Cybersecurity rules in this supplement
The EPA Acquisition Regulation (EPAAR) does not add a general cybersecurity-safeguarding clause. Its information rules cover privacy and information-resource policy:
EPAAR Subpart 1524.1 — Protection of Individual Privacy and clause 1552.211-79 — Compliance with EPA Policies for Information Resource Management. Apply EPA information-management and Privacy Act expectations.
EPAAR clause 1552.227-76 — Project Employee Confidentiality Agreement. Requires confidentiality agreements for project staff.
For cybersecurity obligations, EPA contractors look to the FAR baseline.
In plain terms
EPA's supplement covers privacy and information-management policy plus confidentiality agreements, not a dedicated cyber-safeguarding clause. Your core cyber duties come from the FAR baseline.
Who it applies to
EPA contractors and subcontractors handling EPA information or Privacy Act records.
What it requires
Follow the FAR baseline for safeguarding information, comply with EPA's information-management policy clause, and execute confidentiality agreements where required.
Why it matters
There is no EPAAR-specific cyber clause, so the FAR baseline sets your cybersecurity floor — useful to know when scoping a bid.
Citation
EPA Acquisition Regulation (EPAAR), codified at 48 C.F.R. Chapter 15.