Acquisition
FAR 52.204-21 basic safeguarding requirements
FAR 52.204-21 sets 15 safeguards for systems handling federal contract information. RFO deviations use FAR 52.240-93.
Nov 10, 20265 min read13 sources
Why it matters
Contractors must identify covered systems and meet the safeguarding requirements incorporated into their contracts.
The short version
- 1FAR 52.204-21 sets 15 basic safeguards for systems handling federal contract information.
- 2RFO model deviations move basic safeguarding to 52.240-93; check the version incorporated into your contract.
- 3CMMC Level 1 requires all safeguards to be met, plus an annual self-assessment and affirmation.
Federal Acquisition Regulation (FAR) 52.204-21 requires 15 basic safeguards for systems handling federal contract information (FCI). The clause is titled Basic Safeguarding of Covered Contractor Information Systems. It covers contractor-owned or contractor-operated systems that process, store, or transmit that information (FAR 52.204-21).
The main task is straightforward: identify where contract information goes, apply every required safeguard, and check subcontractor obligations.
Did the FAR Overhaul renumber 52.204-21?
Yes. The Revolutionary FAR Overhaul (RFO) model deviation places basic safeguarding at 52.240-93. The ordinary FAR page still publishes 52.204-21, dated November 2021, under Federal Acquisition Circular 2026-01, effective March 13, 2026 (FAR 52.204-21).
| Text you are reading | Safeguarding clause | What to check |
|---|---|---|
| Ordinary FAR | 52.204-21 | The incorporated clause and date |
| RFO model deviation | 52.240-93 | The agency deviation and incorporated text |
The RFO version retains all 15 controls. It marks the old number reserved within the deviation text (RFO Part 52).
Agency adoption matters. Model deviation text and formally codified FAR text are separate tracks. Check the solicitation, amendments, and contract rather than choosing a version from its search ranking (RFO implementation FAQ).
The Department of Defense (DoD) directed contracting officers to use RFO Part 40 effective February 1, 2026. That makes the new numbering particularly relevant to defense purchases (Class Deviation 2026-O0025).
What is federal contract information?
FCI is information not intended for public release that is provided by or generated for the government under a contract for products or services. Government-published information and simple payment-processing information are excluded (FAR 52.204-21(a)).
Use those conditions together. A document being on a company computer does not, by itself, make it FCI. Ask who supplied or commissioned it, what contract it supports, and whether it was intended for public release.
For example, assess an internal contract deliverable against that definition. Do not assume its file type, lack of a security marking, or ordinary-looking subject settles the question.
FCI vs controlled unclassified information
Controlled unclassified information (CUI) has a separate definition. A law, regulation, or government-wide policy must require or permit safeguarding or dissemination controls. Private company information unrelated to government work does not become CUI merely because the company considers it sensitive (32 Code of Federal Regulations (CFR) 2002.4(h)).
The practical question is which protection requirements attach to the information and contract. Start with what CUI means when the government identifies controlled information.
Basic safeguarding does not discharge additional agency or CUI obligations. Read the other safeguarding clauses before treating these 15 controls as your complete security requirement (FAR 52.204-21(b)(2)).
FAR 52.204-21 15 requirements
The clause contains 15 numbered safeguards. The following plain-language checklist follows paragraphs (b)(1)(i) through (xv), also retained in the RFO counterpart (FAR 52.204-21; RFO 52.240-93).
| Number | Required safeguard |
|---|---|
| 1 | Allow system access only to authorized users, processes, and devices. |
| 2 | Limit authorized users to permitted transactions and functions. |
| 3 | Verify and control external-system connections and use. |
| 4 | Control information posted or processed on public systems. |
| 5 | Identify system users, processes, and devices. |
| 6 | Authenticate their identities before granting access. |
| 7 | Sanitize or destroy FCI-bearing media before disposal or release for reuse. |
| 8 | Restrict physical access to systems, equipment, and operating spaces. |
| 9 | Escort and monitor visitors, log physical access, and manage access devices. |
| 10 | Monitor, control, and protect communications at external and key internal boundaries. |
| 11 | Separate public-facing components from internal networks, physically or logically. |
| 12 | Find, report, and promptly correct information and system flaws. |
| 13 | Install malicious-code protection at appropriate system locations. |
| 14 | Update malicious-code protection when new releases become available. |
| 15 | Scan systems periodically and external files in real time during download, opening, or execution. |
Use the table to assign work. For each row, name an owner, record the implemented control, and identify evidence showing it operates.
How does this relate to CMMC Level 1?
Cybersecurity Maturity Model Certification (CMMC) Level 1 uses these same 15 safeguards. The regulation still references FAR 52.204-21(b)(1)(i) through (xv), despite the RFO numbering change (32 CFR 170.14(c)(2)).
Level 1 adds an assessment and affirmation process. Every requirement must receive a MET result. The organization performs an annual self-assessment and submits results to the Supplier Performance Risk System (SPRS). Plans of action and milestones are not permitted at Level 1 (32 CFR 170.15).
A senior organizational representative with authority to affirm compliance submits the affirmation. That official attests to implementation and continued compliance across the assessed systems, initially and annually (32 CFR 170.22).
For the broader distinction between security requirements, assessment levels, and contract requirements, see what CMMC means.
The contracting rule took effect November 10, 2025. It revised Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7021 and added provision 252.204-7025 (2025 final rule).
Do not use the original rollout calendar without checking later policy. Phase II, originally scheduled for November 10, 2026, was suspended on July 13, 2026 (Small Business Administration announcement).
The Government Accountability Office later described the suspension memorandum's continued use of Level 1 and Level 2 self-assessments. The suspension does not mean contractors should stop protecting FCI (September 21, 2026 decision).
Which systems and subcontractors are covered?
Follow the information. For Level 1, define the assessment scope before assessing it. Include systems that process, store, or transmit FCI, subject to the regulation's exclusions for specialized and out-of-scope assets (32 CFR 170.19(b)).
A useful preparation sequence is:
- List contract information received and generated.
- Trace its route through people, systems, facilities, and external service providers.
- Identify the systems within the assessment scope.
- Assign each safeguard to an owner and supporting evidence.
- Resolve gaps before recording a passing result.
The scope rule expressly asks organizations to consider people, technology, facilities, and external service providers. Reviewing only the office server leaves that exercise incomplete (32 CFR 170.19(b)(3)).
RFO Part 40 covers commercial products and services when contractor systems may contain FCI, except commercially available off-the-shelf items. The clause prescription also considers subcontractors at any tier (RFO 40.303).
The safeguarding clause requires its substance in covered subcontracts where FCI may reside or pass through subcontractor systems. Check that obligation before sending contract information downstream (RFO 52.240-93(c)).
What to do next
- Record the safeguarding clause number, date, and applicable agency deviation.
- Identify FCI and check whether separate CUI requirements apply.
- Assign an owner and evidence to each of the 15 safeguards.
- Check subcontract terms before sharing FCI.
- If Level 1 is required, complete the annual assessment and affirmation after resolving every unmet requirement.
Azcuna's LEDGER turns a trade study into a Decision Package in which every number cites its source and AI agents draft but never decide. It was proposed to the Army under SBIR Phase I topic ARM26BX06-NV012, and the proposal was submitted on October 21, 2026.
Questions people ask
What is FAR 52.204-21?
FAR 52.204-21 is the Basic Safeguarding of Covered Contractor Information Systems clause. It sets 15 minimum safeguards for contractor-owned or contractor-operated systems handling federal contract information. The RFO model deviation places the corresponding clause at 52.240-93, so the incorporated contract version matters.
What is federal contract information?
FAR 52.204-21 defines federal contract information as information not intended for public release that is provided by or generated for the government under a contract for products or services. Government-published information and simple transactional information needed to process payments are excluded. Apply the definition to the information, rather than relying only on markings.
Does FAR 52.204-21 have 15 or 17 requirements?
The clause has 15 requirements, numbered from paragraph (b)(1)(i) through (xv). The assessment table in 32 CFR 170.15 maps some requirements to multiple assessment references. In particular, the visitor and physical-access requirement has several mappings. That does not change the clause's 15-item list.
Is FAR 52.204-21 the same as CMMC Level 1?
The safeguards are the same, but CMMC Level 1 also establishes assessment and affirmation requirements. Under 32 CFR 170.15, every requirement must be met, annual results go into SPRS, and plans of action and milestones are prohibited. Section 170.22 separately requires an authorized official's affirmation.
Did the FAR Overhaul replace 52.204-21?
The RFO model deviation reserves the old number and places basic safeguarding at 52.240-93. Acquisition.gov also continues to publish the ordinary 52.204-21 clause dated November 2021. Agency deviations and the solicitation or contract determine which text applies; publication of model text does not automatically amend every contract.
Sources
- 152.204-21 Basic Safeguarding of Covered Contractor Information Systems. · Federal Acquisition Regulatory Council
- 2FAR Overhaul - Part 52 · Federal Acquisition Regulatory Council
- 3FAR Overhaul - FAQs · Federal Acquisition Regulatory Council
- 4Class Deviation 2026-O0025, RFO Part 40 and DFARS Part 240 · Office of the Assistant Secretary of War for Acquisition and Sustainment
- 532 CFR 2002.4, Definitions · Electronic Code of Federal Regulations
- 632 CFR 170.14, CMMC Model · Electronic Code of Federal Regulations
- 732 CFR 170.15, CMMC Level 1 self-assessment and affirmation requirements · Electronic Code of Federal Regulations
- 832 CFR 170.22, Affirmation · Electronic Code of Federal Regulations
- 9Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041) · Department of Defense
- 10SBA Commends U.S. Department of War's Suspension of CMMC Phase II for Small Defense Contractors · U.S. Small Business Administration
- 11Kearney & Company, P.C.; NextGen Federal Systems LLC; Integral Federal, Inc.; Alpha Tech Alliance, LLC, B-424433.14 et al. · Government Accountability Office
- 1232 CFR 170.19, CMMC scoping · Electronic Code of Federal Regulations
- 13FAR Overhaul - Part 40 · Federal Acquisition Regulatory Council
Where this shows up in our work
- LEDGER, auditable Army acquisition decisions turns a trade study into a package where every number cites its source and AI drafts but never decides.
- ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
- TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.