Skip to content

Required IT Security Controls

Required IT Security Controls for GSA Schedule Contractors

The federal government has always relied heavily on the contracting community to support their missions. To help the government safely and effectively achieve their missions, GSA Schedule contractors should adopt better controls to protect against both cyber and supply chain threats. GSA Schedule contractors, at minimum, are required to meet 15 basic security controls outlined in FAR 52.204-21 and the procedures to protect their covered contractor information systems.

“Covered contractor information systems” is an information system that is owned or operated by a contractor that processes, stores, or transmits federal contract information. “federal contract information” means “means information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service to the government, but not including information provided by the government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.”

These terms are interpreted to cover any information provided by or transmitted to the federal government in connection with contract performance. The 15 controls are intended to impose minimum safeguarding measures that the government believes any responsible contractor should have in place as part of the cost of doing business.

FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems

Contractors shall apply the following basic safeguarding requirements and procedures to protect covered contractor information systems. Requirements and procedures for basic safeguarding of covered contractor information systems shall include, at a minimum, the following security controls:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

 

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

 

(iii) Verify and control/limit connections to and use of external information systems.

 

(iv) Control information posted or processed on publicly accessible information systems.

 

(v) Identify information system users, processes acting on behalf of users, or devices.

 

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

 

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

 

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

 

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

 

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

 

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

 

(xii) Identify, report, and correct information and information system flaws in a timely manner.

 

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

 

(xiv) Update malicious code protection mechanisms when new releases are available.

 

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.