What are the requirements for the Basic Safeguarding of Covered Contractor Information Systems (FAR 52.204-21)?

The 15 requirements of FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, are foundational cybersecurity practices that apply to federal contracts. These requirements, numbered (i) through (xv) in FAR 52.204-21(b)(1), address basic IT security. For example, requirement (i) specifies limiting system access to authorized users, which means implementing user accounts and strong passwords. Requirement (ii) calls for controlling information flow, such as through firewalls, while (iii) requires protecting physical access to information systems. Other requirements cover topics like identifying system flaws, regularly updating security software, and ensuring proper disposal of system media. Meeting these means your company needs to have policies and technical controls in place for user access, network protection, physical security, and system maintenance. This is also the basis for CMMC Level 1, which is a self-assessment.