New Security Requirements For All Contracts And Subcontracts

Starting June 15, 2016 a new clause, FAR 52.204-21 “Basic Safeguarding of Covered Contractors Information Systems” will appear in solicitations and resulting contracts and subcontracts. The primary focus of the new clause is fifteen “basic safeguarding requirements and procedures.” Though the general consensus is that these obligations are not terribly onerous, conventional wisdom dictates that it is one thing to take actions as a matter of business choice and a very different thing to take those actions as contractual obligation with the Government.

Additionally, because these obligations are viewed as a bare minimum that all companies should already employ to protect their own commercial operations, the only applicable exception is for COTS Items at all tiers.

A New Term of Art: “Federal Contract Information”

The applicability of the new contract clause, FAR 52.204-21, turns on the new term of art “Federal contract information” which is defined as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments.” FAR Final Rule 81 Fed. Reg. 30439, 30441 (May 16, 2016) The Intention was for the clause to be broad. The comments express some concern over the breadth of the new rule to which the government responds that the new safeguards are very basic and only applicable to those systems which contain government contract information.

Burden on Small Commercial Service Providers

Based on the broad definition of “Federal contract information” virtually any contract deliverable that is information or contains information will invoke the new rule and its accompanying safeguards. However, the new rule states “This subpart applies to all acquisitions, including acquisitions of commercial items other than commercially available off-the-shelf items, when a contractor’s information system may contain Federal contract information.” (FAR 4.1902 emphasis added). Therefore, a contractor or subcontractor may limit the required application of the new rule to only those systems which contain Federal contract information, “if the contractor stores preexisting proprietary data or trade secrets in a separate information system, the contractor can decide how to protect its own information” FAR Final Rule 81 Fed. Reg. 30439, 30441 (May 16, 2016).

Read more: New Baseline IT Security Requirements For All Government Contracts And All Subcontracts At All Tiers