Skip to main content
Comply Defense
Category: Contracting & Acquisition

Federal Acquisition Regulation

Also known as: FAR, Title 48 of the Code of Federal Regulations
Simply put

The Federal Acquisition Regulation (FAR) is the primary set of rules that federal executive branch agencies follow when they buy goods and services using appropriated funds. It establishes what contractors can and cannot charge the government and governs how government purchasing is conducted.

Formal definition

The FAR is the primary regulation used by all executive agencies for the acquisition of supplies and services with appropriated funds, codified in Title 48 of the Code of Federal Regulations (C.F.R.). It generally governs procurement of goods and services by executive branch agencies and addresses cost allowability under government contracts. Note that this entry defines the FAR at a conceptual level based on the evidence provided; it does not cover specific FAR parts, clause numbers, agency supplements (such as the DFARS for the Department of Defense), or contractual and legal specifics, which readers should verify against the current authoritative text in Title 48 C.F.R.

Why it matters

The FAR is the foundational rulebook for how federal executive branch agencies acquire goods and services using appropriated funds. For compliance officers, contractors, and auditors, it establishes the baseline expectations that govern the government's relationship with its suppliers, including what costs may be charged to the government under a contract. Because cybersecurity and information protection obligations are increasingly embedded into federal contracts through contract clauses, understanding the FAR as the parent framework is essential context for anyone tracing where a specific requirement originates.

A common mistake is to treat the FAR as if it stands alone or is uniformly applied across every federal buyer. In practice, individual agencies issue supplements that add to or tailor the FAR for their own missions, for example, the Department of Defense maintains the Defense Federal Acquisition Regulation Supplement (DFARS). Assuming that base FAR coverage captures every obligation a contractor faces can lead to overlooked defense-specific or agency-specific requirements. Readers should confirm which supplement applies to a given acquisition rather than relying on the FAR alone.

Another frequent error is conflating the FAR's focus on cost allowability and procurement procedure with security or compliance certification. The FAR governs how purchasing is conducted and what can be charged to the government; it is not itself a security control framework. Where cybersecurity or CUI-handling obligations flow into a contract, those requirements typically originate in other authorities and are incorporated through specific clauses. Practitioners should verify the exact FAR parts, clause numbers, and applicable supplements against the current authoritative text in Title 48 C.F.R.

Who it's relevant to

Government Contractors
Contractors selling supplies or services to federal executive branch agencies are subject to the FAR, including its rules on what costs are allowable and how procurement is conducted. Contractors should also confirm whether an agency-specific supplement, such as the DFARS for defense work, imposes additional obligations, and verify applicable clause language against the current Title 48 C.F.R. text.
Compliance Officers and Auditors
Those responsible for ensuring adherence to contract terms and for auditing charges to the government rely on the FAR as the baseline framework governing procurement and cost allowability. They should distinguish the FAR's procurement and cost rules from separate security or cybersecurity requirements, and trace any such requirements to their originating authority and the specific clauses that incorporate them.
Federal Acquisition and Contracting Personnel
Contracting officers and acquisition staff within executive branch agencies apply the FAR when purchasing goods and services with appropriated funds. Personnel in agencies with their own supplements, such as DoD contracting staff working under the DFARS, must apply both the FAR and the applicable supplement, and should confirm current provisions before relying on them.

Inside FAR

Uniform Acquisition Policies
The FAR establishes the primary set of rules governing how federal executive agencies acquire supplies and services through appropriated funds, providing a common baseline across most of the federal government.
Parts and Subparts Structure
The FAR is organized into numbered parts and subparts addressing distinct phases and topics of the acquisition process, such as competition, contract types, and contract clauses; practitioners should consult the current official text for the specific organization applicable to their situation.
Contract Clauses and Provisions
The FAR prescribes standard clauses and solicitation provisions that are incorporated into federal contracts. Cybersecurity-relevant requirements may be imposed through these clauses, and readers should verify the exact clause language and numbering against the current authoritative source.
Agency Supplements
Individual agencies issue supplements that implement or add to the FAR for their own acquisitions. For defense acquisitions, the Defense Federal Acquisition Regulation Supplement (DFARS) applies in addition to the FAR, and the two should not be treated as interchangeable.
Scope of Applicability
The FAR generally applies to acquisitions by federal executive agencies. State, local, tribal, and territorial procurement obligations differ, and certain national security or specialized acquisitions may follow distinct rules that readers must confirm.

Common questions

Answers to the questions practitioners most commonly ask about FAR.

Does the FAR contain the specialized cybersecurity clauses that apply to defense contracts handling CUI?
Not primarily. The FAR is the government-wide baseline regulation for federal executive agency acquisitions, but the Department of Defense adds requirements through the Defense Federal Acquisition Regulation Supplement (DFARS), which is a separate supplement, not part of the FAR itself. The more specialized safeguarding and incident-reporting obligations tied to CUI on defense contracts are generally implemented through DFARS clauses rather than the base FAR. Because agency supplements can impose obligations beyond the FAR, readers should confirm which document governs their specific contract and verify the current text of both the FAR and any applicable agency supplement.
Is compliance with a FAR clause the same as being secure?
No. Meeting the requirements stated in a FAR clause demonstrates contractual compliance with a specified obligation, but compliance and security are distinct. A FAR clause typically establishes a minimum expectation or a required practice; satisfying it does not by itself guarantee that a system or organization is secure against threats. Effective security generally requires ongoing risk management, monitoring, and practices that may exceed what any single clause mandates. Contractors should treat FAR compliance as one input to a broader security posture, not a substitute for it, and confirm obligations against the current authoritative regulation.
How do I find which FAR clauses apply to a particular contract?
Applicable clauses are generally identified in the solicitation and resulting contract, most often in the sections that list contract clauses and representations. The FAR uses prescriptive language that directs contracting officers when to include specific clauses based on factors such as contract type, dollar value, and subject matter. Because inclusion depends on the contracting officer's application of these prescriptions and on any agency supplements, the authoritative source for what applies to your award is the contract document itself. Verify each clause against the current official FAR text and any incorporated supplement.
Where do I locate the current, authoritative text of the FAR?
The FAR is maintained and published through the federal acquisition regulatory process and is available in official government sources that reflect the current consolidated text. Because the FAR is amended over time through the rulemaking process, the version applicable to a given contract may correspond to a particular date or edition. Readers should confirm they are consulting the current official text rather than a cached or third-party copy, and should note the applicable edition when a contract references specific clause language.
How does a clause incorporated 'by reference' differ from one written out in full in my contract?
A clause incorporated by reference is cited by its clause number and title without reproducing the full text in the contract document, whereas a clause incorporated in full includes the complete language. Both are generally treated as legally effective parts of the contract. When a clause is incorporated by reference, the contractor is responsible for obtaining and reviewing the referenced text from the authoritative source. Because the operative language governs your obligations, confirm the exact wording and the applicable edition, and consult the contracting officer if the reference is ambiguous.
How should I handle FAR obligations that must flow down to subcontractors?
Certain FAR clauses require the prime contractor to include specified clauses in subcontracts, commonly referred to as flow-down requirements. The obligation to flow down, and the precise clauses subject to it, is stated within the individual clauses rather than being uniform across the FAR. Prime contractors should review each applicable clause to determine whether flow-down is required and to what tier, and should confirm the current clause text. Because agency supplements may impose additional flow-down obligations, this general answer does not cover contract-specific or legal determinations, which should be verified with counsel or the contracting officer.

Common misconceptions

The FAR and the DFARS are the same thing, so meeting FAR requirements automatically satisfies defense contracting obligations.
The DFARS is a defense-specific supplement that adds to and implements the FAR for DoD acquisitions. Defense contractors generally must comply with both, and DFARS provisions, such as those addressing safeguarding of Controlled Unclassified Information, impose obligations beyond the baseline FAR that readers must verify against the current text.
Complying with FAR contract clauses is the same as being secure or fully compliant with cybersecurity frameworks.
Contractual compliance through FAR or supplemental clauses is distinct from achieving actual security or from meeting separate authorization requirements such as those under the RMF, FISMA, or FedRAMP. A contractor may satisfy a clause's stated terms while still needing to demonstrate security controls under other governing authorities.
The FAR text is static, so a clause number or requirement learned once remains accurate.
The FAR and its agency supplements are revised over time, and specific clauses, numbering, and requirements can change. Practitioners should confirm the current effective language against the official published source rather than relying on remembered or dated versions.

Best practices

Always confirm the exact clause numbers, provision language, and effective revisions against the current official FAR text rather than relying on summaries or prior versions.
For DoD-related acquisitions, review both the FAR and the applicable DFARS supplement, treating them as complementary rather than interchangeable.
Distinguish contractual compliance obligations from separate security authorization and assessment requirements imposed under other authorities, and address each on its own terms.
Verify whether the FAR applies to your acquisition scenario, recognizing that state, local, tribal, territorial, and certain specialized acquisitions may follow different rules.
Track updates to the FAR and its agency supplements so that contract requirements reflect the currently governing language.
When a requirement's applicability or interpretation is unclear, consult contracting and legal specialists and the authoritative published source before acting.