govcon.forum

What are the 15 security requirements of FAR 52.204-21?

Ask a question
Asked Active Viewed 0 timesQuestion
1answer

My company is an IT services firm working on federal contracts. We recently saw a Request for Quotation for a project under NAICS 541519, and the contracting officer mentioned that FAR 52.204-21 would be in the contract. I know this clause covers basic safeguarding of covered contractor information systems, and I have heard it is often associated with CMMC Level 1. We need to make sure we are compliant with all the requirements if we want to bid. I have looked at the regulation text, but I want to make sure I am not missing anything. What are the 15 specific security requirements listed in FAR 52.204-21?

compliance-and-securityfarcybersecuritycompliancesecurity
ShareReport
asked Priya S. Verified vendorCapture manager, IT services · Herndon, VA · 885 rep

1 answer

0

The 15 security requirements of FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, are listed in paragraph (b)(1) of the clause. These requirements cover access control, user identification and authentication, system and communications protection, and incident response. For example, requirement (i) is to limit information system access to authorized users, processes acting on behalf of authorized users, or devices. Requirement (ii) is to limit information system access to the types of transactions and functions that authorized users are permitted to execute. Requirement (v) covers verifying and controlling connections to external information systems. Requirement (xi) is to protect the confidentiality of controlled unclassified information at rest. These are the same 15 requirements that make up CMMC Level 1.

ShareReport
answered Tom B. Construction estimator, public works · Phoenix, AZ · 710 rep

Your answer

Sign up to answerCite the FAR clause or procurement code where you can.

Related questions