Terms / The contract
FAR 52.204-21
The clause holding the 15 basic safeguarding requirements for Federal Contract Information. It is the whole of CMMC Level 1.
Also called 52.204-21, FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
Official Source Material
The Contractor shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:
Source: 48 CFR 52.204-21(b)(1), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
These 15 requirements are the entirety of CMMC Level 1.
FAR 52.204-21 lists fifteen basic safeguarding controls, and CMMC Level 1 adds nothing to them. If your contracts give you only Federal Contract Information, this clause is your whole obligation. Read the list once. It covers access control, identification and authentication, media sanitization, physical access and visitor escorting, boundary protection, flaw remediation, and malicious code protection, including periodic scans and scans of files you download. Each item is one sentence long.
This clause is in almost every Federal contract you hold.
It applies wherever a contractor system processes, stores, or transmits Federal Contract Information, which is nearly every contract that is not purely commercial off-the-shelf. Most small companies have been subject to it for years without noticing. Nothing about this clause is new, and a contracting officer does not need to mention it for it to bind you.
The clause defines the system it protects, and the definition is broad.
A covered contractor information system is any system owned or operated by a contractor that processes, stores, or transmits Federal Contract Information. That includes your email, your shared drive, and the laptop someone uses at home. It is not limited to a server. Write down which systems those are before you claim the fifteen controls are met.
It carries flow-down obligations to your suppliers too.
Paragraph (c) requires you to include the substance of the clause in your subcontracts. It reaches subcontracts for commercial products and services, and excludes only commercially available off-the-shelf items. It applies where the supplier may have Federal Contract Information in or transiting its system. A subcontractor that receives a statement of work from you is usually in that position.
What falls short
- A claim that the fifteen controls are met with no list of the systems they apply to. The clause protects covered contractor information systems, so naming them is the first evidence.
- Antivirus that has not updated in months. Two of the fifteen controls ask you to screen for malicious code and to keep that protection current, and a stale definition file fails the second.
- An unescorted visitor policy that exists only in conversation. The clause asks you to escort visitors, monitor their activity, and maintain physical access audit logs.
Edge cases
- You hold both Federal Contract Information and Controlled Unclassified Information. The higher obligation governs the systems that hold the narrower category, and DFARS 252.204-7012 applies to those.
- Your contract is exclusively for commercially available off-the-shelf items. The flow-down in paragraph (c) excludes those, and CMMC does not apply to a contract solely for them either.
- Your data sits in a cloud service you do not administer. The controls still apply to that system, so the configuration you are responsible for is the part you must be able to show.
Over-engineering
- A CMMC Level 2 program for a company that only ever receives statements of work and invoices. Fifteen controls and an annual self-assessment are the requirement.
- A written policy set modeled on NIST SP 800-171 for Level 1. The clause lists controls, not a documentation program, and Level 1 requires no system security plan.