When does DFARS 252.227-7014 apply?

Is the contract delivering noncommercial computer software or noncommercial software documentation to DoD? If yes, 252.227-7014 governs. Commercial off-the-shelf software uses 252.227-7015 with standard commercial licensing. Pure technical data deliverables (drawings, specifications) use 252.227-7013. Was the software developed exclusively at private expense? If yes, the contractor can assert restricted rights. Document the development funding in time and cost records that survive a challenge years later. Does the deliverable include source code, build scripts, or test data? Each component can carry a different rights category. Source delivered under restricted rights with documentation under unlimited rights is a common configuration. Mark each component explicitly.

What are the most common contractor pitfalls under DFARS 252.227-7014?

Open-source components changing the rights analysis: Software that incorporates copyleft or attribution-required open-source components carries license obligations independent of DFARS. The government can exercise its DFARS rights, but the contractor still owes upstream license compliance. Get an SBOM and a license audit before delivery. Treating SBIR data rights as identical to 7014 restricted rights: SBIR data rights are governed by SBIR-specific clauses (252.227-7018) with a different protection period and different scope. Mixing the two regimes in marking practice creates enforceable ambiguity. Delivering build environments without scoping the rights clearly: CI/CD pipelines, container images, and build scripts can be delivered, demanded, or implied as deliverables in modern contracts. If they are not addressed in the rights schedule, the default category may apply unfavorably. Restricted-rights legends that do not match the clause-prescribed text: The clause prescribes specific legend text. Custom or paraphrased legends are routinely held insufficient to assert the intended restriction. Use the exact prescribed wording.

What audit-flag patterns are associated with DFARS 252.227-7014?

Auditors and contracting officers commonly flag: Source code repositories delivered without a restricted-rights or GPR legend on the file headers; SBOM showing open-source components with copyleft licenses not addressed in the rights schedule; Build environment artifacts delivered with no rights category specified; Custom legend text deviating from the clause-prescribed wording; SBIR-funded software marked under 7014 restricted rights rather than the SBIR-specific protection.

DFARS

DFARS 252.227-7014 — Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation

The companion to 252.227-7013 for noncommercial computer software. Establishes unlimited rights, government purpose rights, restricted rights, and specifically negotiated license rights based on development funding.

Citation: 48 C.F.R. § 252.227-7014 (DFARS) · Live text on acquisition.gov

What this clause does

DFARS 252.227-7014 governs the government's license rights in noncommercial computer software and software documentation delivered under DoD contracts. It parallels 252.227-7013 for technical data but adds a fourth category: restricted rights. Restricted rights apply to noncommercial software developed exclusively at private expense and are narrower than the technical-data limited rights category. They generally permit use on a single computer, with backups, and limited transfer rights.

The four categories are: unlimited rights (government-funded development), government purpose rights (mixed funding, with the same five-year commercial restriction as 7013), restricted rights (private-expense noncommercial software), and specifically negotiated license rights (custom terms when none of the standard categories fit). For commercial computer software, contractors usually deliver under 252.227-7015 with the licensor's standard commercial license, subject to government additional rights.

As with technical data, marking is decisive. Software delivered without the proper restrictive legend defaults to broader rights. The clause also addresses delivery of source code, build environments, and documentation. A frequent point of friction in modern DoD software contracts is the interaction between this clause and the government's push for DevSecOps practices that emphasize source-code visibility and continuous delivery, which can collide with traditional restricted-rights software delivery models.

Does this clause apply to my contract?

Three tests resolve applicability. Read each in order; the first "no" usually means the clause does not flow.

1.Is the contract delivering noncommercial computer software or noncommercial software documentation to DoD?
If yes, 252.227-7014 governs. Commercial off-the-shelf software uses 252.227-7015 with standard commercial licensing. Pure technical data deliverables (drawings, specifications) use 252.227-7013.
2.Was the software developed exclusively at private expense?
If yes, the contractor can assert restricted rights. Document the development funding in time and cost records that survive a challenge years later.
3.Does the deliverable include source code, build scripts, or test data?
Each component can carry a different rights category. Source delivered under restricted rights with documentation under unlimited rights is a common configuration. Mark each component explicitly.

Common contractor pitfalls

Patterns that produce questioned costs, back-wage liability, or False Claims Act exposure under this clause.

Open-source components changing the rights analysis
Software that incorporates copyleft or attribution-required open-source components carries license obligations independent of DFARS. The government can exercise its DFARS rights, but the contractor still owes upstream license compliance. Get an SBOM and a license audit before delivery.
Treating SBIR data rights as identical to 7014 restricted rights
SBIR data rights are governed by SBIR-specific clauses (252.227-7018) with a different protection period and different scope. Mixing the two regimes in marking practice creates enforceable ambiguity.
Delivering build environments without scoping the rights clearly
CI/CD pipelines, container images, and build scripts can be delivered, demanded, or implied as deliverables in modern contracts. If they are not addressed in the rights schedule, the default category may apply unfavorably.
Restricted-rights legends that do not match the clause-prescribed text
The clause prescribes specific legend text. Custom or paraphrased legends are routinely held insufficient to assert the intended restriction. Use the exact prescribed wording.

Audit-flag patterns

Specific signals that contracting officers, DCAA, and agency IGs use to surface noncompliance.

Source code repositories delivered without a restricted-rights or GPR legend on the file headers
SBOM showing open-source components with copyleft licenses not addressed in the rights schedule
Build environment artifacts delivered with no rights category specified
Custom legend text deviating from the clause-prescribed wording
SBIR-funded software marked under 7014 restricted rights rather than the SBIR-specific protection

Related clauses

Clauses that flow alongside or interact with DFARS 252.227-7014.

Frequently asked

What does DFARS 252.227-7014 require?: The companion to 252.227-7013 for noncommercial computer software. Establishes unlimited rights, government purpose rights, restricted rights, and specifically negotiated license rights based on development funding.
When does DFARS 252.227-7014 apply?: Is the contract delivering noncommercial computer software or noncommercial software documentation to DoD? If yes, 252.227-7014 governs. Commercial off-the-shelf software uses 252.227-7015 with standard commercial licensing. Pure technical data deliverables (drawings, specifications) use 252.227-7013. Was the software developed exclusively at private expense? If yes, the contractor can assert restricted rights. Document the development funding in time and cost records that survive a challenge years later. Does the deliverable include source code, build scripts, or test data? Each component can carry a different rights category. Source delivered under restricted rights with documentation under unlimited rights is a common configuration. Mark each component explicitly.
What are the most common contractor pitfalls under DFARS 252.227-7014?: Open-source components changing the rights analysis: Software that incorporates copyleft or attribution-required open-source components carries license obligations independent of DFARS. The government can exercise its DFARS rights, but the contractor still owes upstream license compliance. Get an SBOM and a license audit before delivery. Treating SBIR data rights as identical to 7014 restricted rights: SBIR data rights are governed by SBIR-specific clauses (252.227-7018) with a different protection period and different scope. Mixing the two regimes in marking practice creates enforceable ambiguity. Delivering build environments without scoping the rights clearly: CI/CD pipelines, container images, and build scripts can be delivered, demanded, or implied as deliverables in modern contracts. If they are not addressed in the rights schedule, the default category may apply unfavorably. Restricted-rights legends that do not match the clause-prescribed text: The clause prescribes specific legend text. Custom or paraphrased legends are routinely held insufficient to assert the intended restriction. Use the exact prescribed wording.
What audit-flag patterns are associated with DFARS 252.227-7014?: Auditors and contracting officers commonly flag: Source code repositories delivered without a restricted-rights or GPR legend on the file headers; SBOM showing open-source components with copyleft licenses not addressed in the rights schedule; Build environment artifacts delivered with no rights category specified; Custom legend text deviating from the clause-prescribed wording; SBIR-funded software marked under 7014 restricted rights rather than the SBIR-specific protection.

Sources

DFARS clause text — acquisition.gov/dfars/252.227-7014
DCAA Contract Audit Manual — dcaa.mil/Guidance/CAM
Plain-English methodology — FieldLedger methodology

Snapshot date: 2026-05-08. Clause text is binding only as of the version incorporated into your specific contract — check acquisition.gov for the live regulatory text.