Private security functions under the FAR and DFARS

← All Insights

1. Where the rules come from

Section 25.302 of the Federal Acquisition Regulation (FAR) carries out statutory rules on contractors performing private security functions abroad (FAR 25.302-1). It implements section 862 of the National Defense Authorization Act for Fiscal Year 2008, as amended by section 853 of the act for 2009 and sections 831 and 832 of the act for 2011. The detailed operating rules sit in 32 CFR part 159, to which the FAR points (FAR 25.302-4). The FAR says the contractor’s duties include making sure employees know and follow relevant orders, keeping personnel records, accounting for weapons, registering and identifying armored vehicles and helicopters, and reporting specified incidents (FAR 25.302-4). How that part works is covered in how private security contractors are governed.

2. What counts as private security

Private security functions are two kinds of contractor activity (FAR 25.302-2). The first is guarding personnel, facilities, designated sites or property of a federal agency, the contractor or subcontractor, or a third party. The second is any other activity for which personnel must carry weapons under the contract.

Two kinds of area trigger the rules. An area of combat operations is one the Secretary of Defense designates when enhanced coordination of contractors performing private security functions for government agencies is required (FAR 25.302-2). Other significant military operations are activities, other than combat, in a contingency operation abroad carried out by American forces in an uncontrolled or unpredictable high-threat environment where security personnel may be called on to use deadly force.

3. When the rules apply

The section applies to contracts requiring performance outside the United States in an area of combat operations designated by the Secretary of Defense (FAR 25.302-3). It also applies in an area of other significant military operations designated by the Secretary of Defense, but only with the agreement of the Secretaries of Defense and State. Once those conditions are met, contractors and subcontractors must comply with 32 CFR part 159. That holds whether private security is the main deliverable or only ancillary to it.

Two exclusions apply (FAR 25.302-3). The section does not apply to contracts by intelligence community elements in support of intelligence activities. Nor does it apply to temporary arrangements on non-Defense contracts for private security by individual local personnel not affiliated with a local or expatriate security company, though those arrangements must still follow local law. The clause at FAR 52.225-26 goes in solicitations and contracts for the designated areas, with closely matching exclusions (FAR 25.302-6).

4. Who gives the instructions

Geographic combatant commanders give Defense Department contractors performing private security functions the guidance and procedures for the operational environment in their area (FAR 25.302-4). In designated areas, the relevant chief of mission gives implementing instructions to non-Defense security contractors, consistent with the combatant commander’s standards. The chief of mission may instead tell non-Defense contractors to follow the combatant commander’s guidance, or that of a sub-unified or joint force commander where the combatant commander has authorized it and told non-Defense agencies.

5. What the contractor must do

The clause applies only to performance in a designated area where a contract is performed in both designated and other areas (FAR 52.225-26). The contractor must make sure all employees responsible for private security comply with 32 CFR part 159 and with orders, directives and instructions identified in the contract. Those cover registering, processing, accounting for, overseeing and keeping records of security personnel, and authorizing and accounting for weapons. They also cover registering and identifying armored vehicles, helicopters and other military vehicles the contractor operates.

Five kinds of incident must be reported (FAR 52.225-26). The first is a weapon discharged by security personnel, and the second is security personnel being attacked, killed or injured. The third is people killed or injured, or property destroyed, through contractor personnel’s conduct. The fourth is a weapon discharged, or believed discharged, against security personnel. The fifth is the use of active non-lethal countermeasures, other than discharging a weapon, against a perceived immediate threat.

The contractor and its security employees must be briefed on, and understand, four sets of obligations (FAR 52.225-26). The first is the qualification, training, screening and security requirements of 32 CFR part 159, including thorough background checks where applicable. The second is American and host country law and applicable treaties and international agreements. The third is orders of the combatant commander or chief of mission on weapons, equipment, force protection, security, health, safety and relations with locals. The fourth is their rules on the use of force.

6. Investigations

The contractor must fully cooperate with any government-authorized investigation of reported incidents and alleged misconduct by security personnel, giving access to employees and relevant information it holds (FAR 52.225-26). Full cooperation means disclosing enough to identify the nature and extent of the incident and the individuals responsible, and responding promptly and completely to auditors’ and investigators’ requests. It does not require waiving attorney-client privilege or work product protection, or the Fifth Amendment rights of any officer, director, owner or employee. It does not stop an internal investigation or the defense of a proceeding.

7. Remedies

Besides other remedies, the contracting officer may direct the contractor, at its own expense, to remove and replace security personnel who fail to comply (FAR 25.302-5). Failures must be recorded in past performance databases and considered in responsibility determinations and past performance evaluations. On award-fee contracts, they must be considered in the performance evaluation and may justify reducing, denying or recovering award fees. Severe, prolonged or repeated failures must be referred to the suspending and debarring official.

The contractor’s duty is not reduced by a failure of a higher-tier or lower-tier contractor or subcontractor, or by a lack of oversight by the contracting activity (FAR 52.225-26). The clause flows down to all subcontracts performed in the designated areas.

8. The Defense Department clause

Defense contracts use DFARS clause 252.225-7039 instead of the FAR clause, including for commercial products and services (DFARS 225.302-6). It applies in five settings rather than two. They are contingency operations, designated combat operations, designated other significant military operations with the Secretary of State’s agreement, peace operations consistent with Joint Publication 3-07.3, and other military operations or exercises designated by the combatant commander.

The Defense clause, dated January 2023, follows the FAR clause closely, and its requirements add three things (DFARS 252.225-7039). Weapons carried by, or available to, security personnel must be registered in the Synchronized Predeployment and Operational Tracker (SPOT), as must armored vehicles, helicopters and other military vehicles. Incidents are reported in line with the combatant commander’s orders and instructions. The contractor must also comply with ANSI/ASIS PSC.1-2012, the American standard for quality management of private security company operations, or with International Standard ISO 18788. The clause flows down to subcontracts, including commercial ones, performed in the designated areas.

Key terms

Private security functions	Guarding people, sites or property, or any armed contract activity.
Area of combat operations	An area the Secretary of Defense designates for enhanced coordination of security contractors.
Other significant military operations	Non-combat contingency operations in a high-threat environment where deadly force may be needed.
Full cooperation	Disclosure and access in investigations, without waiving privilege or constitutional rights.
SPOT	The Defense tracking system where security contractors register weapons and vehicles.
Reportable incident	One of five events, from weapon discharges to non-lethal countermeasures, that must be reported.

Every statement above links to the document behind it. The full source list for this piece is on the sources page.

This page describes public United States government programs for general information. It is not legal, regulatory or procurement advice, and it does not address the facts of any particular case.

How Sentfore supports this

Protective security abroad has to meet these requirements from the first day. Sentfore works at the delivery end of defense programs in difficult environments, providing secure movement, protective security, facilities and life support. Requirements can be sent through the contact page.