Who has to comply with FAR 52.204-21?

Any federal contractor or subcontractor whose information systems process, store, or transmit Federal Contract Information must comply, regardless of company size. The clause appears in most federal contracts, not just DoD awards. The only broad exemption is contracts solely for commercially available off-the-shelf (COTS) items.

Is FAR 52.204-21 being renumbered?

Yes. Under the FAR overhaul, FAR 52.204-21 was renumbered to 52.240-93, effective in new solicitations February 1, 2026, with the same title and the same 15 requirements. CMMC Level 1 documentation still references 52.204-21, and the CFR keeps the old number until formal rulemaking, so both numbers are in circulation.

What happens if I cannot check off an item on the checklist?

Each unchecked item is a compliance gap you must close before affirming CMMC Level 1. Level 1 has no POA&M option, so gaps cannot be deferred. Document the weakness, the fix, the responsible owner, and the completion date, then reassess the practice before you affirm in SPRS.

Do I need a third-party audit for FAR 52.204-21 compliance?

No. FAR 52.204-21 compliance is demonstrated through self-assessment, and CMMC Level 1 works the same way: an annual self-assessment and an annual affirmation of continuous compliance submitted to SPRS. A C3PAO assessment is only required for certain CMMC Level 2 contracts, never for Level 1.

How often should I run this FAR 52.204-21 checklist?

At least annually. CMMC Level 1 requires an annual self-assessment and an annual affirmation in SPRS, so your checklist results must stay no more than one year old. Rerun it sooner after major changes such as new systems, an office move, or turnover in IT responsibilities.

What records should I keep after completing the checklist?

Keep the completed checklist, the evidence behind each implemented control (policies, screenshots, configuration exports, logs), and the assessment date. Contracting officers can request proof of compliance during audits, and your annual affirmation is only defensible if the evidence shows every practice was met when you affirmed.

FAR 52.204-21 Checklist: Small Business Guide

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}FAR 52.204-21 Checklist: Small Business GuideUse this checklist to assess and document compliance with FAR 52.204-21, the baseline cybersecurity requirement for all DoD contracts.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.