Question 1

What is FAR 52.204-21?

Accepted Answer

FAR 52.204-21 is the federal contract clause that requires basic safeguarding of covered contractor information systems. It defines 15 security requirements for protecting Federal Contract Information (FCI). These 15 requirements are the same practices that make up CMMC Level 1.

Question 2

How many controls are in FAR 52.204-21?

Accepted Answer

There are 15 practices, spread across 6 domains: Access Control, Identification and Authentication, Media Protection, Physical Protection, System and Communications Protection, and System and Information Integrity.

Question 3

Is FAR 52.204-21 the same as CMMC Level 1?

Accepted Answer

Yes. The 15 practices in FAR 52.204-21 are the basis for CMMC Level 1. Level 1 is scored as a straight compliance percentage (practices met out of 15). It does not use the SPRS point score, which applies only to Level 2.

Question 4

What is the difference between FCI and CUI?

Accepted Answer

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information (CUI) is a specific, marked category requiring more protection. FCI maps to Level 1 (15 practices); CUI maps to Level 2 (110 practices).