Does FAR 52.204-21 apply to subcontractors?

Yes. The clause flows down to subcontracts where the subcontractor's systems process, store, or transmit Federal Contract Information, except subcontracts solely for COTS items. If a prime passes you FCI, the 15 basic safeguarding requirements apply to your systems regardless of your company's size or tier.

Do I need to protect FCI the same way as CUI?

No. Federal Contract Information requires the 15 basic safeguarding requirements in FAR 52.204-21, which is CMMC Level 1 territory. Controlled Unclassified Information triggers DFARS 252.204-7012 and the 110 requirements of NIST SP 800-171, which is CMMC Level 2. CUI always demands the stronger control set.

When did FAR 52.204-21 take effect?

The clause was issued in June 2016, so the 15 basic safeguarding requirements have been contractually binding for nearly a decade. What CMMC 2.0 changed is verification: Level 1 now adds an annual self-assessment, Final Level 1 status, and an annual affirmation in SPRS on top of implementation.

What systems count as covered contractor information systems?

A covered contractor information system is any system owned or operated by the contractor that processes, stores, or transmits Federal Contract Information. The 15 requirements attach to those systems specifically, so an accurate inventory of where FCI actually lives is the practical first step in complying.

FAR 52.204-21: Basic Safeguarding Requirements

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}FAR 52.204-21: Basic Safeguarding RequirementsReview all 15 FAR 52.204-21 basic safeguarding requirements with plain-language explanations and implementation guidance for each control.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.