A FASCSA order is an order under the Federal Acquisition Supply Chain Security Act that can require removal of covered articles from federal systems or exclude named sources or articles from procurement. Suppliers find applicable orders in SAM by searching for "FASCSA order," and in some cases in the solicitation itself.
Definitions
FASCSA stands for the Federal Acquisition Supply Chain Security Act. Covered article and covered source are the products and vendors an order names. A FASCSA order is the instrument that names them.
According to FAR subpart 4.23, three officials can issue orders: the DHS Secretary for civilian agencies, the Secretary of Defense for DoD and national security systems other than certain compartmented systems, and the Director of National Intelligence for the intelligence community. The subpart's authority is stated to expire on 31 December 2033.
What it means for a supplier
Under the subpart, agencies may not procure covered articles, or products and services from a covered source, under an applicable order. The text says this includes a contractor's use of them. That is why the question reaches software suppliers: a component or a service you use inside your own offering could matter.
Where to look
| Situation | Where the order is found |
|---|---|
| Most orders | In SAM, searching for "FASCSA order" |
| Some orders | Identified in the solicitation by the requiring activity, because they are not listed in SAM |
The clauses you may see
| Clause | What it is, per FAR 4.2306 |
|---|---|
| 52.204-28 | Used in basic solicitations and contracts for certain schedules and multi-agency vehicles where orders apply at the order level |
| 52.204-29 | A representation and disclosure provision used in most solicitations |
| 52.204-30 | The prohibition clause, with alternates for specific situations |
If an offeror submits a disclosure under 52.204-29, the contracting officer decides whether to seek a waiver or not make the award. If a contractor submits a report under 52.204-30(c), the contracting officer engages the agency's supply chain risk management program.
Practical steps for a software supplier
- Keep a current inventory of components and hosted services you rely on. An SBOM covers software components, and a vendor list covers services.
- Assign one person to check SAM when you respond to a solicitation and again before award.
- Read which of the three clauses appear in the solicitation.
- Route questions on representations to your contracts counsel. This is a legal duty, and this post is not legal advice.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how each component is listed with its source. A searchable inventory is what makes an order check quick.
Quick check
Is a FASCSA order the same as an SBOM requirement?
No. An order is about excluding named sources or articles. An SBOM helps you find out whether you use one.
Do all orders appear in SAM?
No. The subpart says some are not listed in SAM and must be identified in the solicitation.
Safeguard provides SBOM and dependency scanning and asset discovery, which supports building that inventory. The free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
