Details about 48 FAR 52.204-21

We are a federal contractor, but we don’t have any Department of Defense (DoD) contracts. What does FAR 52.204-21 mean to me?

If you are a Federal Contractor that has signed a contract containing this clause, your company is likely already required to meet these controls. Additionally, if you are not currently meeting them, you may be at risk of contract default. There are only 16 controls, so this isn’t too difficult or expensive, but you will most certainly have to change procedures and policies, likely incurring some level of capital expenditures to replace or upgrade computers, network equipment, applications, or email systems. Our employees are experienced in helping companies like you meet these requirements with minimal impact to your workflow and budget.

As a Contractor, you must apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

• Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
• Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
• Verify and control/limit connections to and use of external information systems.
• Control information posted or processed on publicly accessible information systems.
• Identify information system users, processes acting on behalf of users, or devices.
• Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
• Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
• Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
• Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
• Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
• Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
• Identify, report, and correct information and information system flaws in a timely manner.
• Provide protection from malicious code at appropriate locations within organizational information systems.
• Update malicious code protection mechanisms when new releases are available.