(f) The following DOT provisions and clauses are authorized for use in acquisitions of commercial products or commercial services when required by the individual provision or clause prescription:

(1) 1252.201-70, Contracting Officer's Representative.

(2) 1252.204-70, Contractor Personnel Security and Agency Access.

(3) 1252.209-70, Organizational and Consultant Conflicts of Interest.

(4) 1252.209-71, Limitation of Future Contracting.

(5) 1252.211-70, Index for Specifications.

(6) 1252.216-70, Evaluation of Offers Subject to an Economic Price Adjustment Clause.

(7) 1252.216-71, Determination of Award Fee.

(8) 1252.216-72, Award Fee Plan.

(9) 1252.216-73, Distribution of Award Fee.

(10) 1252.216-74, Settlement of Letter Contract.

(11) 1252.222-70, Strikes or Picketing Affecting Timely Completion of the Contract Work.

(12) 1252.222-71, Strikes or Picketing Affecting Access to a DOT Facility.

(13) 1252.223-70, Removal or Disposal of Hazardous Substances—Applicable Licenses and Permits.

(14) 1252.223-71, Accident and Fire Reporting.

(15) 1252.223-73, Seat Belt Use Policies and Programs.

(16) 1252.232-70, Electronic Submission of Payment Requests.

(17) 1252.237-70, Qualifications of Contractor Employees.

(18) 1252.237-71, Certification of Data.

(19) 1252.237-72, Prohibition on Advertising.

(20) 1252.237-73, Key Personnel.

(21) 1252.239-70, Security Requirements for Unclassified Information Technology Resources.

(22) 1252.239-71, Information Technology Security Plan and Accreditation.

(23) 1252.239-72, Compliance with Safeguarding DOT Sensitive Data Controls.

(24) 1252.239-73, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

(25) 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident Reporting.

(26) 1252.239-75, DOT Protection of Information About Individuals, PII, and Privacy Risk Management Requirements.

(27) 1252.239-76, Cloud Computing Services.

(28) 1252.239-77, Data Jurisdiction.

(29) 1252.239-78, Validated Cryptography for Secure Communications.

(30) 1252.239-79, Authentication, Data Integrity, and Non-Repudiation.

(31) 1252.239-80, Audit Record Retention for Cloud Service Providers.

(32) 1252.239-81, Cloud Identification and Authentication (Organizational Users) Multi-Factor Authentication.

(33) 1252.239-82, Identification and Authentication (Non-Organizational Users).

(34) 1252.239-83, Incident Reporting Timeframes.

(35) 1252.239-84, Media Transport.

(36) 1252.239-85, Personnel Screening—Background Investigations.

(37) 1252.239-86, Boundary Protection—Trusted Internet Connections.

(38) 1252.239-87, Protection of Information at Rest.

(39) 1252.239-88, Security Alerts, Advisories, and Directives.

(40) 1252.239-89, Technology Modernization.

(41) 1252.239-90, Technology Upgrades/Refreshment.

(42) 1252.239-91, Records Management.

(43) 1252.239-92, Information and Communication Technology Accessibility Notice.

(44) 1252.239-93, Information and Communication Technology Accessibility.

(45) 1252.242-70, Dissemination of Information—Educational Institutions.

(46) 1252.242-71, Contractor Testimony.

(47) 1252.242-72, Dissemination of Contract Information.