U.S. FAR 52.204-27

Why does it matter?

FAR 52.204-27 is one of the FAR's national security prohibitions, and the one with the widest reach: it binds every federal contractor, including sellers of commercial products and COTS items and holders of micro-purchases, and it follows the work onto employee-owned phones used under a bring-your-own-device arrangement. The preamble to 88 FR 36430 describes the clause as a national security measure to protect Government information and information and communication technology systems. A contractor that cannot show the covered application is absent from the information technology it uses under the contract is in breach of a mandatory clause, with the remedies available under the contract, and its subcontractors inherit the same obligation through paragraph (c).

Key benefits include:

• One defined target

Paragraph (a) defines the covered application as the social networking service TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited, the words of section 102(a)(1) of the Act.

• Statutory reach for information technology

The clause uses the 40 U.S.C. 11101(6) definition, which includes equipment a contractor uses under a contract that requires its use, and excludes equipment acquired incidental to a federal contract.

• Personal devices included

Paragraph (b) names equipment provided by the Contractor's employees; the preamble confirms that a BYOD phone used in performance is covered and a personal phone not used in performance is not.

• Exceptions only in writing

The prohibition lifts only when the Contracting Officer notifies the Contractor in writing that an exception has been granted under M-23-13 (paragraph (b)); agencies limit exceptions to law enforcement, national security and security research.

• Flow-down to every subcontract

Paragraph (c) requires the substance of the clause, including (c) itself, in all subcontracts, including subcontracts for commercial products or commercial services.

How does it work?

Section 102 of the No TikTok on Government Devices Act directed the OMB Director, within 60 days and in consultation with GSA, CISA, the Director of National Intelligence and the Secretary of Defense, to issue standards and guidelines requiring executive agencies to remove the covered application from information technology, with exceptions for law enforcement activities, national security interests and activities and security researchers (section 102(b)). M-23-13 answered on February 27, 2023: within 30 days agencies had to identify, remove and block the application; within 90 days stop issuing contracts whose performance may involve it; within 120 days require conformance in option exercises, extensions and new solicitations that may involve contractor use of information technology.

FAR subpart 4.22 carries the policy into contracts. Section 4.2201 repeats the two definitions, 4.2202 states the prohibition for Government information technology and for information technology used or provided by a contractor under a contract, including equipment provided by the contractor's employees, and 4.2203 prescribes clause 52.204-27 for all solicitations and contracts unless an exception is granted under M-23-13. The interim rule also added text to FAR 13.2 so the prohibition reaches micro-purchases and a cross-reference in FAR part 39. Contracting officers had to include the clause in solicitations issued on or after June 2, 2023, amend earlier solicitations by July 3, 2023 and modify existing indefinite-delivery contracts under FAR 1.108(d)(3).

The clause asks for conduct, not paperwork. The preamble to 88 FR 36430 says the rule requires no supply chain review and no contractor reporting, unlike the Kaspersky and covered telecommunications prohibitions at 52.204-23 and 52.204-25, and expects contractors to use existing technology to block the application's URLs, prevent its download and remove it, to update workplace technology policies and to explain to employees when the application is prohibited on a personal device used in performance. An exception granted to an agency program under M-23-13 is documented by the agency, lasts up to one year and is shared with acquisition officials for the contract file; the contractor relies on it only after the Contracting Officer's written notice.

Key Elements

• Covered application (52.204-27(a))

TikTok or any successor application or service developed or provided by ByteDance Limited or an entity owned by ByteDance Limited.

• Information technology (52.204-27(a))

The 40 U.S.C. 11101(6) definition: equipment and systems used by the agency directly or by a contractor under a contract that requires their use, including software, firmware and services, but not equipment acquired incidental to a federal contract.

• Prohibition (52.204-27(b))

No having or using a covered application on Government-owned or Government-managed information technology, or on information technology used or provided by the Contractor under the contract, including equipment provided by the Contractor's employees.

• Exception (52.204-27(b) and M-23-13 section IV)

Applies only after written notification from the Contracting Officer; agency exceptions are granted by the agency head or designee, documented, time-limited to one year and limited to national security, law enforcement and security research.

• Subcontracts (52.204-27(c))

The substance of the clause, including paragraph (c), goes into all subcontracts, including those for commercial products or commercial services.

• Prescription and applicability (FAR 4.2203 and 88 FR 36430)

All solicitations and contracts, including those at or below the simplified acquisition threshold, for commercial products and services and for COTS items, with micro-purchases addressed in FAR 13.2.

What does it cover?

The clause applies to every prime contractor and, through paragraph (c), every subcontractor at any tier that performs a contract with an executive agency, regardless of dollar value or commercial status, because the FAR Council and the Administrator for Federal Procurement Policy determined under 41 U.S.C. 1905 to 1907 to apply the statute below the simplified acquisition threshold and to commercial and COTS acquisitions. The subject matter is information technology as defined in 40 U.S.C. 11101(6): Government-owned or Government-managed systems and the contractor's own or employee-provided equipment when it is used or provided under the contract. Equipment acquired incidental to a federal contract and personal devices not used in performance are outside the clause.

What are its objectives?

The clause exists to carry the No TikTok on Government Devices Act and M-23-13 into every federal contract.

Keep the covered application off information technology owned or managed by the Government.

Keep it off information technology the contractor uses or provides under the contract, including employee-provided devices used in performance.

Confine any use to exceptions an agency has documented under M-23-13 and a Contracting Officer has confirmed in writing.

Carry the same obligation to every subcontractor through paragraph (c).

Apply the prohibition uniformly across agencies so contractors meet one rule rather than agency-specific variants, the reason the FAR Council gave for an immediately effective interim rule.

Framework in Context

FAR 52.204-27 sits with the FAR's other supply chain prohibitions: 52.204-23 on Kaspersky Lab products, 52.204-25 on covered telecommunications equipment under section 889 of the FY 2019 NDAA (see NDAA Section 889) and the FASCSA order clauses at 52.204-28 and 52.204-30. The FAR Council's Revolutionary FAR Overhaul proposed rule of June 23, 2026 (FAR Case 2026-001) would move all of them, including 52.204-27, into a single clause at FAR 52.240-3, Security Prohibitions and Exclusions, with a companion representation at 52.240-2; it is a proposed rule, and the eCFR still shows 52.204-27 unchanged since June 2, 2023. The clause is distinct from the safeguarding requirements of FAR 52.204-21, which protect Federal contract information rather than banning an application.

Common Framework Mappings

Contractors usually record the clause alongside the control sets below, so one device inventory and one acceptable-use policy answer the TikTok prohibition and their wider security obligations.

Mapped frameworks include:

CIS Controls v8.1

FedRAMP Rev. 5

GDPR

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2

GovRAMP