FAR 52.204-21

No changes recorded yet — we are watching, and nothing has been published.

1. 2026-07-23 Comment period closed on the FAR Overhaul proposed rule that would move the clause to 52.240-5
2. 2025-08-14 FAR Overhaul model deviation text for Part 40 issued; agencies adopting it use clause 52.240-93 for basic safeguarding
3. 2021-12-06 NOV 2021 version of the clause takes effect
4. 2016-06-15 FAR 52.204-21 takes effect

1. 2026-06-23
   FAR Overhaul proposed rule (Parts 1, 2, 4, 33, 39, 40, 53) Draft

   Proposes moving the clause to 52.240-5, Covered Federal Information, as part of the Revolutionary FAR Overhaul; comments closed on 23 July 2026. source

2. 2021-11-04
   FAR 52.204-21 (NOV 2021) RevisionCurrent

   Replaced "commercial items" with "commercial products or commercial services" in the subcontract flowdown; effective 6 December 2021. source

3. 2016-05-16
   FAR 52.204-21 (JUN 2016) Major version

   Added a new subpart and contract clause for basic safeguarding of contractor information systems that hold Federal contract information; effective 15 June 2016. source

The clause covers contractor information systems that process, store or transmit Federal contract information.

Federal contract information

Information not intended for public release that is provided by or generated for the Government under a contract, excluding public information and simple transactional information such as that needed to process payments. source

Subcontracts

The clause flows down to subcontracts, including for commercial products or services (other than COTS items), where the subcontractor may hold Federal contract information. source

Other requirements

It does not relieve the contractor of other safeguarding requirements set by agencies, for example for Controlled Unclassified Information. source

FAR Overhaul

Under the FAR Overhaul Part 40 deviation text, the equivalent clause is 52.240-93, Basic Safeguarding of Covered Contractor Information Systems. source

CMMC Level 1

DoD's CMMC Level 1 uses the safeguarding requirements of 48 CFR 52.204-21. source

The clause sets 15 safeguarding requirements; where DoD requires CMMC Level 1, they are checked through an annual self-assessment.

Requirements

Fifteen basic controls, from limiting system access to authorized users to periodic and real-time malware scans. source

DoD contracts

Where CMMC Level 1 is required, a self-assessment against these requirements is done annually and entered in SPRS. source

The clause is enforced as a contract term by the contracting agency.

Contract term

Contracting officers insert the clause in solicitations and contracts when the contractor may have Federal contract information in its systems. source

1. Law text FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
2. Guidance FAR Overhaul – Part 40, Information Security and Supply Chain Security (model deviation text)
3. Law text Final rule creating the clause (16 May 2016)
4. Law text FAR Overhaul proposed rule, Parts 1, 2, 4, 33, 39, 40 and 53 (23 June 2026)

1. CMMC

   CMMC is DoD's program that checks contractors' security; its Level 1 uses the requirements of FAR 52.204-21.

2. DFARS 252.204-7012

   DFARS 252.204-7012 applies to DoD contractors handling covered defense information and requires NIST SP 800-171 and 72-hour incident reporting; 52.204-21 is a basic floor for Federal contract information.

3. NIST SP 800-171

   NIST SP 800-171 sets requirements for Controlled Unclassified Information; 52.204-21 covers the less sensitive Federal contract information.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to FAR 52.204-21 (RSS)