The FAR 52.204-21 checklist, in plain English
All 15 basic safeguarding requirements, what each one means for a small shop, and what you'd show as proof. These are the same 15 requirements CMMC Level 1 is assessed against.
What FAR 52.204-21 is
FAR 52.204-21, "Basic Safeguarding of Covered Contractor Information Systems," is a contract clause. Paragraph (b)(1) lists 15 safeguarding requirements for any covered contractor information system, meaning a system you own or operate that processes, stores or transmits Federal Contract Information (FCI).
FCI is information that isn't meant for public release and is provided by or generated for the government under a contract. Information the government has made public, and simple transactional information like what's needed to process payments, doesn't count.
The clause also has to be flowed down to subcontracts where the subcontractor may have FCI in or passing through its systems. Commercially available off-the-shelf items are excluded. CMMC Level 1 is an annual self-assessment against these same 15 requirements.
How to use this checklist
- Go through each item and ask: could I prove this today?
- The plain-English lines are summaries. The official wording is in the clause itself, linked in the sources below.
- The evidence lines are examples, not an official list. Your proof should match how your company actually works.
- For CMMC, every item has to be met. There's no partial credit and no plan-of-action allowance at Level 1.
The 15 requirements
Only people and devices you've approved can get onto company systems.
What evidence looks like: A current list of user accounts and company devices that matches who actually works there.
People can only do what their job needs. Not everyone is an administrator.
What evidence looks like: A list of who has admin rights and why, plus screenshots of user roles in your main systems.
You decide which outside systems, personal devices and accounts can be used for company work.
What evidence looks like: A short written rule on personal devices and outside accounts, and settings that enforce it where possible.
Contract information doesn't end up on your website or social media.
What evidence looks like: A named person who approves public posts, and a record of that review.
Every person and device has its own identity. No shared logins.
What evidence looks like: A user list showing one account per person, and a device inventory.
Everyone proves who they are, with a password or other sign-in, before they get in.
What evidence looks like: Screenshots of password or sign-in settings. Changed default passwords on routers and devices.
Old drives, laptops, USB sticks and paper with FCI get wiped or destroyed before they leave.
What evidence looks like: A disposal log, wipe records or shredding receipts.
Only the right people can physically get to your computers, network gear and work areas.
What evidence looks like: Locked doors or rooms, and a list of who has keys or access.
Visitors are escorted, visits are logged, and keys and badges are tracked. CMMC splits this one into three parts.
What evidence looks like: A visitor log, a key or badge list, and a note on what happens when someone leaves.
Traffic in and out of your network is monitored and protected at the edge, usually by a firewall, and at key internal boundaries.
What evidence looks like: Firewall or router settings, and who manages them.
Anything the public can reach, like a website or guest Wi-Fi, is kept apart from your internal systems.
What evidence looks like: A simple network diagram, guest Wi-Fi settings, or proof your website is hosted separately.
Security flaws get found, reported and fixed promptly, mostly by keeping updates current.
What evidence looks like: Patch or update history, and automatic update settings.
Antivirus or anti-malware protection is in place where it's needed.
What evidence looks like: A screenshot or console view showing protection on every in-scope device.
That protection keeps itself up to date.
What evidence looks like: Auto-update settings, or a dashboard showing current definitions.
You run regular scans, and files get scanned as they're downloaded or opened.
What evidence looks like: Scheduled scan settings, real-time protection turned on, and a recent scan report.
Proof matters as much as practice
Don't overlook the paperwork. A requirement you meet in practice still needs proof: a written rule, a current user list, a visitor log, a record of disposal. Anything missing has to be fixed before you affirm, because Level 1 doesn't let you post now and fix later.
Want help? Onyx writes your policies, builds an evidence binder for all 15 requirements and walks you through the SPRS affirmation. See pricing, or read the Level 1 self-assessment guide.
Common questions
Is FAR 52.204-21 the same as CMMC Level 1?
CMMC Level 1 is an annual self-assessment against the 15 security requirements in FAR 52.204-21. The FAR clause sets the requirements; CMMC adds the assessment, SPRS entry and annual affirmation.
Do these apply if my contract doesn't mention CMMC?
If your contract includes FAR 52.204-21, its 15 requirements apply to systems that handle FCI, whether or not the contract also has a CMMC requirement.
Does the clause require multi-factor authentication?
The clause says to authenticate or verify identities before allowing access. It doesn't name a specific method like multi-factor authentication.
Why does CMMC show 17 items instead of 15?
CMMC splits requirement (b)(1)(ix), the one about visitors, physical access logs and access devices, into three parts. It's still 15 requirements in the FAR clause.
What counts as Federal Contract Information?
Information not intended for public release that's provided by or generated for the government under a contract. Public information and simple transactional information, like payment details, don't count.
Find out where you stand in 20 minutes.
Free, no obligation. If you're already covered, we'll tell you.
Sources
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (acquisition.gov)
- 32 CFR 170.15, Level 1 requirement identifiers (Cornell LII)
- 32 CFR 170.15, CMMC Level 1 self-assessment (eCFR)
- DoD CIO, About CMMC
- McDermott Will & Emery, CMMC from the bottom up: Level 1
General information, not legal advice. Back to Onyx home.