Overview
FAR Subpart 4.19 establishes the minimum security requirements for protecting "Federal Contract Information" (FCI) that resides on or transits through contractor information systems. This subpart ensures that even for non-classified contracts, contractors maintain a baseline level of "basic safeguarding" to prevent unauthorized access or disclosure of non-public government data.
Key Rules
- Definition of FCI: Federal Contract Information is any information provided by or generated for the Government under a contract that is not intended for public release. It specifically excludes simple transactional information (like payment processing) and information already available to the public.
- Applicability: These regulations apply to all acquisitions, including commercial products and services, where a contractor’s system may handle FCI.
- The COTS Exception: The only major exception to this subpart is for the acquisition of Commercially Available Off-The-Shelf (COTS) items.
- System Ownership: The rules apply to any information system owned or operated by a contractor that processes, stores, or transmits FCI.
- Mandatory Clause: The requirements are codified in the contract through the inclusion of FAR clause 52.204-21.
Responsibilities
- Contracting Officers (CO): Responsible for determining if FCI will be involved in the contract and ensuring that FAR clause 52.204-21 is inserted into all applicable solicitations and contracts.
- Prime Contractors: Must implement the 15 basic security controls specified in the related clause and are responsible for flowing down the requirement to subcontractors at all tiers who may handle FCI.
- Subcontractors: Must comply with the same safeguarding standards as the prime contractor if they receive, store, or transmit FCI as part of their performance.
Practical Implications
- Cybersecurity "Floor": This subpart represents the absolute minimum cybersecurity "floor" for doing business with the federal government. While it is less rigorous than NIST SP 800-171 (required for Controlled Unclassified Information/CUI), no contractor can ignore these basics.
- Flow-Down Management: Prime contractors must have a process to identify which subcontractors will handle FCI to ensure the 52.204-21 clause is properly flowed down, as failure to do so could result in a breach of contract.
- Broad Scope: Because the definition of FCI includes almost any non-public communication or data "generated for the Government," most service and manufacturing contracts (that are not COTS) will trigger these requirements. Contractors should assume that technical drawings, performance schedules, and Statement of Work (SOW) details constitute FCI and must be protected accordingly.