# 48 CFR § 39.102: 39.102 Management of risk

> Federal · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/ecfr-48-39.102

## Section

- **Citation:** 48 CFR § 39.102
- **Heading:** 39.102 Management of risk
- **Jurisdiction:** Federal
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** September 22, 2026
- **Source:** Publisher's official text
- **Location:** Title 48—Federal Acquisition Regulations System > CHAPTER 1—FEDERAL ACQUISITION REGULATION > SUBCHAPTER F—SPECIAL CATEGORIES OF CONTRACTING > PART 39—ACQUISITION OF INFORMATION TECHNOLOGY > Subpart 39.1—General

## Text

(a) Prior to entering into a contract for information technology, an agency should analyze risks, benefits, and costs. (See part 7 for additional information regarding requirements definition.) Reasonable risk taking is appropriate as long as risks are controlled and mitigated. Contracting and program office officials are jointly responsible for assessing, monitoring and controlling risk when selecting projects for investment and during program implementation.
(b) Types of risk may include schedule risk, risk of technical obsolescence, cost risk, risk implicit in a particular contract type, technical feasibility, dependencies between a new project and other projects or systems, the number of simultaneous high risk projects to be monitored, funding availability, and program management risk.
(c) Appropriate techniques should be applied to manage and mitigate risk during the acquisition of information technology. Techniques include, but are not limited to: prudent project management; use of modular contracting; thorough acquisition planning tied to budget planning by the program, finance and contracting offices; continuous collection and evaluation of risk-based assessment data; prototyping prior to implementation; post implementation reviews to determine actual project cost, benefits and returns; and focusing on risks and returns using quantifiable measures.

## Nearby sections

- [48 CFR § 39.101 39.101 Policy.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.101.md)
- [48 CFR § 39.102 39.102 Management of risk.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.102.md)
- [48 CFR § 39.103 39.103 Modular contracting.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.103.md)
- [48 CFR § 39.104 39.104 Information technology services.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.104.md)
- [48 CFR § 39.105 39.105 Privacy.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.105.md)
- [48 CFR § 39.106 39.106 Contract clause.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.106.md)
- [48 CFR § 39.201 39.201 Scope of subpart.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.201.md)
- [48 CFR § 39.202 39.202 Definition.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.202.md)
- [48 CFR § 39.203 39.203 Applicability.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.203.md)
- [48 CFR § 39.204 39.204 Exceptions.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.204.md)
- [48 CFR § 39.205 39.205 Exemptions.](https://www.frixlaw.com/law-library/statutes/ecfr-48-39.205.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/ecfr-48-39.102. Check the current official text before relying on it. Not legal advice.