Requires basic safeguarding controls for contractor systems that process, store, or transmit Federal contract information.
Applicability: Inserted when prescribed by FAR 4.1903; it generally applies to covered contractor information systems and excludes COTS acquisitions.
Key Requirements
Apply the clause's fifteen basic safeguarding requirements to covered contractor information systems
Protect Federal contract information, including access, authentication, media disposal, communications, and malware safeguards
Flow down the substance of the clause, including paragraph (c), to applicable subcontracts
Common Issues & Pitfalls
Proposing without adequate security infrastructure in place
Treating the basic safeguarding clause as if it were a separate NIST or CMMC certification
Not addressing cybersecurity in the technical proposal when clause applies
Failing to include security requirements in subcontract language
Contractor Guidance for Your Bid
Do not describe this clause as a blanket NIST SP 800-171 or CMMC certification requirement. Map the solicitation's actual safeguarding and any separate CUI or DoD clauses to your systems, then document the controls and subcontract flow-downs that apply.
Related FAR Clauses
Everything You Need to Know Before Bidding
Straight answers on data privacy, free trial access, and federal contracting workflows.
Have a specific question about your NAICS or team size?
Our GovCon capture specialists respond within 1 business hour.