What is an FIS? The proposed rule defines FIS as “an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization, on behalf of a government agency.”įAR 52.239-YY would be required in contracts acquiring FIS services that include (or are anticipated to use) non-cloud computing services during contract performance. As drafted, the rule would affect contracts that involve the development and maintenance of federal information systems (“FIS”). Under the proposed rule, the FAR Council would promulgate two new FAR clauses, FAR 52.239-YY (Federal Information Systems Using Non-Cloud Computing Systems) and FAR 52.239-XX (Federal Information Systems Using Cloud Computing Services).

Who Will the Standardization of Cybersecurity Contractual Requirements Affect? 2021-019, which seeks to standardize cybersecurity contractual requirements across federal agencies. 2021-017, which would impose a range of new cyber incident reporting requirements on nearly all government contractors, earlier this week. On October 3, 2023, the FAR Council proposed two potentially significant cybersecurity rules.