Overview
This section mandates the inclusion of a specific cybersecurity clause in federal solicitations and contracts to ensure the protection of Federal contract information (FCI) within contractor information systems.
Key Rules
- Mandatory Clause: Contracting officers are required to insert the clause at FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
- Applicability Trigger: The clause must be used whenever a contractor or subcontractor (at any tier) may have FCI residing in or transiting through their information systems.
- Flowdown Requirement: Because the rule specifies "at any tier," the requirements must be passed down from prime contractors to subcontractors who handle protected data.
Practical Implications
- Estiblyishes a universal "basic hygiene" cybersecurity baseline for all government contractors handling non-public contract data.
- Requires prime contractors to vet their subcontractors' information systems and ensure the inclusion of these safeguarding terms in all subcontracts.