Federal Contract Compliance: FAR Obligations

Federal contract compliance, in the sense most contractors mean it, is the set of obligations the Federal Acquisition Regulation (FAR) and its contract clauses place on a company once it holds, or bids on, a U.S. government contract. Two of the most widely applied are an ethics-and-disclosure clause, FAR 52.203-13, and a basic cybersecurity clause, FAR 52.204-21. Each has its own trigger, deadline and flowdown rule, and mixing them up is where most programs go wrong. This guide states those triggers as the official acquisition.gov text describes them on 2026-10-29. It is general information, not legal advice.

What federal contract compliance is and who sets it

The FAR is the primary regulation for federal executive-agency purchasing, and its full text is published on acquisition.gov. Individual contracts incorporate FAR clauses by number, so a contractor’s real obligations are the clauses in its own contract, not a generic checklist. Agencies add supplements on top; for the Department of Defense see our guide to DFARS 252.204-7021 and CMMC requirements.

FAR Subpart 3.10 sets the overall policy. FAR 3.1002 says that government contractors “must conduct themselves with the highest degree of integrity and honesty.” The same section describes ethics codes, training and internal controls as guidance for what contractors should do; the binding detail sits in the clauses below.

Which clauses apply: a trigger table

Start with what your contract actually contains. The table lists the two clauses covered in detail on this page, as described on acquisition.gov on 2026-10-29.

Clause	What it requires	When it applies	Flowdown
FAR 52.203-13, Contractor Code of Business Ethics and Conduct (Nov 2021)	Written code of conduct within 30 days of award; timely written disclosure of credible evidence of certain violations; for larger contractors, an internal control system and ethics awareness program	Inserted when the contract value is expected to exceed $7.5 million and the performance period is 120 days or more (FAR 3.1004(a))	See the clause text for its subcontract provisions
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Nov 2021)	15 basic safeguarding controls on covered contractor information systems	Where the contract includes the clause	Substance of the clause flows down to subcontracts where a subcontractor may hold or transmit federal contract information, including commercial subcontracts other than COTS items

Other obligations attach to other clauses and programs, such as covered telecommunications equipment under Section 889, cost principles under FAR Part 31, and Cost Accounting Standards. Check the clause list in your own contract for each.

Ethics code and mandatory disclosure (FAR 52.203-13)

When does the clause apply?

FAR 3.1004(a) directs contracting officers to insert 52.203-13 if the value of the contract is expected to exceed $7.5 million and the performance period is 120 days or more.

What must a contractor have in place?

Under paragraph (b)(1), within 30 days after contract award, unless the contracting officer establishes a longer period, the contractor must have a written code of business ethics and conduct and make it available to each employee engaged in performing the contract.

Paragraph (c) adds an internal control system and an ongoing ethics awareness program. Paragraph (c) does not apply if the contractor represented itself as a small business for the award, or if the contract is for a commercial product or service. Where it does apply, the minimum elements of the internal control system in (c)(2) are:

assignment of responsibility at a sufficiently high level, with adequate resources;
due diligence on the company’s principals;
periodic reviews, including monitoring and auditing, evaluations and risk assessments;
an internal reporting mechanism, which may be anonymous or confidential;
disciplinary action for improper conduct;
timely disclosure to the agency Office of Inspector General (OIG); and
full cooperation with government audits and investigations.

What does mandatory disclosure mean?

Paragraph (b)(3)(i) requires timely written disclosure to the agency OIG, with a copy to the contracting officer, of credible evidence of certain violations: federal criminal law violations involving fraud, conflict of interest, bribery or gratuity, and civil False Claims Act violations. The duty under (c)(2)(ii)(F)(3) runs until at least three years after final payment on the contract.

“Full cooperation” means disclosing information sufficient for law enforcement to identify the nature and extent of the offense and the individuals responsible; the clause states that it does not require waiving attorney-client privilege or work-product protection.

Separately, FAR 3.1003(a)(2) says a contractor may be suspended or debarred for a principal’s knowing failure to timely disclose such credible evidence, and that this remains a cause until three years after final payment on a contract. That text sits in the policy subpart, so read it alongside your contract rather than assuming the clause is the only source of the duty. Screening for exclusions is covered in debarment and suspension verification in SAM.gov.

Basic cybersecurity safeguarding (FAR 52.204-21)

Paragraph (b)(1) lists 15 basic safeguarding controls for covered contractor information systems. They cover limiting access to authorized users and devices, authentication, sanitizing or destroying media before disposal or reuse, limiting physical access, monitoring and protecting communications at system boundaries, separating publicly accessible components into subnetworks, identifying and correcting system flaws, protection from malicious code with updates, and periodic and real-time scans. Contractors with Defense work, or handling controlled unclassified information, face stronger requirements; see CMMC Level 1 self-assessment, CMMC scoping and FCI versus CUI.

Flowdown to subcontractors

Paragraph (c) of 52.204-21 requires the prime to include the substance of the clause in subcontracts where the subcontractor may have federal contract information residing in or transiting through its information system. That includes commercial subcontracts except those for commercial off-the-shelf (COTS) items. For other clauses, read the flowdown paragraph of each clause in your contract and track which subcontracts carry it.

Steps to build a compliance program

Pull the clause list from the contract and any solicitation, and note each clause number and edition date.
For 52.203-13, confirm whether the $7.5 million and 120-day trigger is met, and whether paragraph (c) is excluded because of small-business status or a commercial contract.
Adopt the written code and deliver it to each employee working on the contract within 30 days of award, or within the longer period the contracting officer sets.
Where paragraph (c) applies, put the seven internal control elements above in writing and assign an accountable owner.
Map the 15 controls of 52.204-21 to your systems that handle federal contract information.
List subcontracts and mark where clause flowdown applies.
Keep disclosure records for at least three years after final payment.

Typical timeline phases

Before award: registration and representations, including those in SAM.gov representations and certifications; review of the solicitation clauses.
First 30 days after award: written code of conduct in place and available to employees, unless a longer period is set.
Performance period: internal control activities, monitoring, reporting and timely disclosure as needed; safeguarding controls maintained.
After final payment: the disclosure duty continues for at least three years.

Common mistakes

Assuming the 52.203-13 internal control system applies to every contractor. Paragraph (c) is excluded for small-business representations and commercial contracts, but the written code requirement in (b)(1) is separate.
Treating the 30-day code deadline as running from the start of performance. The clause counts from contract award.
Ending disclosure readiness at contract close-out. The duty runs to three years after final payment.
Skipping flowdown on commercial subcontracts. 52.204-21 reaches them unless the item is COTS.
Reading a generic checklist instead of the clauses in the contract.

Topic	Page
Commercial products and services acquisitions	FAR Part 12
Defense contractor cybersecurity	DFARS 252.204-7021
Federal information systems	FISMA compliance
Registration and exclusions	SAM.gov
Subcontracting plans	Small business subcontracting plan

FAQ

What is federal contract compliance?

It is meeting the obligations in the FAR and the clauses of your specific federal contract, including ethics, disclosure, cybersecurity and subcontract flowdown.

Does FAR 52.203-13 apply to small businesses?

The written code of conduct requirement applies when the clause is in the contract. The internal control system and ethics awareness program in paragraph (c) do not apply if the contractor represented itself as a small business for the award.