FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems
Establishes 15 basic cybersecurity controls federal contractors must implement on systems processing or storing Federal Contract Information (FCI).
When This Clause Applies
Required in all federal contracts (FAR-based) above the micro-purchase threshold involving FCI, except for COTS commercial items.
What This Means for Contractors
Contractors must implement the 15 listed controls (access control, identification & authentication, media protection, physical protection, system & communications protection, system & information integrity). For DoD work, satisfied by NIST 800-171 implementation. For civilian work, this is often the only cyber requirement.
Common Pitfalls
- 1Assuming this clause is only for IT vendors — it applies to anyone handling FCI
- 2Skipping flow-down to subcontractors
- 3Not documenting implementation in case of an audit
Related Topics
Related Clauses
Safeguarding Covered Defense Information and Cyber Incident Reporting
Requires DoD contractors and subcontractors handling Covered Defense Information (CDI) to implement NIST SP 800-171 security controls and report cyber incidents within 72 hours.
Cybersecurity Maturity Model Certification Requirements
Implements the CMMC program — requires contractors handling FCI or CDI to achieve and maintain a CMMC certification at the level specified in the solicitation.
Continue Your Research
DoD Procurement Guide
Cybersecurity clauses primarily apply to DoD acquisitions. See DoD's vehicles and small business focus.
NAICS 518210 — Data Processing, Hosting, and Related Services
Find federal contracts under NAICS 518210. Common agencies, set-asides, contract values.
NAICS 541330 — Engineering Services
Find federal contracts under NAICS 541330. Common agencies, set-asides, contract values.
Browse Full FAR Clause Library
All FAR and DFARS clauses we've documented with plain-English summaries.
GovCon Compliance Blog
Latest guidance on FAR/DFARS updates, CMMC, NIST 800-171, and capture strategy.
Need help complying with FAR 52.204-21?
Aliff helps GovCon firms map clause requirements to deliverables, build compliance evidence, and respond to CO inquiries with confidence.