(a) The requirements in 39.203 do not apply to acquisitions for—

(1) National security systems. ICT operated by agencies as part of a national security system, as defined by 40 U.S.C. 11103(a);

(2) Incidental contract items. ICT acquired by a contractor incidental to a contract, i.e., for in-house use by the contractor to perform the contract; or

(3) Maintenance or monitoring spaces. The portions of ICT that are operable parts (i.e., hardware-based user controls for activating, deactivating, or adjusting ICT) or status indicators, and that are located in spaces frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment.

(b) The contracting officer shall receive, as a part of the requirements documentation, written confirmation from the requiring activity that an exception, in accordance with paragraph (a)(1), (2), or (3) of this section, applies to the ICT supply or service (see 7.105(b)(5)(iv)). This documentation shall be maintained in the contract file.