Keep TikTok off contract devices and stay FAR 52.204-27 compliant

FAR 52.204-27 is the Federal Acquisition Regulation clause titled Prohibition on a ByteDance Covered Application. It bars contractors from having or using TikTok, or any successor app or service developed or provided by ByteDance Limited or an entity it owns, on information technology owned or managed by the Government or used or provided by the contractor under the contract. It implements the No TikTok on Government Devices Act.

Any contractor or subcontractor whose federal contract includes the clause must comply. FAR 4.2203 directs contracting officers to insert it in solicitations and contracts, and paragraph (c) requires the substance of the clause in all subcontracts, including those for commercial products and commercial services. In practice, most businesses working on US federal contracts should expect to see it.

Yes, where the device is used or provided under the contract. The clause covers information technology used or provided by the contractor under the contract, including equipment provided by the contractor's employees. A personal phone used for contract work is therefore in scope. Equipment acquired by a contractor that is only incidental to a federal contract falls outside the definition of information technology.

Only a narrow one. The prohibition does not apply if the Contracting Officer gives the contractor written notification that an exception has been granted in accordance with OMB Memorandum M-23-13. Contractors cannot grant themselves an exception, so without that written notice the ban applies to all in-scope information technology.

They cover different risks. FAR 52.204-27 bans one named application, TikTok and other ByteDance services, on contract IT. FAR 52.204-21 sets 15 basic safeguarding requirements for contractor systems handling federal contract information. FAR 52.204-25 prohibits covered telecommunications and video surveillance equipment and services, such as those from Huawei and ZTE. A single contract often includes all three.

A breach is a failure to meet a contract term, so the contracting agency can use its normal contract remedies. The clause itself does not set a specific penalty. Consequences depend on the contract and the circumstances, so contractors should treat the prohibition like any other contractual obligation and keep evidence that covered applications are absent from in-scope devices.

Start by identifying every device used or provided under the contract, including employee devices. Remove or block TikTok and other ByteDance apps through mobile device management or endpoint controls, write the ban into acceptable use and BYOD policies, and insert the clause into all subcontracts. Then keep monitoring and retain evidence, because new devices and app installs can reintroduce the risk.

FAR 52.204-27 is mapped in OneClickComply's control library and available on request. Once enabled, OneClickComply can collect device evidence from connected tools, alert you when controls drift, generate policies that reflect the prohibition and reuse that evidence across related frameworks such as FAR 52.204-21, NIST SP 800-171 and CMMC.