What are the 15 basic safeguarding requirements of FAR 52.204-21?

The 15 basic safeguarding requirements of FAR 52.204-21 cover fundamental cybersecurity practices to protect covered contractor information systems. This clause is a common requirement for federal contracts that involve Federal Contract Information, even for services like janitorial work if your systems will handle that data. The requirements are:

• Limit information system access to authorized users, processes acting on behalf of authorized users, or devices.
• Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
• Verify and control connections to external information systems.
• Control information posted or processed on publicly accessible information systems.
• Identify information system users, processes acting on behalf of users, or devices.
• Authenticate information system users, processes acting on behalf of users, or devices.
• Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
• Protect the confidentiality of Federal Contract Information at rest and in transit.
• Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
• Control and manage information system components.
• Implement a security awareness program.
• Periodically update malicious code protection mechanisms.
• Monitor information system for unauthorized use of Federal Contract Information.
• Map organizational information systems and processes to Federal Contract Information flow.
• Apply security configurations to information systems.