A government contractor should treat every security questionnaire as a request for evidence against two documents: FAR clause 52.204-21, which sets 15 basic safeguarding controls for systems holding federal contract information, and NIST SP 800-171, which covers controlled unclassified information. Know which applies to your contract, map answers to it, and never claim more than you have.
Which rules are buyers usually asking about?
Prime contractors and agencies ask because their contracts flow requirements down. Two sources appear most often.
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, applies to a contractor information system that processes, stores or transmits federal contract information. That is information not meant for public release, provided by or generated for the government under a contract, excluding public website content and simple transactional data such as payment processing. The clause requires the contractor to include its substance in subcontracts where the subcontractor may have such information.
NIST SP 800-171 Revision 3, published May 2024, gives recommended requirements for protecting the confidentiality of controlled unclassified information in nonfederal systems. NIST says the requirements are meant for agencies to use in contracts and other agreements, and a companion publication, SP 800-171A, gives assessment procedures.
Your contract states which applies. Other clauses may add duties, so read the contract itself.
What do the 15 basic controls cover?
The FAR clause lists them at a high level: limit access to authorized users and permitted functions, control connections to external systems, control information on public systems, identify and authenticate users and devices, sanitize media before disposal, limit physical access and escort visitors, monitor and protect communications at boundaries, separate public-facing subnetworks, fix flaws in a timely manner, protect against malicious code and keep that protection updated, and run periodic and real-time scans.
Two of these are directly relevant to software teams: identify, report and correct system flaws in a timely manner, and scan files from external sources as they are downloaded, opened or executed.
How do you build an answer file?
- Identify which contracts carry which clause, and what data you hold under each.
- Draw the system boundary: which systems process federal contract information or CUI.
- For each of the 15 FAR controls, write an answer, name the owner and attach evidence.
- If CUI is in scope, map to 800-171 requirement families and assess against 800-171A.
- Record exceptions in a plan of action with dates.
- Prepare subcontractor flow down language and a list of subs who touch the data.
- Keep scan reports, patch records, access review results and training logs ready.
Constructed example: a small firm builds a logistics app for a defense prime. The prime's questionnaire asks, "Do you correct flaws in a timely manner?" The answer file points to a patch policy with severity deadlines, the last quarter's remediation report, and a list of exceptions approved by the security owner.
How should you word answers?
State facts: what is in place, what is partial, what is planned and by when. Do not call yourself certified or compliant with a framework unless an assessment says so. A basic safeguarding clause is a set of contract requirements, not a certificate.
Where does the software supply chain fit?
Buyers increasingly ask what open source is in your product and how you track flaws. A current SBOM and scan history answer that directly. Safeguard's CLI generates SBOMs and scans dependencies, and its compliance automation can organise evidence, but the scope decisions and attestations stay with your leadership.
What about subcontractors you depend on?
The FAR clause requires flow down to subcontractors that may have federal contract information. Keep a list of those vendors, the data each can reach and the clause language in your agreement. When a prime asks about your subcontractors, you can answer from that list in minutes rather than weeks.
Quick check
How many controls does FAR 52.204-21 list?
Fifteen basic safeguarding controls, covering access, authentication, media, physical access, boundaries, flaw correction and malware protection.
Is SP 800-171 a certification?
No. It is a NIST publication of requirements. Assessment procedures are in SP 800-171A, and contracts say how compliance is shown.
Sources
- FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems, Acquisition.gov
- NIST SP 800-171 Rev. 3, CSRC
Last reviewed: 18 October 2026.
