(a) This part addresses broad security requirements that apply to acquisitions of products and services. It prescribes policies and procedures for managing information security and supply chain security when acquiring products and services that include, but are not limited to, information and communications technology (ICT).

(b) See part 39 for security-related policies and procedures that only apply to ICT.

(c) See parts 4, 24, and 46 for additional policies and procedures related to managing information security and supply chain security.

(d) Information and supply chain policies and procedures that are unrelated to security are covered in other parts of the FAR (e.g., part 22 for labor and human trafficking risks and part 23 for climate-related risks).