FAR Clause Renumbering: What Contractors Must Fix Now

by adiit • 
September 22, 2026 • 5 min read

The FAR Council wants to move every clause in the Federal Acquisition Regulation out of the 52.2 series and into a new 52.4 series. That single change, buried inside four proposed rules published June 23, 2026, is easy to dismiss as clerical. It is not. New solicitations are already using revised clause numbers, and a proposal team, subcontracts group, or capture manager still citing the old numbering scheme is one compliance matrix away from a real problem. The comment period on these proposed rules closed July 23, and the final rules could take effect before most contractors have finished updating their templates.

The FAR Clause Renumbering Explained

This is Phase Two of the Revolutionary FAR Overhaul, the rulemaking process that began in 2025 with a series of class deviations most agencies have already adopted. Phase Two moves from informal deviation into formal notice-and-comment rulemaking, and the FAR Council intends to issue twelve proposed rules in total, eventually revising all 53 parts of the FAR. Four of those rules dropped on June 23, covering twenty parts and their associated clauses.

Each of the four rules includes the same proposal buried in its clause discussion: relocate every clause currently in Subpart 52.2 to a new Subpart 52.4. If adopted, clause numbers across the entire FAR would begin with 52.4 instead of 52.2. The Council's stated reason is clarity, drawing a hard line between clauses under the old FAR and clauses under the overhauled version so nobody accidentally applies deviation-era language to a post-overhaul contract. Comments on how the change affects contractors and agencies were due alongside the broader rulemaking comment period.

This Has Already Happened Once

Contractors do not need to imagine what this looks like in practice. It already happened to the basic safeguarding clause. FAR 52.204-21, the clause requiring the 15 basic security controls for Federal Contract Information, was renumbered to FAR 52.240-93 under an earlier class deviation, months before the current renumbering proposal existed. Anyone still citing 52.204-21 in a proposal template today is citing a clause number that solicitations have already moved past. The 52.2-to-52.4 renumbering is the same pattern, applied at the scale of the entire regulation instead of one clause.

Why It Is Not Just Cosmetic

Clause renumbering interacts with substance in ways that matter for compliance teams specifically. FAR Case 2026-001 folds the security and supply chain restrictions previously scattered across Part 4 into an expanded Part 40, which now absorbs seven open rulemakings at once, including the Controlled Unclassified Information rule, Section 889 telecommunications restrictions, and the American Security Drone Act prohibitions. A compliance matrix that still points to Part 4 for CUI handling is pointing at the wrong part of the regulation, not just an outdated clause number.

The changes to FAR Part 33 raise the stakes for capture and proposal teams in a different way. The overhaul strengthens the agency-level bid protest process, requiring contracting officers to report protests up the chain and giving protesters access to redacted evaluation records they did not previously see. GAO's bid protest guidance describes how the current process works, and teams tracking a live protest need to understand which version of Part 33 governs their case, since the timeline for the transition matters as much as the substance.

Real-World Implications for Proposal and Compliance Teams

Solicitations issued today may cite either the current 52.2 numbering or early references to the proposed 52.4 scheme, depending on which agency issued them and how quickly that agency's contracting shop adopted the deviation guidance. That inconsistency is the actual risk. A proposal boilerplate library built around one numbering convention will misfire against a solicitation built around the other, and the mismatch will not always be obvious to a reviewer skimming a 40-page compliance matrix under deadline pressure.

Subcontract flow-down language carries the same exposure, and it compounds. A prime contractor that flows down an outdated clause citation to a subcontractor is passing along a defect that neither party may catch until a compliance audit or a post-award review surfaces it. Teaming agreements drafted before June 2026 are especially exposed, since many were finalized before the four proposed rules existed.

There is also a timing question capture managers should not ignore. The FAR Council gave industry a 30-day comment window, shorter than typical, which signals the Council wants to move quickly toward final rules. Wiley Rein's government contracts practice, tracking the overhaul closely, expects final rules to take effect sometime in 2026 without a published date yet attached. Waiting for a final rule before updating internal references means waiting for a moving target.

Tactical Recommendations

  1. Audit every active proposal template and compliance matrix for FAR and DFARS clause citations, flagging any that reference Part 4, Part 10, or Part 18, since each has been reorganized or marked reserved under the proposed rules. (Section 3)
  2. Cross-reference subcontract flow-down clauses against the current solicitation, not against the flow-down language used on your last award, before submitting a new proposal or renewing a teaming agreement. (Section 4)
  3. Confirm which numbering convention a live solicitation is using before assembling your compliance matrix, since agencies are adopting the overhaul at different speeds. (Section 4)
  4. Assign one person to track the FAR Council's final rule publication for FAR Cases 2026-001, 2026-002, 2026-005, and 2026-007, rather than relying on each proposal team to notice independently. (Section 2)
  5. Treat the CUI consolidation into Part 40 as a trigger to re-verify your organization's CUI scoping, not just a citation update. (Section 3)

Contractors who get ahead of this now avoid the scramble that hits every proposal shop when a final rule lands without warning. Atlantic Digital's CMMC Strategy Experts maintain a current crosswalk between legacy and overhauled clause numbers as part of ongoing compliance support, so clients are not relying on a single person's memory of which part governs what. For organizations managing multiple active solicitations across this transition, Atlantic Digital's vCISO Services fold clause and control tracking into a single ongoing engagement instead of a one-time cleanup project.

Contact us today to learn more.

Frequently Asked Questions

Do I need to update my proposals right now to use 52.4 clause numbers? Not yet. The 52.2-to-52.4 renumbering is a proposal open for comment, not a final rule, so current solicitations still cite 52.2-series numbers unless an agency has separately adopted a class deviation. Contractors should track the transition and update templates as final rules publish rather than switching preemptively.

Is the FAR renumbering final? No. The FAR Council published four proposed rules on June 23, 2026, with comments due July 23. The proposed rules do not state when final rules will take effect, though the shortened comment period suggests the Council intends to move quickly.

What happens if I cite the old clause number in a solicitation response? Citing a superseded clause number can create a mismatch between your proposal and the solicitation's actual requirements, which a reviewer or contracting officer may flag during evaluation. The safer approach is verifying the clause numbering against the specific solicitation rather than a standing template.

Does this renumbering affect subcontract flow-down clauses? Yes. Flow-down clauses reference the same FAR and DFARS numbering as prime contracts, so any renumbering at the prime level needs to be verified and updated in subcontract templates and teaming agreements before those documents are reused on a new award.

hello world!

Future-Proof Framing

Don’t Just Secure Your Business.
Build Compliance That Lasts.

CMMC forces change. Architecture makes it sustainable. Secure Start builds it right from day one.
Schedule a CMMC Readiness Consultation  →
Let’s build the architecture your compliance program depends on.

Related Posts

View All
5 min to read
Understanding the Cybersecurity Maturity Model Certification (CMMC) 2.0
‍In today's digital age, the threat of data breaches and cyberattacks is ever-present. This is […]
The Importance of Secure Smart Devices in the Modern World
‍In today's interconnected world, the proliferation of network-connected products has revolutionized the way we live […]
SEC Final Rules on Cybersecurity: A Comprehensive Analysis
‍The Securities and Exchange Commission (SEC) recently released its long-anticipated final rules on cybersecurity risk […]
1 2 3 … 14
© 2026 Atlantic Digital. All rights reserved.
linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram