Effective Date: 12/01/2026 (see HHSAR CD 2026-29)
Subpart 340.3 – Safeguarding Information
340.370 Basic safeguarding of HHS information.
340.370-1 Definition.
340.370-2 General.
340.370-3 Contract clause.
Subpart 340.70 – Supply Chain Risk Assessments
340.7000 Scope of subpart.
340.7001 Definitions.
340.7002 Policy.
340.7003 SCRA requirements.
340.7004 SCRA determinations.
340.7005 Contract clause.
Subpart 340.3 – Safeguarding Information
340.370 Basic safeguarding of HHS information.
340.370-1 Definition.
As used in this section—
HHS information—
(1) Means information, in any form or format, that—
(i) Is provided by or on behalf of HHS to the contractor in connection with contract performance; or
(ii) Is collected, created, generated, received, maintained, managed, processed, or otherwise handled by the contractor on behalf of HHS in connection with contract performance.
(2) May include Federal contract information, HHS sensitive information, controlled unclassified information, protected health information, personally identifiable information, Privacy Act records, Federal records, and other information subject to specific protection or handling requirements when the information meets the applicable definition or criteria for that category.
340.370-2 General.
(a) HHS will identify in the contract—
(1) The safeguarding requirements and handling conditions applicable to HHS information, and
(2) When warranted by the nature of the information, the manner in which it is handled, or the circumstances of contract performance; any additional or more restrictive security, privacy, confidentiality, records management, access, use, disclosure, reporting, retention, preservation, disposition, or other requirements.
(b) Contractors must—
(1) Ensure that HHS information is, at a minimum—
(i) Protected against unauthorized access, use, disclosure, release, modification, loss, or destruction; and
(ii) Used, disclosed, released, or disseminated only as authorized by the contract; and
(2) Comply with the specified safeguarding requirements and handling conditions identified in the contract.
340.370-3 Contract clause.
Insert the clause at 352.240-71, Basic Safeguarding of HHS Information, in solicitations and contracts when contract performance may involve handling HHS information.
Subpart 340.70 – Supply Chain Risk Assessments
340.7000 Scope of subpart.
This subpart implements, in part, various statutes, executive orders and policies, including Executive Order 14017 of February 23, 2021, America’s Supply Chains; the HHS Enterprise Supply Chain Risk Management (E-SCRM) Program Policy; and the HHS Cyber Supply Chain Risk Management (C-SCRM) Policy requirement to conduct a supply chain risk assessment on mission-critical acquisitions.
340.7001 Definitions.
As used in this subpart—
Foreign person means as defined in 31 CFR 800.224.
Mission-critical acquisition means an acquisition of products, materials, information, or services that support or involve—
(1) Continuity of operations (COOP) mission essential functions;
(2) Critical infrastructure;
(3) Research and development;
(4) High-value information and communication-based technology (ICT);
(5) Use or sharing of HHS Intellectual property;
(6) Financial databases and services; or
(7) Other critical assets or services as identified by HHS Division leadership.
Supply chain risk means as defined in FAR 40.101.
Supply chain risk assessment (SCRA) means a systematic examination of supply chain threats, risks, or vulnerabilities, likelihoods of their occurrence, and potential impacts.
340.7002 Policy.
HHS will conduct SCRAs on mission-critical acquisitions when required by the E-SCRM and C-SCRM policies to protect the Department's internal supply chain as it relates to threats posed by the activities of foreign and other adversaries toward the acquisition lifecycle of mission-critical products, materials, information, and services.
340.7003 SCRA requirements.
(a) For mission-critical acquisitions, SCRAs—
(1) Will be conducted before award when required by the E-SCRM Program Policy and C-SCRM Policy, and
(2) May be conducted during contract performance when—
(i) There is an active supply chain risk mitigation in place;
(ii) Adverse information is identified during performance;
(iii) There are changes in reporting items in clause 352.240-70;
(iv) The contract is modified to acquire mission-critical products, materials, information, or services;
(v) The Government plans to exercise an option period; or
(vi) The contracting officer determines a SCRA is needed after consultation with the appropriate SCRM personnel.
(b) HHS will perform a SCRA using information submitted in response to the solicitation and other sources.
340.7004 SCRA determinations.
(a) Findings from the SCRA will be considered in connection with a determination of the—
(1) Offeror’s responsibility and eligibility for award, or
(2) Contractor’s eligibility to continue performance on the contract.
(b) Failure to furnish the required information in clause 352.240-70 or additional information as requested by the contracting officer may render the—
(1) Offeror non-responsible and ineligible for award, or
(2) Contractor ineligible to continue performance on the contract.
340.7005 Contract clause.
Insert the clause at 352.240-70, Supply Chain Risk Assessment, in solicitations and contracts for mission-critical acquisitions when required by the E-SCRM and C-SCRM policies.