Understanding FAR Clause 52.204-21
TheFederal Acquisition Regulation (FAR) Clause 52.204-21is titled"Basic Safeguarding of Covered Contractor Information Systems."This clause establishesminimum cybersecurity requirementsforfederal contractorsthat handleFederal Contract Information (FCI).
Key Purpose of FAR Clause 52.204-21
Theprimary objectiveof FAR 52.204-21 is to ensure that contractors applybasic cybersecurity protectionsto theirinformation systemsthat process, store, or transmitFCI. Theseminimum safeguarding requirementsserve as abaseline security standardfor contractors doing business with theU.S. government.
Why "Minimum Standard of Care" is Correct?
FAR 52.204-21 doesnotrequire contractors to install specific cybersecurity tools (eliminating option A).
Itoutlines only the minimum safeguards, notallcybersecurity controls needed for complete security (eliminating option B).
CMMC certification isnotmandated by this clause alone (eliminating option D).
Instead, it establishesa baseline "standard of care"that all federal contractorsmust followto protectFCI(making option C correct).
Breakdown of Answer Choices
Option
Description
Correct?
A. It directs all covered contractors to install the cybersecurity systems listed in that clause.
❌Incorrect–The clause doesnotspecify tools or require specific cybersecurity systems.
B. It describes all of the safeguards that contractors must take to secure covered contractor IS.
❌Incorrect–It only setsminimumrequirements, notall possiblesecurity measures.
C. It describes the minimum standard of care that contractors must take to secure covered contractor IS.
✅Correct – The clause defines basic safeguards as a minimum security standard.
D. It directs covered contractors to obtain CMMC Certification at the level equal to the lowest requirement of their contracts.
❌Incorrect–FAR 52.204-21 doesnot mandateCMMC certification; that requirement comes from DFARS 252.204-7012 and 7021.
Minimum Safeguarding Requirements Under FAR 52.204-21
The clause defines15 basic security controls, which align withCMMC Level 1. Some examples include:
✅Access Control– Limit access to authorized users.
✅Identification & Authentication– Authenticate system users.
✅Media Protection– Sanitize media before disposal.
✅System & Communications Protection– Monitor and control network connections.
Official References from CMMC 2.0 and FAR Documentation
FAR 52.204-21– Establishes thebasic safeguarding requirementsfor FCI.
CMMC 2.0 Level 1– Directly aligns withFAR 52.204-21 controls.
Final Verification and Conclusion
The correct answer isC. It describes the minimum standard of care that contractors must take to secure covered contractor IS.This aligns withFAR 52.204-21 requirementsas abaseline security standard for FCI.
