All 15 Requirements
FAR 52.204-21(b)(1) safeguarding controls.
- Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
- Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
- Verify and control or limit connections to and use of external information systems.
- Control information posted or processed on publicly accessible information systems.
- Identify information system users, processes acting on behalf of users, or devices.
- Authenticate or verify the identities of users, processes, or devices before allowing access to organizational information systems.
- Sanitize or destroy information system media containing Federal Contract Information (FCI) before disposal, release, or reuse.
- Limit physical access to organizational information systems, equipment, and operating environments to authorized individuals.
- Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control/manage physical access devices.
- Monitor, control, and protect organizational communications at external boundaries and key internal boundaries.
- Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
- Identify, report, and correct information and information system flaws in a timely manner.
- Provide protection from malicious code at appropriate locations and update protection mechanisms when new releases are available.
- Update malicious code protection and other security-relevant software in a timely manner.
- Perform periodic and real-time scans of information systems and files from external sources as files are downloaded, opened, or executed.