PGI 244.201-70: Information technology.

(a) When contracting for information technology, whether as a service or as a supply, that is a covered system or covered item of supply, consider the need for a consent to subcontract requirement regarding supply chain risk (see DFARS 240.271). In collaboration with the requiring activity, assess the criticality of the component or system to be supplied and potential supply chain risk concerns.

(b) The contracting officer’s written consent to subcontract is necessary when subcontractors are selected or modified during contract performance.

(c) If a potential subcontractor’s risk is beyond the tolerance of the system and mission, the requiring activity must inform the contracting officer. The contracting officer can use the authority granted in section 806 of National Defense Authorization Act for Fiscal Year 2011 (Pub. L. 111-383) to withhold consent for the contractor to subcontract with a particular source or exclude a source from consideration as specified in DFARS 240.271.