Controlled unclassified information carries handling and safeguarding duties that ride on the contractor's own systems, not just the deliverable — typically the NIST SP 800-171 control set, with incident reporting on a fixed clock.
Supplement clauses that impose it
Each clause below cites this authority in its own text and directs the contractor or offeror to do something about it.
DFARS — Defense (DoD)
DOLAR — Labor
EDAR — Education
HSAR — Homeland Security
HUDAR — Housing and Urban Development
TAR — Transportation
Clauses that name it without imposing it
These cite the same authority for a different reason — a form that carries a burden statement, or a collection the agency has already had approved — so they are listed apart from the clauses that place a duty on the contractor.
DFARS — Defense (DoD)
EDAR — Education
HSAR — Homeland Security
TAR — Transportation
How this list was built
Every agency FAR supplement published by GSA is parsed in full, and each clause is matched against the statutory authorities cited in its own body text — never its title. A clause counts as imposing the obligation only when a directive addressed to the contractor sits alongside the citation; otherwise it is listed as naming it. That split matters: some clauses mention a statute only because a referenced form carries a burden statement. The controlling version of any clause is the one in the Code of Federal Regulations, linked from that clause's page.