An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock
( )
or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
MV-2022-06 with supplement 1
Date of latest supplement: December 12, 2023
MEMORANDUM FOR THE PBS LEASING CONTRACTING WORKFORCE
FROM AND DIGITALLY SIGNED BY: Jeffrey A. Koses, Senior Procurement Executive, Office of Acquisition Policy
SUBJECT: Cyber-supply chain risk management (C-SCRM) requirements for leasing
On this page
Issued 12/12/2023
On September 16, 2022, GSA Acquisition Letter (AL) MV-2022-06 was issued to clarify C-SCRM requirements, including provisions and clauses, that must be considered for inclusion in the acquisition of leasehold interests in real property (lease acquisitions).
The AL contemplated future supplements to:
That supplemental information is here:
Attachment A provides instructions for GSA’s implementation in the leasing of real property to add one new provision and two new clauses based on the following FAR amendments:
The provisions and clauses listed in Attachment A, as well as the considerations in Attachment B, are required, as applicable, in all existing lease contracting actions (including leasing activities delegated by GSA to other Federal agencies) using the following timeline:
Attachment A is updated as follows:
The following C-SCRM provisions and clauses, as applicable, must be included in leasing solicitations and/or contracts. The list below does not reflect the representations and certifications captured through the System for Award Management (SAM.gov) (e.g., FAR provision 52.204-7, System for Award Management, FAR provision 52.204-8, Annual Representations and Certifications, or FAR clause 52.204-19, Incorporation by Reference of Representations and Certifications).
Additions via this supplement are indicated by [bold text in brackets].
| Title | Provision/clause | Where prescribed |
|---|---|---|
| 52.204-2, Security Requirements | Clause | 4.404(a) |
| 52.204-9, Personal Identity Verification of Contractor Personnel | Clause | 4.1303 |
| 52.204-21, Basic Safeguarding of Covered Contractor Information Systems | Clause | 4.1903 |
| 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities | Clause | 4.2004 |
| 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment | Provision | 4.2105(a) (see also LA-20-11) |
| 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment | Clause | 4.2105(b) (see also LA-20-11) |
| 52.204-26, Covered Telecommunications Equipment or Services-Representation | Provision | 4.2105(c) (see also LA-20-11) |
| [52.204-27, Prohibition on a ByteDance Covered Application | Clause | 4.2203 |
| 52.204-29, Federal Acquisition Supply Chain Security Act Orders-Representation and Disclosures | Provision | 4.2306 |
| 52.204-30, Federal Acquisition Supply Chain Security Act Orders-Prohibition [4] | Clause | 4.2306] |
| Title | Provision/clause | Where prescribed |
|---|---|---|
| 552.204-9, Personal Identity Verification Requirements | Clause | 504.1303 |
| 552.270-33, Foreign Ownership and Financing Representation for High-Security Leased Space | Clause | 570.703(c) |
| 552.270-34, Access Limitations for High-Security Leased Space | Clause | 570.703(d) |
Questions regarding this supplement may be directed to GSARPolicy@gsa.gov.
[1] 88 FR 36430
[2] 88 FR 69503
[3] As used in GSAM 570.401.
[4] FAR 4.2306 and 52.204-29 and 52.204-30 are effective 12/04/2023. See 88 Fed. Reg. 69503 (Oct. 5, 2023).
Issued 09/16/2022
The purpose of this acquisition letter (AL) is to clarify the C-SCRM requirements, including provisions and clauses, that must be considered for inclusion in the acquisition of leasehold interests in real property [1] (lease acquisitions).
Almost all of GSA’s procurements, including lease acquisitions, can introduce cybersecurity risks to the Government. For example, Federally leased-facilities may contain building and access control systems—computers that monitor and control building operations such as elevators, electrical power, and heating, ventilation, and air conditioning—that are increasingly being connected to other information systems and the Internet.
Further, the adoption and integration of Internet of Things (IoT) and Industrial Internet of Things (IIoT) devices have led to an increasingly interconnected mesh of systems–not just building and access control systems–which expands the attack surface and blurs the once clear functions of cybersecurity and physical security. [2]
The increased connectivity heightens PBS-leased facilities’ vulnerability to cyber attacks, which could compromise security measures, hamper our Federal tenant agencies’ ability to carry out their missions, or cause physical harm to the facilities or their occupants.
Additionally, as noted in previous GSA Orders [3], a series of recent Government-wide and GSA-specific policy changes have highlighted the importance of the Federal Government’s goal to improve its focus on C-SCRM acquisition and considerations.
This AL supplements those policies by addressing the growing nature of cyber-supply chain risks that must be considered during the pre-award and post-award phases by the lease contracting officer and any other members of the leasing acquisition team.
This AL is effective immediately and remains in effect until rescinded or incorporated into the General Services Acquisition Regulation (GSAR).
GSA is also aware of C-SCRM-related cases on the Regulatory Agenda [4] that will impact GSA, and may be applicable to lease acquisitions. This AL, or the GSAR, may be updated in the future to account for C-SCRM rules impacting lease acquisitions.
Beginning on 10/01/2022, the provisions and clauses listed in Attachment A, as well as the requirement considerations in Attachment B, are required, as applicable, to all new lease contracting actions (including leasing activities delegated by GSA to other Federal agencies). Specifically:
Beginning 10/01/2022, the following leasing templates (as well as any future relevant documents) must be updated to reflect the provisions, clauses, and requirements listed in Attachment A and Attachment B.
The templates must be further updated as additional C-SCRM related laws, statutes, regulations and/or policies are issued to meet deadline dates listed throughout this AL.
In addition, the Office of Leasing shall work expeditiously to revise appropriate policy and templates relevant to the requirements listed under Attachment B, as well as update its policy (e.g., Leasing Alerts (LA), Leasing Desk Guide (LDG)) and templates to reflect any new applicable C-SCRM related laws, statutes, regulations issued, or best practices and recommendations as issued by other GSA offices or agencies.
The FAR or GSAR provisions or clauses must not include any deviations unless an approved deviation specific to the relevant provision or clause is signed by the GSA Senior Procurement Executive. Active deviations can be found on GSA InSite’s Acquisition Policy Library.
The following provisions and clauses, as applicable, must be included in leasing solicitations and/or contracts. The list below does not reflect the representations and certifications captured through FAR provision 52.204-7, System for Award Management, FAR provision 52.204-8, Annual Representations and Certifications, or FAR clause 52.204-19, Incorporation by Reference of Representations and Certifications.
| Title | Provision/clause | Where prescribed |
|---|---|---|
| 52.204-2, Security Requirements | Clause | 4.404(a) |
| 52.204-9, Personal Identity Verification of Contractor Personnel | Clause | 4.1303 |
| 52.204-21, Basic Safeguarding of Covered Contractor Information Systems | Clause | 4.1903 |
| 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities | Clause | 4.2004 |
| 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment | Provision | 4.2105(a) (see also LA-20-11) |
| 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment | Clause | 4.2105(b) (see also LA-20-11) |
| 52.204-26, Covered Telecommunications Equipment or Services-Representation | Provision | 4.2105(c) (see also LA-20-11) |
| Title | Provision/clause | Where prescribed |
|---|---|---|
| 552.204-9, Personal Identity Verification Requirements | Clause | 504.1303 |
| 552.270-33, Foreign Ownership and Financing Representation for High-Security Leased Space | Clause | 570.703(c) |
| 552.270-34, Access Limitations for High-Security Leased Space | Clause | 570.703(d) |
| Policy/reference | GSA Order PBS 3490.3 CHGE 1 |
|---|---|
| Title | Security for Sensitive Building Information Related to Federal Buildings, Grounds, or Property |
| Notes | This Order applies to all entities that handle, receive, and store CUI building information related to GSA-controlled space, as well as to the access to and generation, dissemination, storage, transfer, and disposal of all such information. It also applies to procurements to acquire, alter, or manage space, either Government-owned or leased, including GSA space that is delegated to other Federal agencies. Appendix C (within the Order) includes CUI language for all solicitations containing CUI information (including Requests for Lease Proposals). |
| See also | GSA Order CIO 2103.2, Controlled Unclassified Information (CUI) Policy |
| Policy/reference | LA-18-05 |
|---|---|
| Title | Cybersecurity Measures for Leased Facilities |
| Notes | This leasing alert provides required and recommended measures for lessors related to cybersecurity protections and precautions in leased facilities. Section 2 (within the LA) provides required measures and recommended guidance, and Attachment 1 provides cybersecurity language that was added to Federal Security Level (FSL) templates. |
PBS-leased facilities may include various types of connected systems, such as parts, equipment, services, and technologies that can be a target for cyber-events. Below is a sample list of some of those connected systems. Understanding the needs and mission of your customer agency, as well as any Office of the Chief Information Officer (OCIO) (or similar office) policy the customer may have, can help mitigate C-SCRM risk.
| Common systems in federal facilities | Connected systems |
|---|---|
| Closed circuit camera systems | Cameras, televisions or monitors, and recording equipment, and provide video surveillance capabilities. |
| Access control systems | Card readers, control panels, access control servers, and infrastructure such as door actuators and communications lines, which restrict access to authorized persons. |
| Fire annunciation and suppression systems | Fire alarms, emergency communication equipment, and water-based or nonwater- based suppression systems, designed to prevent, extinguish, or control a fire or other life safety event. |
| Building automation systems (commonly manages the HVAC) | Also known as energy management control systems, provide centralized control—through the use of software and hardware (e.g., computer, modems, sensors, controllers, and printers)—to monitor and adjust building systems (e.g., temperature settings and schedules for running equipment)—such as a building’s cooling systems. |
| Power and lighting control systems | Lighting devices and their controls, advanced-metering controls, power distribution systems, and emergency power or lighting systems, which are also often managed through a building automation system. |
| Elevator control systems | Operating machinery, safety systems, and a control system or panel. |
[1] Except as noted at GSAR 570.101
[2] Cybersecurity and Physical Security Convergence [PDF], Cybersecurity & Infrastructure Security Agency (CISA)
[3] GSAM Case 2021-G511 [PDF] and GSAM Case 2021-G512 [PDF]
[4] Unified Agenda of Regulatory and Deregulatory Actions (Agenda) reports on the actions administrative agencies plan to issue in the near and long term. Released by the Office of Information and Regulatory Affairs, the Agenda provides important public notice and transparency about proposed regulatory and deregulatory actions within the Executive Branch.
[5] GSAM 504.7005
[6] Table in Attachment C are adapted from GAO-15-6
Error, The Per Diem API is not responding. Please try again later.
No results could be found for the location you've entered.
Rates for Alaska, Hawaii, and U.S. territories and possessions are set by the Department of Defense.
Rates for foreign countries are set by the Department of State.
Rates are available between 10/1/2022 and 09/30/2025.
The End Date of your trip can not occur before the Start Date.
Traveler reimbursement is based on the location of the work activities and not the accommodations, unless lodging is not available at the work activity, then the agency may authorize the rate where lodging is obtained.
Unless otherwise specified, the per diem locality is defined as "all locations within, or entirely surrounded by, the corporate limits of the key city, including independent entities located within those boundaries."
Per diem localities with county definitions shall include"all locations within, or entirely surrounded by, the corporate limits of the key city as well as the boundaries of the listed counties, including independent entities located within the boundaries of the key city and the listed counties (unless otherwise listed separately)."
When a military installation or Government - related facility(whether or not specifically named) is located partially within more than one city or county boundary, the applicable per diem rate for the entire installation or facility is the higher of the rates which apply to the cities and / or counties, even though part(s) of such activities may be located outside the defined per diem locality.
An SBA program that helps provide a level playing field for small businesses owned by socially and economically disadvantaged people or entities that meet the following eligibility requirements:
See Title 13 Part 124 of the Code of Federal Regulations for more information.
A multiple-award IDIQ governmentwide acquisition contract offering complete and flexible IT solutions worldwide. A best-in-class GWAC and preferred governmentwide solution, Alliant 2 offers:
It provides best-value IT solutions to federal agencies, while strengthening chances in federal contracting for small businesses through subcontracting.
An agreement established by a government buyer with a Multiple Award Schedule contractor to fill repetitive needs for supplies or services.
Types of funds to use on specific expenses.
The work done to make a structure or system ready for use or to bring a construction or development project to a completed state.
Negotiated firm-fixed pricing on airline seats for official government travel. The locked-in ticket prices for the fiscal year save federal agencies time and money. Federal employees enjoy flexibility to change their plans without incurring penalties or additional costs. All negotiated rates have:
Use the CPP search tool to find current fares.
From 5 USC 5701(6), "continental United States" means the several states and the District of Columbia, but does not include Alaska or Hawaii.
A space where individuals work independently or co-work collaboratively in a shared office. The work environment is similar to a typical office, usually inclusive of office equipment and amenities. Typical features of co-working facilities include work spaces, wireless internet, communal printer/copier/fax, shared kitchens, restrooms and open seating areas. May also be referred to as a “shared office.”
A system that is bought from a commercial vendor to solve a particular problem, as opposed to one that a vendor custom builds.
An employee who negotiates and awards contracts with vendors and who has the sole authority to change, alter or modify a contract.
An employee whose duties are to develop proper requirements and ensure contractors meet the commitments during contract administration, including the timeliness and delivery of quality goods and services as required by the contract.
A request of GSA where a federal agency retains and manages all aspects of the procurement process and is able to work with the selected vendor after award.
An SBA program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
See Title 13 Part 127 Subpart B of the Code of Federal Regulations for more information.
The primary regulation for federal agencies to use when buying supplies and services with funds from Congress.
Use acquisition.gov to browse FAR parts or subparts or download the full FAR in various formats.
The travel and relocation policy for all federal civilian employees and others authorized to travel at government expense.
A program that promotes the adoption of secure cloud services across the federal government by providing a standardized approach to security and risk assessment.
A GSA business line that provides safe, reliable, low-cost vehicle solutions for federal agency customers and eligible entities. Offerings include:
A charge card for U.S. government personnel to use when paying for fuel and maintenance of GSA Fleet vehicles. Find out where the Fleet card is accepted, how to use it and more.
A Department of Homeland Security program that allows members to use expedited lanes at U.S. airports and when crossing international borders by air, land and sea.
A charge card for certain U.S. Government employees to use when buying mission-related supplies or services using simplified acquisition procedures, when applicable, and when the total cost does not exceed micro-purchase thresholds.
A charge card for U.S. government personnel to use when paying for reimbursable expenses while on official travel. Visit smartpay.gsa.gov for more.
A vehicle used to perform an agency’s mission(s), as authorized by the agency.
Pre-competed, multiple-award, indefinite delivery, indefinite quantity contracts that agencies can use to buy total IT solutions more efficiently and economically.
A ceremony marking the official start of a new construction project, typically involving driving shovels into ground at the site.
An online shopping and ordering system at gsaadvantage.gov that provides access for federal government employees and in some cases, state and local entities, to purchase from thousands of contractors offering millions of supplies and services.
An online auction site at gsaauctions.gov that allows the general public to bid on and buy excess federal personal property assets such as:
Real property for which GSA is responsible. It can be either federally owned or leased from a public or private property owner.
An SBA program that gives preferential consideration for certain government contracts to business that meet the following eligibility requirements:
See Title 13 Part 126 Subpart B of the Code of Federal Regulations for more information.
A type of contract when the quantity of supplies or services, above a specified minimum, the government will require is not known. IDIQs help streamline the contract process and speed service delivery.
A fee paid by businesses who are awarded contracts under Multiple Award Schedule to cover GSA’s cost of operating the program. The fee is a fixed percentage of reported sales under MAS contracts that contractors pay within 30 calendar days following the completion of each quarter.
A law that provides $3.375 billion for us to:
This includes $2.15 billion for low embodied carbon materials in construction projects, $975 million to support emerging and sustainable technologies, and $250 million for measures to convert more buildings into High Performance Buildings.
An investment in our nation’s infrastructure and competitiveness. The law provides funding for LPOE modernization projects that will create new good-paying jobs, bolster safety and security, and make our economy more resilient to supply chain challenges.
A written agreement entered into between two federal agencies, or major organizational units within an agency, which specifies the goods to be furnished or tasks to be accomplished by one agency (the servicing agency) in support of the other (the requesting agency).
A facility, also known as a border station, that provides controlled entry into or departure from the United States for persons or materials. It houses the U.S. Customs and Border Protection and other federal inspection agencies responsible for the enforcement of federal laws related to entering into or departing from the U.S.
An employee who is responsible for preparing, negotiating, awarding and monitoring compliance of lease agreements.
Criteria used to select the technically acceptable proposal with the lowest evaluated price. Solicitations must specify that award will be made on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors.
The rate of reimbursement for driving a privately owned vehicle when your agency authorizes it. Current rates are at gsa.gov/mileage.
Long-term governmentwide contracts with commercial firms providing federal, state, and local government buyers access to more than 11 million commercial products and services at volume discount pricing. Also called Schedules or Federal Supply Schedules.
The standard federal agencies use to classify business establishments for the purpose of collecting, analyzing, and publishing statistical data related to the U.S. business economy.
A family of six separate governmentwide multiple award, IDIQ contracts for management and advisory, facilities, technical and engineering, logistics, intelligence services, research and development, environmental, and enterprise solutions.
A formal, signed agreement between GSA’s Public Buildings Service and a federal agency for a specific space assignment.
Services performed under a contract with a federal agency that include:
The per day rates for the lower 48 continental United States, which federal employees are reimbursed for expenses incurred while on official travel. Per diem includes three allowances:
An identification card that allows credentialed government personal to access facilities, computers, or information systems. May also be referred to as HSPD-12 card, LincPass, Smart Card, or CAC.
Furniture and equipment such as appliances, wall hangings, technological devices, and the relocation expenses for such property.
Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. Get our agency's privacy policies and practices as they apply to our employees, contractors, and clients.
You should only drive a privately owned vehicle for official travel after your agency evaluates the use of:
When your agency has determined a POV to be the most advantageous method of transportation, you are authorized reimbursement for mileage and some additional allowances (parking, bridge, road and tunnel fees, etc.).
Approvals from GSA’s congressional authorizing committees, the U.S. Senate Committee on Environment and Public Works and the U.S. House Committee on Transportation and Infrastructure, for proposed capital and leasing projects that require funding over an annually established threshold.
Region 1 (New England): Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont
Region 2 (Northeast and Caribbean): Northern New Jersey, New York, Puerto Rico, U.S. Virgin Islands
Region 3 (Mid-Atlantic): Delaware, parts of Maryland, Southern New Jersey, Pennsylvania, parts of Virginia, West Virginia
Region 4 (Southeast Sunbelt): Alabama, Florida, Georgia, Kentucky, Mississippi, North Carolina, South Carolina, Tennessee
Region 5 (Great Lakes): Illinois, Indiana, Michigan, Minnesota, Ohio, Wisconsin
Region 6 (Heartland): Iowa, Kansas, Missouri, Nebraska
Region 7 (Greater Southwest): Arkansas, Louisiana, New Mexico, Oklahoma, Texas
Region 8 (Rocky Mountain): Colorado, Montana, North Dakota, South Dakota, Utah, Wyoming
Region 9 (Pacific Rim): Arizona, California, Hawaii, Nevada
Region 10 (Northwest Arctic): Alaska, Idaho, Oregon, Washington
Region 11 (National Capital): Washington, D.C., area including parts of Maryland and Virginia
Formal agreements between GSA and a federal agency customer where GSA agrees to provide goods, services, or both, and the federal agency agrees to reimburse GSA’s direct and indirect costs. The customer portal for RWA information is called eRETA at extportal.pbs.gsa.gov.
A document used in negotiated procurements to communicate government requirements to prospective contractors (firms holding Multiple Award Schedule contracts) and to solicit proposals (offers) from them.
A document used to communicate government requirements, but which do not solicit binding offers. Quotations submitted in response are not offers. The Multiple Award Schedule order is the offer, and then the contractor can do something to show acceptance, like ordering supplies or contacting subcontractors.
An SBA program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
See Title 13 Part 128 Subpart B of the Code of Federal Regulations for more information.
An SBA designation for businesses that meet size standards set for each NAICS code. Most manufacturing companies with 500 employees or fewer, and most non-manufacturing businesses with average annual receipts under $7.5 million, will qualify as a small business.
See Title 13 Part 121.201 of the Code of Federal Regulations for more information.
To improve and stimulate small business utilization, we award contracts to businesses that are owned and controlled by socially and economically disadvantaged individuals. We have contracting assistance for:
A Small Business Administration program that gives preferential consideration for certain government contracts to business that meet the following eligibility requirements:
See Title 13 Section 124.1001 of the Code of Federal Regulations for more information.
The basis for the lease negotiation process, which becomes part of the lease. SFOs include the information necessary to enable prospective offerors to prepare proposals. See SFO minimum requirements.
Specific supply and service subcategories within our Multiple Award Schedule. For the Information Technology Category, a SIN might be new equipment or cloud services.
An online system at sam.gov, which the U.S. Government uses to consolidate acquisition and award systems for use by contractors wishing to do business with the federal government. Formerly known as FBO.gov, all contracting opportunities valued over $25,000 are posted at sam.gov.
When you use a government purchase card, such as the "GSA SmartPay" travel card for business travel, your lodging and rental car costs may be exempt from state sales tax. Individually billed account travel cards are not tax exempt in all states. Search for exemption status, forms and important information.
The finishes and fixtures federal agency tenants select that take a space from a shell condition to a finished, usable condition and compliant with all applicable building codes and standards.
A statute that applies to all Multiple Award Schedule contracts, unless otherwise stated in the solicitation or contract, which requires contractors to sell to the U.S. Government only products that are manufactured or “substantially transformed” in the U.S. or a TAA-designated country.
Vendors report transactional data — information generated when the government purchases goods or services from a vendor — to help us make federal government buying more effective.
See our TDR page for which SINs are eligible and which line-item data to submit.
A unique number required to do business with the federal government.
An indicator of how efficiently a federal agency is currently using space, it is traditionally calculated by dividing the usable square feet of the space, by the number of personnel who occupy the space.
A Small Business Administration program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
A governmentwide acquisition contract exclusively for service-disabled veteran-owned small businesses to sell IT services such as:
The amount of solid waste, such as trash or garbage, construction and demolition waste, and hazardous waste, that is reused, recycled or composted instead of being put in a landfill or burned.
A GSA program designed to promote recycling and reuse of solid waste.
A Small Business Administration program that gives preferential consideration for certain government contracts to businesses that meet the following eligibility requirements:
See Title 13 Part 127 Subpart B of the Code of Federal Regulations for more information.
U.S. General Services Administration