Cybersecurity rules in this supplement
The NRC Acquisition Regulation (NRCAR) does not add a general cybersecurity-safeguarding clause in the supplement itself. Its published information rule is privacy-focused:
NRCAR Subpart 2024.1 — Protection of Individual Privacy. Applies Privacy Act handling to covered work.
Note: NRC contracts that involve Safeguards Information or sensitive nuclear information carry separate, statute-driven protection requirements outside the acquisition supplement; for general cybersecurity, the FAR baseline applies.
In plain terms
The NRC supplement adds privacy handling rather than a dedicated cyber clause. Sensitive nuclear information is protected by separate statutory rules, and your general cyber duties come from the FAR baseline.
Who it applies to
NRC contractors and subcontractors; heightened rules apply separately to anyone handling Safeguards or sensitive nuclear information.
What it requires
Follow the FAR baseline for safeguarding information, comply with the Privacy Act provision, and meet any separate Safeguards Information protection requirements your contract imposes.
Why it matters
The supplement itself adds no cyber clause, but nuclear-sensitive work can trigger strict statutory controls — so scoping the right authority matters.
Citation
NRC Acquisition Regulation (NRCAR), codified at 48 C.F.R. Chapter 20.