FAR 52.204-21: The 15 Security Controls Most Federal Contractors Already Owe

You do not need a CMMC certificate to have federal cybersecurity obligations. If your contract touches Federal Contract Information, fifteen safeguarding requirements already apply.

The Fifteen Safeguarding Requirements Already in Most Federal Contracts.

Many contractors believe federal cybersecurity requirements start when CMMC certification arrives. They already started. FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, sits in most federal contracts above the micro-purchase threshold and applies the moment your systems process, store or transmit Federal Contract Information (FCI): information provided by or generated for the government under contract that is not intended for public release.

The clause lists fifteen requirements. In plain terms: limit system access to authorized users and devices, control what public-facing systems expose, verify identities, sanitize media before disposal, control physical access, monitor and control external connections, patch flaws in a timely way, run malware protection and keep it current, and scan what enters your systems. If you run a competent small-business IT shop, none of these are exotic. What they are is contractual: when the clause is in your contract, each one is a promise you have already made, and it flows down to your subcontractors.

Three things to act on. First, map your systems: know where FCI lives, because the requirements attach to those systems. Second, self-assess against the fifteen and write down what you found, when, and what evidence supports each answer. CMMC Level 1 is built on these same fifteen practices, and NIST SP 800-171 obligations are expected to expand across civilian agencies through pending FAR updates, so the work compounds. Third, make your assessment provable. A self-assessment that cannot show when it was done, or that its results have not been altered since, is weak evidence in a dispute or audit. This is where tamper-evident records earn their keep: CompassIP's Trust Ledger Anchoring gives any self-assessment or compliance record a dual-signed, independently verifiable receipt, so you can prove what you attested and when.

The requirements are the floor, not the ceiling. Treat them as the start of your evidence trail.

Source: FAR 52.204-21, acquisition.gov. This article is general information, not legal or compliance advice.