you are looking up 52.240-90, 52.240-91, 52.240-92 or 52.240-93, this is what each one is, which apply to your acquisition, and what each one replaced.
These are class deviations, not final FAR text. The FAR Council issued the Part 40 model deviation on 14 August 2025. Agencies adopt it individually, and every adopting agency has recorded the same base effective date of 3 November 2025. If your agency has not adopted Part 40, the legacy clauses still apply — check the list below.
| Number | Title | Type | UCF section | Prescribed at |
|---|---|---|---|---|
| 52.240-90 | Security Prohibitions and Exclusions Representations and Certifications | Provision | K | 40.205(a) |
| 52.240-91 | Security Prohibitions and Exclusions | Clause | I | 40.205(b) |
| 52.240-92 | Security Requirements | Clause | I | 40.302-3(a) |
| 52.240-93 | Basic Safeguarding of Covered Contractor Information Systems | Clause | I | 40.303-2 |
The distinction that matters most in practice: 52.240-90 is a provision and belongs in the solicitation at Section K, where offerors represent and certify. The other three are clauses and belong in the resulting contract at Section I.
| Number | Applicability |
|---|---|
| 52.240-90 | Solicitations. No encoded conditions — treat as broadly applicable. |
| 52.240-91 | Contracts. No encoded conditions — treat as broadly applicable. Alt I at 40.205(c). |
| 52.240-92 | Non-COTS only, and only where the contract may require access to classified information. No dollar threshold. Alt I / Alt II at 40.302-3(b)/(c). |
| 52.240-93 | Non-COTS only. No dollar threshold. |
None of the four carries a dollar threshold, so they reach simplified acquisitions and micro-purchases. The recurring trap is 52.240-92: it is prescribed “when the contract may require access to classified information,” which is a judgment the contracting officer makes rather than something derivable from the acquisition’s attributes. A clause engine cannot decide it for you; it can only put it in front of you.
This is the part that catches people. A clause number you have used for years may not be gone — it may have been folded into one of these four.
| New Part 40 clause | Consolidates |
|---|---|
| 52.240-90 Security Prohibitions and Exclusions Representations and Certifications | 52.204-24, 52.204-26 Also folds in 52.204-29, 52.225-20, 52.225-25, which ArcClause does not track separately. |
| 52.240-91 Security Prohibitions and Exclusions | 52.204-23, 52.204-25, 52.204-27, 52.204-28, 52.204-30, 52.225-13, 52.240-1 |
| 52.240-92 Security Requirements | 52.204-2 |
| 52.240-93 Basic Safeguarding of Covered Contractor Information Systems | 52.204-21 |
52.204-21 and 52.240-1 are removed and reserved under the deviation. If a template or clause matrix still pulls them, it is producing a document against superseded text.
Because these are class deviations, adoption is agency by agency. 26 agencies have issued a Part 40 deviation, all with a base effective date of 3 November 2025:
Adoption data as of 2026-08-09. Agencies not listed here are tracked as verified-legacy for Part 40 — meaning 52.204-21, 52.204-25 and the rest of the legacy set still govern their acquisitions.
Use the legacy clauses. The Part 40 set has no force at an agency that has not issued the deviation, and inserting 52.240-93 into a contract at an agency still operating under Part 4 creates a clause that is prescribed by nothing. The reverse error is more common and more costly: continuing to insert 52.204-21 at an agency that adopted Part 40 in November 2025.
FAR 52.240-93, Basic Safeguarding of Covered Contractor Information Systems. It carries the same title and the same non-COTS applicability. Under the Revolutionary FAR Overhaul Part 40 model deviation, 52.204-21 is removed and reserved and the requirement moves to Part 40, prescribed at 40.303-2 instead of 4.1903.
52.240-90 is a provision and 52.240-91 is a clause. The provision goes in solicitations in Uniform Contract Format Section K and collects representations and certifications from offerors. The clause goes in the resulting contract in Section I and imposes the actual prohibitions. Most acquisitions that use one use the other.
52.240-91. The Part 40 model deviation consolidates 52.204-23, 52.204-25, 52.204-27, 52.204-28, 52.204-30 and 52.225-13 into a single clause, covering the Section 889 covered telecommunications prohibitions along with Kaspersky, ByteDance, FASCSA exclusion orders and restricted foreign purchases.
Yes, except for commercially available off-the-shelf items. The encoded condition is commerciality not equal to COTS, and there is no dollar threshold, so it reaches commercial acquisitions and micro-purchases that are not COTS.
The FAR Council issued the Part 40 model deviation text on 14 August 2025. Every agency that has adopted it recorded the same base effective date of 3 November 2025. As of 2026-08-09, 26 agencies have adopted Part 40.
Then the legacy clauses still apply to your acquisition. These are class deviations, not final FAR rule text, so adoption is agency by agency. An agency that has not issued a Part 40 deviation is still using 52.204-21, 52.204-25 and the rest of the Part 4 and Part 25 set.
ArcClause resolves the legacy and deviation clause sets against your agency, your acquisition attributes and the effective date — and shows the prescription behind every clause it picks.
Related: FAR Part 22 labor clauses after E.O. 11246 · FAR Part 23 clauses after E.O. 14057 · FAR overhaul tracker · full FAR clause library · the CUI rule under the overhaul