Meet the 15 FAR 52.204-21 safeguarding controls with less effort

FAR 52.204-21 is a US Federal Acquisition Regulation contract clause titled Basic Safeguarding of Covered Contractor Information Systems. It requires contractors to apply 15 basic security controls to any information system they own or operate that processes, stores or transmits Federal Contract Information. The controls include limiting access to authorised users, authenticating users and devices, sanitising media, controlling physical access, patching flaws and running malware protection.

Federal Contract Information is information, not intended for public release, that is provided by or generated for the US Government under a contract to develop or deliver a product or service. It excludes information the Government provides to the public, such as on public websites, and simple transactional information such as that needed to process payments. FCI is the information FAR 52.204-21 is designed to protect.

Any contractor whose federal contract contains FAR 52.204-21 must comply, which happens when the contractor or a subcontractor may have Federal Contract Information on its systems. The clause applies across federal agencies, including to commercial products and services, but not to commercially available off-the-shelf items. Prime contractors must include it in subcontracts where the subcontractor may hold FCI, so suppliers outside the US can be covered too.

The 15 requirements are: limit access to authorised users; limit access to permitted transactions; control external connections; control information posted publicly; identify users; authenticate users; sanitise media before disposal; limit physical access; escort visitors and manage physical access devices; protect system boundaries; separate public-facing components into subnetworks; correct flaws promptly; protect against malicious code; update malware protection; and run periodic and real-time scans.

Failing to meet FAR 52.204-21 is a breach of contract, so the government can use normal contract remedies, which may affect payment, past performance ratings or future awards. Knowingly misrepresenting cyber security compliance can also create liability under the US False Claims Act. The clause does not set a fixed fine, so the consequences depend on the contract and the circumstances.

CMMC Level 1 is built directly on the 15 FAR 52.204-21 requirements, and for Department of Defense contractors it adds an annual self-assessment and affirmation in SPRS. NIST SP 800-171 is a larger set of requirements for protecting Controlled Unclassified Information, which FAR 52.204-21 does not cover. The 15 FAR controls broadly correspond to a subset of NIST SP 800-171 requirements, so meeting them is a useful foundation.

FAR 52.204-21 is a short, mandatory contract clause with 15 basic controls for protecting Federal Contract Information, while ISO 27001 is a voluntary international standard for a full information security management system. Most FAR 52.204-21 controls overlap with ISO 27001 Annex A controls, so an organisation with ISO 27001 will usually already meet much of the clause, but it still needs to confirm each requirement for systems holding FCI.

Yes, on request. FAR 52.204-21 is mapped in OneClickComply's control library and is available on request rather than enabled for every customer by default. Once enabled, you can track all 15 safeguarding controls, collect evidence automatically from connected tools, generate policies and monitor for drift, with evidence reused across CMMC Level 1, ISO 27001 and other frameworks you manage. OneClickComply does not certify compliance.