52.204-21 Basic Safeguarding of Covered Contractor Information Systems
Source: FAR 52.204-21 on acquisition.gov
Contractors handling Federal contract information must implement and maintain specific baseline cybersecurity safeguards and flow these requirements down to eligible subcontractors.
Overview
FAR 52.204-21 establishes mandatory minimum safeguarding requirements for contractor information systems that process, store, or transmit Federal contract information (FCI). The clause defines key terms and outlines 15 specific security controls that contractors must implement to protect FCI from unauthorized access, disclosure, or loss. These requirements apply to both prime contractors and applicable subcontractors, including those providing commercial products or services (excluding COTS items). The clause also clarifies that these are baseline requirements and do not supersede any additional safeguarding obligations imposed by agencies or for controlled unclassified information (CUI).
Key Rules
- Definitions and Scope
- Clearly defines covered contractor information systems, Federal contract information, and safeguarding measures.
- Mandatory Security Controls
- Contractors must implement 15 specific security controls, including access restrictions, authentication, physical security, monitoring, malware protection, and timely flaw remediation.
- Subcontractor Flowdown
- The clause must be flowed down to applicable subcontracts where FCI may be present, except for COTS items.
- Additional Requirements
- Does not relieve contractors of other agency-specific or CUI safeguarding requirements.
Responsibilities
- Contracting Officers: Ensure inclusion of this clause in applicable contracts and verify flowdown to subcontracts.
- Contractors: Implement all specified security controls, flow down the clause to eligible subcontractors, and maintain compliance with any additional safeguarding requirements.
- Agencies: May impose further safeguarding requirements for CUI or other sensitive information.
Practical Implications
- This clause sets a baseline for cybersecurity in federal contracting, aiming to reduce the risk of data breaches involving FCI.
- Contractors must assess and, if necessary, upgrade their information systems and practices to meet these requirements.
- Failure to comply can result in contractual remedies, increased scrutiny, or loss of eligibility for future awards.
As prescribed in 4.1903 , insert the following clause:
Basic Safeguarding of Covered Contractor Information Systems (Nov 2021)
(a) Definitions. As used in this clause—
Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.
Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.
Information means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).
Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3502&num=0&edition=prelim" target="_blank">44 U.S.C. 3502).
Safeguarding means measures or controls that are prescribed to protect information systems.
(b) Safeguarding requirements and procedures.
(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:
(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
(iii) Verify and control/limit connections to and use of external information systems.
(iv) Control information posted or processed on publicly accessible information systems.
(v) Identify information system users, processes acting on behalf of users, or devices.
(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
(xii) Identify, report, and correct information and information system flaws in a timely manner.
(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.
(xiv) Update malicious code protection mechanisms when new releases are available.
(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
(2) Other requirements. This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.
(c) Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.
(End of clause)