FAR 52.204-21, Explained: All 15 Basic Safeguarding Requirements, Annotated

What FAR 52.204-21 is — and where it applies

The clause is inserted per FAR 4.1903 and defines its own scope in paragraph (a). Two definitions do the work:

Covered contractor information system — “an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.” Note what that is not: it is not “your whole company.” Only the systems that touch FCI are covered — which is why scoping is the first real decision in any Level 1 self-assessment.

Federal contract information — verbatim from the clause (and identically at FAR 4.1901):

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

The two exclusions in that definition — public information and simple transactional information — are routinely skipped by vendors trying to scare you, and they matter. We unpack the full definition, with the exclusions, in what FCI (Federal Contract Information) actually is.

How the clause becomes CMMC Level 1

CMMC did not invent new Level 1 controls. The program rule points straight back at this clause: the fifteen safeguards in paragraph (b)(1) are the fifteen CMMC Level 1 requirements, each renamed with a CMMC identifier that literally encodes its FAR paragraph — AC.L1-b.1.i is FAR 52.204-21(b)(1)(i). Table 2 to 32 CFR § 170.15(c)(1)(ii) also maps each one to a NIST SP 800-171 Rev 2 requirement number, and the self-assessment is conducted against the corresponding NIST SP 800-171A objectives (59 in total at Level 1), with FCI substituted wherever an objective says CUI.

What CMMC adds is verification: an annual self-assessment, results entered in SPRS, and an annual affirmation of continuing compliance by a senior company official. Handling CUI is a different tier entirely — that’s CMMC Level 2, with the full 110-control NIST SP 800-171 set behind it.

The fifteen safeguards, annotated

Everything below quotes paragraph (b)(1) of the clause verbatim — the text is public domain — followed by a plain-language reading and the CMMC Level 1 requirement each safeguard becomes.

(b)(1) The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

Access control — (i) through (iv)

(i) — becomes AC.L1-b.1.i, Authorized Access Control (SP 800-171: 3.1.1)

Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

In plain terms: know who and what is allowed into your systems, and keep everyone else out. That means a current register of authorized users and devices, documented approval when accounts are created, and access shut off the day someone leaves. Service accounts and automated processes count as “users” here too.

(ii) — becomes AC.L1-b.1.ii, Transaction & Function Control (3.1.2)

Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Being allowed in isn’t being allowed to do everything. Define what each role can do — view, edit, administer — and enforce it. Practically: role-based permissions on the folders and repos holding FCI, and admin functions restricted to named people.

(iii) — becomes AC.L1-b.1.iii, External Connections (3.1.20)

Verify and control/limit connections to and use of external information systems.

This is the “no FCI in personal Dropbox” control. Identify the external systems your business connects to and the outside tools your people use, verify them before allowing them, and put technical limits on external sharing.

(iv) — becomes AC.L1-b.1.iv, Control Public Information (3.1.22)

Control information posted or processed on publicly accessible information systems.

Decide who may publish to your website and social accounts, review content before it goes public, and have a way to take FCI down fast if it ever slips out.

Identification and authentication — (v) and (vi)

(v) — becomes IA.L1-b.1.v, Identification (3.5.1)

Identify information system users, processes acting on behalf of users, or devices.

Every person gets a unique login — no shared accounts. Service accounts are individually identified with owners, and the devices that reach your systems are inventoried.

(vi) — becomes IA.L1-b.1.vi, Authentication (3.5.2)

Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

Identification says who you claim to be; authentication proves it before access is granted. Strong passwords (multi-factor authentication is the sensible modern reading, even where the letter of the clause doesn’t demand it), keys or tokens for service accounts, and every vendor default password changed.

Media protection — (vii)

(vii) — becomes MP.L1-b.1.vii, Media Disposal (3.8.3)

Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

Drives, laptops, USB sticks, and paper holding FCI get wiped or destroyed before they leave your control — including before a laptop is handed to a new employee. A disposal log and full-disk encryption (which makes crypto-erase always available) cover most small shops.

Physical protection — (viii) and (ix)

(viii) — becomes PE.L1-b.1.viii, Limit Physical Access (3.10.1)

Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

Know exactly who may physically reach your systems and equipment — the office, the network closet, the laptops — and limit it to those people. Remote work isn’t exempt; it needs rules too.

(ix) — becomes PE.L1-b.1.ix, Manage Visitors & Physical Access (3.10.3 / 3.10.4 / 3.10.5)

Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

One FAR sentence, three obligations — which is why this single safeguard maps to three NIST requirement numbers. Escort and monitor visitors, keep a physical-access log, and inventory-and-manage every key, badge, and fob (issued with a record, deactivated or rekeyed on loss or departure).

System and communications protection — (x) and (xi)

(x) — becomes SC.L1-b.1.x, Boundary Protection (3.13.1)

Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

Define where your network ends — the firewall, the router, the cloud tenant edge — and watch, control, and protect traffic there. A default-deny firewall, TLS everywhere, and whatever monitoring your providers give you covers the small-business case. (That parenthetical is part of the official clause text — a surprising number of summaries drop it.)

(xi) — becomes SC.L1-b.1.xi, Public-Access System Separation (3.13.5)

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

If you host anything the public can reach, it must be separated from the network where FCI lives. Most small contractors satisfy this by hosting their public website with an external provider and keeping guest Wi-Fi segmented — and if nothing publicly accessible sits inside your assessment scope, this is the one requirement that legitimately comes out NOT APPLICABLE.

System and information integrity — (xii) through (xv)

(xii) — becomes SI.L1-b.1.xii, Flaw Remediation (3.14.1)

Identify, report, and correct information and information system flaws in a timely manner.

“Timely” is yours to define — so define it. Written patch timeframes (say, critical fixes inside 14 days), auto-updates turned on, and a simple log showing flaws actually get fixed within the window you set.

(xiii) — becomes SI.L1-b.1.xiii, Malicious Code Protection (3.14.2)

Provide protection from malicious code at appropriate locations within organizational information systems.

Anti-malware or EDR on every endpoint, plus protection at the other places malware arrives — email and web. Centrally managed, so users can’t switch it off.

(xiv) — becomes SI.L1-b.1.xiv, Update Malicious Code Protection (3.14.4)

Update malicious code protection mechanisms when new releases are available.

The shortest requirement in the set, with exactly one assessment objective behind it: automatic updates are on, and agents are current.

(xv) — becomes SI.L1-b.1.xv, System & File Scanning (3.14.5)

Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Two scanning duties: scheduled full scans on a defined frequency (weekly is common), and real-time scanning of files arriving from outside as they’re downloaded, opened, or executed.

The two paragraphs everyone skips: (b)(2) and (c)

(b)(2) — Other requirements. Verbatim:

This clause does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.

Translation: these fifteen safeguards are a floor. If your contract also carries CUI obligations — DFARS 252.204-7012, NIST SP 800-171, FedRAMP-Moderate cloud — this clause doesn’t waive a word of them.

(c) — Subcontracts. The contractor must include the substance of the clause, including paragraph (c) itself, in subcontracts — commercial products and services included, commercially available off-the-shelf items excepted — wherever the subcontractor “may have Federal contract information residing in or transiting through its information system.” If you’re a sub two tiers down from a prime and FCI touches your laptop, this clause is why the requirement reaches you.

What complying actually looks like

The clause itself just says “apply the safeguards.” CMMC supplies the how: an annual self-assessment against the 59 assessment objectives, every requirement finding MET (or NOT APPLICABLE, which counts as MET), results entered in SPRS, and an annual affirmation by a senior company official. There are no POA&Ms at Level 1 — 32 CFR § 170.21(a)(1) doesn’t permit them at any time — so a gap means fix first, then assess. We walk the SPRS mechanics, exact button labels included, in how to submit your SPRS score.

If you want to see where you stand today, run our free CMMC Level 1 self-assessment — it interviews you against all fifteen requirements and 59 objectives, and generates the document package a passing self-assessment should leave behind. No charge, and your answers never leave your browser.