FAR 52.204-21, explained: the clause behind CMMC Level 1

If a government contract or a subcontract from your prime lists FAR 52.204-21, you've agreed to 15 basic safeguards for the computers, email, and phones that touch the job's information. It's the clause every CMMC Level 1 self-assessment is scored against, and it's been in contracts since 2016. This guide covers the clause itself - who it reaches, what each paragraph says, and why some newer contracts call it something else.

If you want the 15 requirements explained one by one, with what each looks like in a small shop, that's in the requirements guide. This page stays at the clause level.

What FAR 52.204-21 is

FAR 52.204-21 is titled "Basic Safeguarding of Covered Contractor Information Systems." It's a contract clause in the Federal Acquisition Regulation, the rulebook for acquisition by all executive agencies. It isn't a DoD-only rule, so any federal agency's contract can carry it, not just a defense contract.

The FAR also says when the clause belongs in a contract. FAR 4.1903 tells contracting officers to include it when the contractor or a subcontractor at any tier may have Federal contract information (FCI) residing in or transiting through its information system. The clause shows up because of the information, not because of what you make.

The clause itself is short. It has three paragraphs:

• (a) Definitions - the terms the rest of the clause runs on.
• (b) Safeguarding requirements - the 15 safeguards, plus a note about other rules that still apply.
• (c) Subcontracts - when you have to pass the clause down.

Does it apply to you?

The trigger is Federal contract information on your systems. Company size doesn't decide it, and neither does contract value.

In plain English, FCI is information the government gives you, or that you create for the government, under a contract, and that isn't meant for public release. The clause's definition leaves out two things: information the government already makes public (like what's on its websites) and simple transactional information, such as what's needed to process payments.

The clause reaches you one of two ways. Either it's written into your own contract with the government, or your prime flows it down to you in a subcontract.

Here's a quick way to check. Open the contract or solicitation and search for 52.204-21, then search for 52.240-93. If you're scrolling instead of searching, look at the clause list, which usually sits near the end of the document.

Take Acme Precision Machining. A customer sends over part drawings for a government job, and those drawings land in the shop's email and its job system. That's FCI on Acme's systems, so the clause applies to the computers, email, and phones that handle it.

One more thing to look for: if the contract also includes DFARS 252.204-7012, you're likely handling CUI and Level 2 applies. Here's how to tell which level you're in.

The clause, paragraph by paragraph

(a) Definitions

Paragraph (a) defines the terms the clause depends on. The ones that matter here are covered contractor information system, Federal contract information, information system, and safeguarding. The one that sets your scope is the first: a covered contractor information system is a system you own or operate that processes, stores, or transmits FCI. FCI is defined the way it's described above, and safeguarding means the measures or controls that protect those systems. For how that plays out in a real shop, see what's actually in scope for Level 1.

(b) Safeguarding requirements

Paragraph (b)(1) is the heart of the clause. It lists 15 basic safeguarding requirements, numbered (i) through (xv), and says your protection of covered systems has to include them at a minimum. They're in the table below.

Paragraph (b)(2) is one sentence, and it's easy to skip. It says the clause doesn't relieve you of any other safeguarding requirements, whether they come from a specific federal agency or from the federal rules for controlled unclassified information (CUI). If your contract has stricter rules somewhere else, those still apply. The 15 are a floor, not a ceiling.

(c) Subcontracts

Paragraph (c) is the flow-down. If you sub out work and the subcontractor may have FCI residing in or transiting through its information system, you have to include the substance of the clause in that subcontract - including paragraph (c) itself, so the duty keeps moving down the chain. That covers subcontracts for commercial products and services too, with one exception: commercially available off-the-shelf (COTS) items. If you're the prime passing work down, here's how to handle the flow-down.

The 15 safeguarding requirements at a glance

Here's the full list from paragraph (b)(1), with the short names we use across this site.

#	CLAUSE	REQUIREMENT	IN PLAIN ENGLISH
1	(b)(1)(i)	Limit access to authorized users	Only approved people and devices get in.
2	(b)(1)(ii)	Limit access to what the job needs	People only do what their role requires.
3	(b)(1)(iii)	Verify and control external connections	Know and control outside systems you connect to.
4	(b)(1)(iv)	Control what goes public	Check what gets posted on public sites.
5	(b)(1)(v)	Identify users and devices	Every user and device has its own identity.
6	(b)(1)(vi)	Authenticate before access	Prove who you are before getting in.
7	(b)(1)(vii)	Sanitize media before disposal or reuse	Wipe or destroy drives before they leave.
8	(b)(1)(viii)	Limit physical access	Keep outsiders away from computers and equipment.
9	(b)(1)(ix)	Escort visitors and keep logs	Escort visitors, log entry, control keys and badges.
10	(b)(1)(x)	Control the boundary with the internet	Watch and control traffic at your network's edge.
11	(b)(1)(xi)	Separate public systems from internal ones	Public-facing systems stay off your internal network.
12	(b)(1)(xii)	Fix flaws in a timely way	Find and patch software flaws promptly.
13	(b)(1)(xiii)	Malware protection, kept current	Run malware protection where it's needed.
14	(b)(1)(xiv)	Malware protection, kept current	Update it when new releases come out.
15	(b)(1)(xv)	Scan periodically and in real time	Regular scans, plus scanning files as they open.

For what each one looks like in a real shop, read the 15 requirements, explained, and if you've seen a count of 17 somewhere, here's why it's 15 now.

Why you might see it as FAR 52.240-93

The FAR is being rewritten under the Revolutionary FAR Overhaul, and agencies are putting the rewritten parts into use through class deviations before the codified FAR changes. The new FAR Part 40 pulls together content that used to sit in Parts 4 and 25. Under those Part 40 deviations, the basic safeguarding clause appears as FAR 52.240-93, with the same title: Basic Safeguarding of Covered Contractor Information Systems.

We compared the Department of Homeland Security's deviation text (Class Deviation 25-23, effective November 3, 2025) against 52.204-21. The 15 safeguards are word for word the same. The definitions, the (b)(2) note about other requirements, and the (c) flow-down carry the same substance, with small wording and formatting changes.

As of September 29, 2026, the codified FAR at acquisition.gov still shows 52.204-21 with its full text. So some contracts will carry one number, and some will carry the other.

How it connects to CMMC Level 1

CMMC Level 1 doesn't add new safeguards. The CMMC rule at 32 CFR 170.14(c)(2) says the Level 1 security requirements are the ones in FAR 52.204-21(b)(1)(i) through (xv), and the Level 1 table in 32 CFR 170.15 maps each one to NIST SP 800-171A assessment objectives.

What CMMC adds for DoD contracts is the proof. Under 32 CFR 170.15, you self-assess against all 15, every one has to be met (no POA&Ms at Level 1), and you submit the results in SPRS every year. Under 32 CFR 170.22, your affirming official - the senior person responsible for compliance - affirms it in SPRS after the assessment and annually after that. How to submit your SPRS score walks through the entry, and the annual affirmation guide covers the yearly cycle.

The July 13, 2026 suspension paused third-party certification for Level 2 and Level 3. Your annual self-assessment, your SPRS affirmation, and the 15 requirements in your contract are all exactly where they were on July 12. Here's what the suspension did and didn't touch.

The CMMC rule applies to DoD contracts and subcontracts. On a civilian agency contract, the clause still applies, but the CMMC self-assessment and SPRS affirmation don't come with it.

What "compliance" actually looks like

Complying with the clause comes down to three things:

1. The 15 safeguards are actually in place. Not planned, not mostly done. In place on every system that touches FCI.
2. You keep evidence that shows it. Screenshots, lists, logs, and written policies that back up each answer. Here's what counts as evidence.
3. For DoD work, your self-assessment and affirmation are current in SPRS.

The third one is where the stakes live. An SPRS affirmation is a statement to the government that you meet the requirements, and a false one carries False Claims Act exposure. That's not a reason to panic. It's a reason to affirm only what's true on the day you affirm it, and to fix gaps before you attest, not after.

Most small shops aren't far off, and the misses tend to land in the same places: a shared login, permissions where everyone can open everything, no visitor control, a router nobody manages, and a server that never gets patched. The 5 most common Level 1 gaps covers each one and what it takes to close it.

Quick answers

Is FAR 52.204-21 the same as NIST SP 800-171?

No. FAR 52.204-21 has 15 basic safeguards, and it covers FCI. NIST SP 800-171 Rev. 2 has 110 security requirements for protecting CUI. It comes into your contract through DFARS 252.204-7012, and it's the standard behind CMMC Level 2. If you're not sure which one you're facing, start with Level 1 vs Level 2.

Does it apply outside the Department of Defense?

Yes. It's a FAR clause, and the FAR covers acquisition by all executive agencies, so civilian agency contracts can carry it too. CMMC and SPRS are DoD-specific. A civilian contract with this clause means the 15 safeguards, without the CMMC self-assessment and SPRS affirmation on top.

Is there a FAR 52.204-21 certification?

No. Level 1 is a self-assessment that your own company attests to. Nobody issues a certificate for it, and anyone selling you a "FAR 52.204-21 certification" is selling something else, so ask what it actually is. Level 1 Ready isn't a certifier either. It's a documentation tool, and you're the one who attests.

Is there a FAR 52.204-21 checklist?

The clause is its own checklist: the 15 safeguards in the table above. For each one explained with shop examples, read the requirements guide, and for the proof to keep on file, use the evidence checklist. The quickest first read is the free 5-question check below.