FAR clauses

FAR 52.204-21 Explained

FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, is the baseline cybersecurity clause for federal contracts. It lists 15 basic safeguarding requirements in paragraph (b)(1)(i)–(xv) that any contractor system holding Federal Contract Information must meet (clause text on acquisition.gov).

These same 15 requirements are what CMMC Level 1 assesses — see CMMC Level 1 requirements.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 19, 2026

CMMC Level 1 requirements Free CMMC Quick Score

What is Federal Contract Information (FCI)?

The clause defines FCI as:

"Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments."

FCI is broader and less sensitive than CUI. If your contract involves CUI, the stronger DFARS 252.204-7012 obligations apply instead — see What is CUI?

When the clause applies

Per FAR 4.1903, the clause goes in solicitations and contracts when the contractor or a subcontractor at any tier may have Federal Contract Information residing in or transiting through its information system. Under FAR 4.1902 that includes acquisitions of commercial products and services, except commercially available off-the-shelf (COTS) items.

The 15 basic safeguarding requirements

Paragraph (b)(1) lists fifteen requirements, (i) through (xv). Each links to its own page with the verbatim clause text:

Authorized Access Control — AC.L1-b.1.i
Access Enforcement — AC.L1-b.1.ii
External Connections — AC.L1-b.1.iii
Control Publicly Posted Information — AC.L1-b.1.iv
Identification — IA.L1-b.1.v
Authentication — IA.L1-b.1.vi
Media Sanitization — MP.L1-b.1.vii
Limit Physical Access — PE.L1-b.1.viii
Visitor Escort, Physical Access Logs & Access Devices — PE.L1-b.1.ix
Boundary Protection — SC.L1-b.1.x
Subnetwork Separation — SC.L1-b.1.xi
Flaw Remediation — SI.L1-b.1.xii
Malicious Code Protection — SI.L1-b.1.xiii
Malicious Code Updates — SI.L1-b.1.xiv
System & File Scanning — SI.L1-b.1.xv

Download (CSV): the 15 Level 1 requirements

How it maps to CMMC Level 1

CMMC Level 1 assesses exactly these 15 FAR 52.204-21(b)(1) requirements (32 CFR 170.15). Level 1 is an annual self-assessment plus an affirmation in SPRS — no third-party assessment and no POA&M: all 15 must be fully implemented. The mapping to the underlying NIST SP 800-171 requirements is on the Level 1 hub.

Flowdown to subcontractors

Paragraph (c) requires flowing the clause down to subcontracts where the subcontractor may have FCI residing in or transiting through its information system — except subcontracts solely for COTS items.

Frequently asked questions

What is FCI?

Federal Contract Information: information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service — excluding public information and simple transactional information like payment processing.

Is FAR 52.204-21 the same as CMMC Level 1?

Effectively yes for content: CMMC Level 1 assesses the 15 basic safeguarding requirements of FAR 52.204-21(b)(1). CMMC adds the verification layer — an annual self-assessment scored in SPRS plus a senior official's affirmation.

Does FAR 52.204-21 require an SSP?

No. The clause lists 15 safeguarding requirements but does not require a System Security Plan. Documenting how each requirement is met is still good practice and makes the CMMC Level 1 affirmation defensible.