Reference · Cybersecurity & CMMC
FAR 52.204-21
Basic Safeguarding of Covered Contractor Information Systems
FAR 52.204-21 is the government-wide contract clause imposing 15 basic security controls on any contractor information system that processes, stores, or transmits Federal Contract Information (FCI). It is the FCI safeguarding floor and the basis of CMMC Level 1.
What it is
The clause lists 15 basic safeguarding requirements — a subset of the controls in NIST SP 800-171 — covering access control, identification and authentication, media protection, and similar fundamentals for systems handling FCI.
Why it exists
It establishes a minimum cyber-hygiene baseline across all federal contracting for non-public contract information, below the higher CUI bar of DFARS 252.204-7012.
Who it applies to
Contractors and subcontractors whose information systems handle Federal Contract Information — effectively most non-commercial-item contractors. It does not apply to acquisitions solely for COTS items.
Flow-down
The clause flows down to subcontracts (other than COTS) in which the subcontractor may handle Federal Contract Information.
Compliance triggers
Implement the 15 basic requirements on any system handling FCI. For a CMMC Level 1 assessment, these same 15 requirements are the assessment scope.
Frequently asked
How many controls are in FAR 52.204-21?
FAR 52.204-21 contains 15 basic safeguarding requirements. They apply to any contractor system that handles Federal Contract Information and are the exact scope of a CMMC Level 1 assessment.
Related terms
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.