What are the 15 requirements of FAR 52.204-21 for basic safeguarding of information systems?

The 15 requirements of FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, are listed in paragraph (b)(1) of the clause. These requirements cover basic cyber hygiene for information systems that process, store, or transmit federal contract information. They include limiting information system access to authorized users, controlling information flow, identifying and authenticating users, and encrypting CUI at rest and in transit. The clause also requires contractors to control physical access to information systems, use current antivirus software, and ensure proper system configuration. Other requirements involve patching system flaws, implementing least functionality, and providing audit logging capabilities. It also covers safeguarding media, limiting the use of portable storage, and ensuring proper system disposal. Finally, the clause requires contractors to scan for malicious code, monitor system security, and implement incident response plans. CMMC Level 1 builds directly on these 15 requirements.