Basic Safeguarding of Covered Contractor Information Systems

At a Glance

Who it applies to

Every contractor (and subcontractor) whose systems handle Federal Contract Information — nearly all federal contracts above the micro-purchase threshold

What it obligates

15 basic safeguarding requirements (access control, authentication, media handling, boundary protection, patching, etc.)

Governing authority

FAR 52.204-21, prescribed by FAR 4.1903

Flow-down

Yes — you must include the clause in subcontracts where the sub's systems will handle FCI

The stakes

It's the minimum baseline; failing to meet it is a contract-compliance and responsibility problem, not just an IT gap

What It Is

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, is the governmentwide floor for cybersecurity on federal contracts. It protects a category called Federal Contract Information (FCI) — information provided by or generated for the government under a contract to develop or deliver a product or service, that is not intended for public release (it does not include information the government has released publicly, like on a public website). The clause requires you to apply 15 specific basic safeguarding requirements to any 'covered contractor information system' — any system you own or operate that stores, processes, or transmits FCI. The 15 controls are deliberately basic and map to a subset of the NIST SP 800-171 family: limiting system access to authorized users, controlling who can run what, verifying identities before granting access, sanitizing or destroying media before disposal, limiting physical access, monitoring and controlling the boundaries of your network, using subnetworks for publicly accessible components, identifying and correcting flaws in a timely way, providing protection from malicious code and updating it, and performing periodic scans. Two things make this clause the anchor of the whole safeguarding regime. First, it is nearly universal — it goes in essentially every contract other than those solely for commercially available off-the-shelf (COTS) items, so almost every SDVOSB is subject to it. Second, it is a floor, not a ceiling: a DoD contract handling more sensitive Controlled Unclassified Information layers DFARS 252.204-7012, NIST SP 800-171, and CMMC on top of these 15 basics. In plain terms: if you do federal work, you must meet these 15 controls, and you must make your subcontractors meet them too.

When It Applies

• On essentially every federal contract above the micro-purchase threshold whose performance involves FCI — not just IT contracts.
• When you store, process, or transmit any non-public information the government provided or you generated to perform the contract.
• As a flow-down: you must include FAR 52.204-21 in subcontracts where the subcontractor's systems will handle FCI.
• As the baseline that DoD's DFARS 252.204-7012 / NIST SP 800-171 / CMMC requirements build on top of for more sensitive data.

Key Features

The SDVOSB Angle

For a small SDVOSB, FAR 52.204-21 is the requirement most likely to be quietly overlooked because it isn't labeled 'cybersecurity' in the solicitation and applies even to non-IT work. Don't ignore it: the 15 controls are foundational, achievable without an enterprise budget, and they double as the on-ramp to the harder DoD requirements — every dollar you spend meeting them counts toward NIST SP 800-171 and CMMC Level 1. Two moves: first, inventory where FCI actually lives in your business (email, shared drives, a laptop, a cloud folder) and apply the 15 controls there; second, remember the flow-down — if a similarly situated subcontractor's systems will touch FCI, the clause has to be in their subcontract and they have to meet it, and their gap is your compliance problem as the prime. Meeting this baseline cleanly is also a low-cost past-performance and responsibility signal in a small-business field where many competitors treat it as an afterthought.

How to Comply

1. Identify every system — laptop, server, email, cloud drive — that stores, processes, or transmits FCI.
2. Implement the 15 basic safeguarding requirements on those systems; document what you did.
3. Restrict access to authorized users, enforce authentication, and control removable media.
4. Keep systems patched, run anti-malware, and perform periodic scans.
5. Flow FAR 52.204-21 down into subcontracts where the sub's systems will handle FCI, and confirm the sub complies.

Watch Out For

• Assuming the clause only applies to IT contracts — it applies to any contract where your systems handle FCI.
• Thinking a cloud email/office subscription automatically satisfies it — you still have to configure and document the 15 controls.
• Forgetting the flow-down — a subcontractor handling FCI without the clause is a prime-level compliance gap.
• Treating it as the ceiling — for DoD CUI work, the much stricter DFARS 7012 / 800-171 / CMMC requirements also apply.

Run the Numbers

Frequently Asked

Primary Sources

• FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems
• FAR 4.1903 — Contract clause (safeguarding)
• FAR Subpart 4.19 — Basic Safeguarding of Covered Contractor Information Systems

Plain-English reference, not legal advice. Cybersecurity and information-safeguarding rules are fact-specific and change often — the FAR, DFARS, NIST publications, and the CMMC program rule are amended and phased in over time. Always read the current FAR/DFARS text and the safeguarding clauses in your specific contract, check the version of NIST SP 800-171 your contract requires, confirm the SPRS and CMMC requirements with the contracting officer, and consult qualified counsel or a cybersecurity professional before relying on a compliance position or making a certification.

Related Safeguarding Requirements

Systems You’ll Use

Clauses That Apply

How It Plays by Contract Type

Forms You’ll Use

Put It Into Practice

Terms Used on This Page

In the FAQ Knowledge Base