What is the BEST description of the purpose of FAR clause 52 204-21?

FAR clause 52.204-21, "Basic Safeguarding of Covered Contractor Information Systems," establishes the fundamental, or minimum, cybersecurity requirements that contractors must implement to protect Federal Contract Information (FCI) on their information systems. The clause lists 15 basic security controls that represent a foundational level of cyber hygiene. This set of controls constitutes the minimum acceptable "standard of care" for any contractor handling FCI, as opposed to a comprehensive list of all possible safeguards or a mandate for specific commercial products or advanced certifications.

A. The clause specifies security requirements and controls, not a list of specific commercial cybersecurity "systems" that must be installed.

B. This clause only covers "Basic Safeguarding." More comprehensive safeguards, such as those in NIST SP 800-171, are required for protecting Controlled Unclassified Information (CUI).

D. FAR 52.204-21 does not mandate CMMC certification. CMMC requirements are imposed through separate DFARS clauses, such as 252.204-7021.

---

1. Federal Acquisition Regulation (FAR)

Subpart 52.2

Clause 52.204-21

"Basic Safeguarding of Covered Contractor Information Systems." The title itself uses the term "Basic

" and the content lists 15 foundational controls

indicating a minimum standard

not a comprehensive or product-specific list. (Available at https://www.acquisition.gov/far/52.204-21).

2. U.S. Department of Defense

Office of the Under Secretary of Defense for Acquisition & Sustainment

"CMMC Model v2.0

" December 2021. Page 8 states

"Level 1 is equivalent to the Federal Acquisition Regulation (FAR) clause 52.204-21." This shows that the FAR clause's 15 controls are the foundation (minimum standard) upon which the CMMC framework is built

starting with Level 1 for protecting FCI.

3. Carnegie Mellon University

Software Engineering Institute

"Mapping CMMC 2.0 to NIST SP 800-171 and FAR 52.204-21

" 2022. This document explicitly maps the 15 controls from FAR 52.204-21 to the 17 practices in CMMC Level 1

reinforcing that the FAR clause provides the baseline requirements for protecting FCI. (Available at https://resources.sei.cmu.edu/assetfiles/WhitePaper/2022019001841018.pdf).