The 15 FCI Safeguards Explained in Plain English: A CMMC Level 1 Guide for Defense Contractors
In today’s post, we’ll share insights on the 15 Federal Contract Information (FCI) safeguards in FAR 52.204-21, explain what each requirement means, provide some practical examples, and guide you in how to prepare for CMMC Level 1 readiness.
If you’ve begun the journey toward CMMC accreditation, you’ve realized the task is not as simple as checking off a to-do list. The number of requirements and evidence gathering may seem daunting, but Gold Comet is here to assist, offering the following guidance to help you navigate your unique path successfully and to help you manage and store your assessment data securely.
Starting with your CMMC Level 1 self-assessment. Let’s begin.
What Are FCI Safeguards?
Federal Contract Information (FCI) is information that is not intended for the general public. FCI is provided by the U.S. government or generated by you for the U.S. government under an official contract that you have been awarded to develop or deliver a service or a product.
What are some examples of FCI? FCI may include things like nonpublic contract documents, project specifications, work instructions, and other contract-related information, depending on the circumstances and the requirements of your contract.
For organizations supporting the Defense Industrial Base (DIB), protecting FCI is both a critical cybersecurity responsibility and an important part of meeting applicable federal contract requirements.
The Federal Acquisition Regulation (FAR) clause 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, establishes 15 basic safeguarding requirements for contractor information systems that process, store, or transmit FCI. These safeguards form the foundation of CMMC Level 1, which requires an annual self-assessment and affirmation (self-attestation) for organizations subject to the applicable CMMC requirements. See the Department of Defense’s official CMMC overview.
Note: Self-attestation must be supported by documented evidence, managed, shared, stored, and archived within a secure enclave. The attestation is legal and binding, a sworn statement that your enterprise has met the requirements and has the evidentiary documentation to prove it, at the time of attestation. Steps that you “plan to implement soon” don’t count and cannot be used as part of your attestation package.
Understanding the 15 safeguards is your first step. As a contractor, you must also determine which systems are in scope, implement the appropriate controls, and maintain evidence that the safeguards are operating as intended.
This guide explains each safeguard in plain language, providing practical examples and verification questions to help you evaluate your current practices. Let’s dive in.
FCI Safeguard 1: Limit System Access to Authorized Users, Processes, and Devices.
Requirement:
Limit information system access to authorized users, processes acting on behalf of authorized users, or authorized devices, including other information systems.
What it Means:
Only approved people, applications, automated processes, and devices should be able to access systems that handle your FCI.
You must establish control over who and what can connect to your systems. An employee’s business relationship with the company does not automatically mean that the employee needs access to every system or every piece of contract information.
This safeguard establishes the basic principle of controlled access: unauthorized users and devices must not be able to enter systems containing protected contract information.
Why it Matters:
Compromised accounts, unauthorized devices, and improperly configured access can expose FCI to individuals who have no legitimate business need to see it. Unrestricted access also increases the potential impact of a compromised employee account.
Access controls help reduce the number of opportunities for attackers to obtain sensitive information.
Practical Example:
A small defense subcontractor stores contract specifications and project documents in a secure collaboration environment. Employees receive individual accounts, and only approved personnel can enter the environment. Unrecognized devices or unauthorized accounts are denied access according to the organization's configured controls.
When an employee leaves the company, the administrator must disable the account and remove associated access.
What to Verify:
Does every person with access have an approved business reason?
Are individual accounts used instead of shared credentials?
Are applications, automated processes, and connected devices appropriately authorized?
Is access removed promptly when employment or project responsibilities change?
Can administrators review and verify current access permissions?
Gold Comet’s Perspective:
Secure data storage and collaboration technology can support this safeguard through controlled access and centralized administration. Your enterprise must still define authorization rules and manage access appropriately.
FCI Safeguard 2: Limit Users to Authorized Functions and Transactions.
Requirement:
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
What it Means:
Being authorized to enter a system does not mean a user should be allowed to perform every available action.
This safeguard focuses on what an authorized user can do after access is granted. Permissions should reflect job responsibilities and business needs. For example, viewing a document, editing it, downloading it, sharing it externally, and administering the system are different activities that may require different permissions.
Why it Matters:
Excessive privileges can turn an otherwise legitimate account into a significant security risk. If an account is compromised, attackers may be able to download sensitive files, alter information, create unauthorized sharing links, or modify security settings.
Limiting user functions reduces the opportunities for accidental disclosure and misuse.
Practical Example:
An engineering contractor gives project engineers permission to view and update the technical documents they need. A project manager can approve document releases, while system administration privileges are restricted to designated administrators.
A subcontractor receives access only to the specific files required for its assigned work rather than the entire project repository.
What to Verify:
Are permissions based on job responsibilities and business needs?
Are viewing, editing, downloading, sharing, and administrative functions appropriately separated?
Are privileged accounts limited to authorized personnel?
Are permissions reviewed when project assignments or responsibilities change?
Do collaboration systems support the required restrictions, and have those restrictions been configured and tested?
Your Key Takeaway:
Access authorization answers, “Who can enter?” and “What can they do once they are inside?” These activities must be clearly defined and carefully controlled.
FCI Safeguard 3: Control Connections to External Information Systems.
Requirement:
Verify and control or limit connections to and use of external information systems.
What it Means:
Contractors must verify and control connections to systems outside their organization's managed environment. These external systems may include third-party cloud services, personal devices, partner networks, remote services, and other platforms that can store, process, or transmit information.
The requirement is not simply to prohibit every external connection. It is to ensure that hybrid connections and uses are appropriately evaluated and controlled.
Your organization should understand where FCI is permitted to go and which external services are approved to handle it.
Why it Matters:
Employees can unintentionally expose FCI by uploading documents to personal cloud storage, forwarding files to unapproved accounts, or using unauthorized file-sharing tools. These exposure risks occur more often than you think.
External services can also introduce risks involving account security, access management, data retention, impacting your organization's ability to control information after it has been shared.
Practical Example:
A defense contractor establishes an approved process for sharing FCI with a project partner. Before information is transferred, the organization confirms that the partner and the receiving system are authorized for the intended use.
Employees are instructed not to transfer contract documents to personal file-sharing accounts. Approved collaboration tools provide controlled access and allow designated administrators to manage sharing permissions.
What to Verify:
Is there an inventory of approved external systems and services used with FCI?
Are connections and data-sharing arrangements evaluated before use?
Are employees prevented or appropriately restricted from using unauthorized services?
Are external recipients and their access permissions verified?
Can the organization control, review, and revoke external access where supported?
Gold Comet’s Perspective:
A secure collaboration platform can help contractors share FCI with approved recipients while maintaining control over access. However, selecting a platform is only part of the process; organizations must establish and enforce rules for its use.
FCI Safeguard 4: Control Information on Publicly Accessible Systems.
Requirement:
Control the information that is posted or processed on publicly accessible information systems.
What it Means:
Organizations must prevent unauthorized disclosure of FCI through systems that are freely available for public use. Such systems may include public websites, open forums, public reference and document repositories, and other services where information can be accessed without appropriate restrictions.
This safeguard gains particular relevance when employees publish project materials, technical documents, presentations, images, or other contractual files online.
Information that is intended for public release should be distinguished from nonpublic contract information before publication. Gold Comet recommends developing a process for reviewing all materials for designating and protecting FCI and deciding what materials can be displayed in public forums.
Why it Matters:
Once sensitive information is published publicly, it may be copied, indexed by search engines, downloaded, or redistributed. Removing the original post may not, does not, and cannot eliminate every copy that may have been made.
Even seemingly harmless information can reveal details about a project, customer, operational process, or contractual relationship when aggregated with intel and other publicly available information.
Practical Example:
An employee prepares a presentation for the company website. Before publication, a designated reviewer checks the material to ensure it does not contain nonpublic contract specifications, customer-provided documents, or other FCI.
The company also establishes procedures for reviewing public-facing content and correcting unauthorized disclosures when discovered.
What to Verify:
Are public-facing materials reviewed before publication?
Do employees understand which contract information must not be publicly disclosed?
Are access permissions and publication rights appropriately restricted?
Are public repositories and websites checked for unauthorized contract information?
Is there a process for reporting and addressing accidental disclosures?
An Important Distinction:
FCI is not automatically the same as Controlled Unclassified Information (CUI). If information is designated or otherwise subject to CUI handling requirements, additional safeguards may apply. As a contractor, you should always seek to determine the applicable requirements of your contracts and relevant government guidance. Breach of contractual propriety is not a mark you want to have on your enterprise record.
Safeguard 5: Identify System Users, Processes, and Devices.
Requirement:
Identify all information system users, applications and processes acting on behalf of users, or devices active in your enterprise network.
What it Means:
Your organization must be able to identify the users, automated processes, and devices interacting with information systems and determine whether those activities are authorized. Identification establishes a recognizable identity for an account, process, or device and is a prerequisite for reliably controlling access and understanding who or what is attempting to use a system.
For people, this commonly means assigning individual user accounts. For automated services and devices, it may involve unique account identifiers, device identities, or other appropriate identification mechanisms.
Why it Matters:
If multiple employees use the same account, it may be difficult to determine who performed a particular action. Similarly, unidentified devices or processes may connect to systems without adequate accountability, increasing risk of vulnerability or breach.
Reliable identification supports access control, auditing and incident investigation, and the ability to distinguish legitimate activity from suspicious behavior.
Practical Example:
A small manufacturer gives each employee a unique account for the system used to store FCI. Automated integrations use designated service identities rather than an employee's personal credentials.
The organization maintains an inventory of authorized devices and can associate system activity with identifiable accounts or processes.
What to Verify:
Does each user have a unique, identifiable account?
Are shared or generic accounts avoided or appropriately controlled?
Are automated processes identifiable and managed?
Are authorized devices identified where required?
Can the organization associate system access and relevant activities with the correct user, process, or device?
Key Takeaway:
Identification establishes who or what is requesting access. The next safeguard addresses how the organization verifies that identity.
Preparing for the Remaining FCI Safeguards:
The first five safeguards establish a foundation for controlling access to FCI, limiting user privileges, managing external connections, preventing public disclosure, and identifying users and devices.
The following ten safeguards address authentication, media sanitization, physical security, visitor management, communications protection, network separation, system flaw remediation, malicious-code protection, security updates, and malware scanning.
Together, the 15 safeguards provide a practical baseline for protecting FCI in covered contractor information systems. Gold Comet recommends that all contractors evaluate each requirement against the actual systems, workflows, and facilities involved to ensure the requirements for FCI management are clearly covered with identifiable evidence.
Protecting FCI is more than a one and done checklist event. FCI management requires appropriate technical controls, documented procedures, accountable personnel, and ongoing review. Secure data management and collaboration capabilities can support these efforts, while a structured governance, risk, and compliance (GRC) process will help your organization assess controls, document evidence, track gaps, and manage readiness.
Gold Comet helps organizations protect and manage sensitive information through secure data storage, sharing, and messaging capabilities.
To explore how secure data management can support your FCI protection strategy, contact Gold Comet to discuss your requirements and current approach to CMMC Level 1 readiness.
Read about Gold Comet’s approach FCI data security here.
FCI Safeguard 6: Authenticate the Identities of Users, Processes, and Devices.
Requirement: Authenticate (or verify) the identities of users, processes acting on behalf of users, or devices before allowing access to organizational information systems.
What it Means:
While dentification (Safeguard 5) tells a system who or what is requesting access, authentication verifies that the claimed identity is legitimate.
Common authentication methods include passwords, authentication applications, security keys, certificates, and other verification mechanisms. The appropriate method depends on the system, its configuration, and applicable requirements, but Gold Comet always recommends that a multifactor authentication (MFA) sequence be used because authentication that requires multiple verification inputs is significantly less likely to be compromised.
Authentication should apply not only to employees but also, where relevant, to automated processes and devices connecting to organizational systems.
Why it Matters:
A username alone does not prove identity. Attackers may obtain basic credentials through phishing, password reuse, malware, or other techniques. If a system accepts a stolen password without adequate verification, an unauthorized person may gain access to FCI.
Authentication helps prevent unauthorized access and supports accountability by connecting system activity to verified identities.
Practical Example:
An engineering contractor requires employees to authenticate before accessing its FCI repository. The organization configures its authentication controls to verify user identities and restricts access when verification fails. Administrative accounts receive appropriate additional protection.
Automated integrations use managed service identities and credentials rather than undocumented shared passwords.
What to Verify:
Does the system authenticate users before granting access?
Are authentication mechanisms configured and operating as intended?
Are credentials protected against unauthorized disclosure?
Are automated processes and relevant devices authenticated appropriately?
Are authentication failures handled and reviewed according to organizational procedures?
Gold Comet’s Perspective:
Authentication is one component of a broader Zero Trust approach. Zero Trust emphasizes explicit verification and least-privilege access rather than automatically trusting a user or device because it is inside the network. Contractors should verify that your actual technology configuration meets the applicable requirement.
FCI Safeguard 7: Sanitize or Destroy Media Containing FCI Before Disposal or Reuse
Requirement:
Sanitize or destroy information system media containing FCI before disposal or release for reuse.
What it Means:
When equipment or storage media containing FCI is discarded, returned, sold, reassigned, or otherwise reused, the organization must ensure that the FCI is properly removed or that the media is destroyed.
Such media may include hard drives, solid-state drives, removable USB devices, backup media, and other storage devices. Printed documents and other physical records containing FCI should also be handled under applicable information-handling procedures. FCI from long-term contracts may even be found stored on older technology such as DVDs/CDs which should also be destroyed rather than discarded.
Deleting a file or moving it to a recycle bin does not constitute destruction of the media; deletion does not necessarily remove its underlying data.
Why it Matters:
Storage devices can retain recoverable information even after files have been deleted. Improper disposal may expose contract information to a future owner, recycler, repair provider, or other unauthorized party.
The risk extends beyond computers. Removable drives, retired backup devices, and equipment returned to a leasing company can also contain sensitive data.
Practical Example:
A contractor retires a workstation that was used to access FCI. Before the equipment is sold or transferred, the organization identifies its storage media and follows an approved sanitization process appropriate to the device and its intended disposition.
Where sanitization cannot be reliably performed, the organization uses an appropriate destruction method and retains records of the action.
What to Verify:
Is there a documented process for disposing of or reusing media?
Are storage devices identified before equipment leaves organizational control?
Are sanitization or destruction methods appropriate for the media?
Are third-party disposal and recycling arrangements managed appropriately?
Are completion records maintained where appropriate?
For additional technical guidance, consult NIST Special Publication 800-88, Guidelines for Media Sanitization.
Key Takeaway:
FCI protection does not end when information is no longer needed. Secure disposal is part of the information lifecycle.
FCI Safeguard 8: Restrict Physical Access to Systems, Equipment, and Operating Environments.
Requirement:
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
What it Means:
Cybersecurity includes physical security as well as online/network security. Your organization must restrict who can physically access your computers, servers, networking equipment, storage devices, and the environments in which those systems operate. You can’t just walk out and leave the doors unlocked, much less standing wide open.
Physical access may enable someone to steal your equipment, remove storage media, connect an unauthorized device, access an unattended workstation, install malware.
Controls should reflect the environment. A contractor operating a dedicated server room may use locked doors and access controls, while a small business may rely on locked offices, secured equipment, and controlled access to work areas.
Why it Matters:
Digital protections can be undermined if unauthorized individuals can access your equipment directly. A stolen laptop or an unattended workstation may expose FCI and other data even when your organization's network perimeter is well protected.
Physical access restrictions help protect systems against tampering, theft, and unauthorized changes.
Practical Example:
A small defense supplier keeps network equipment and systems used to manage FCI in a locked office accessible only to designated employees. Workstations are configured to lock when unattended, and visitors are not allowed to handle company equipment without authorization.
If the contractor uses a cloud provider or managed service provider, it evaluates the physical-security responsibilities and assurances relevant to the systems and services in scope.
What to Verify:
Are facilities and work areas restricted to authorized personnel?
Are servers, networking equipment, and storage media physically protected?
Are workstations secured when unattended?
Are laptops and portable devices protected against theft or unauthorized access?
Have relevant third-party hosting and service arrangements been reviewed?
Gold Comet’s Perspective:
Secure Data Storage can help protect information at the digital layer, but it does not replace physical safeguards for endpoints, offices, servers, or other equipment that remains under the contractor's control. The successful security of your FCI requires a responsible partnership: You ensure the physical safety of your offices and equipment; Gold Comet ensures the cybersecurity of the data to be stored.
FCI Safeguard 9: Escort Visitors, Monitor Their Activity, Maintain Physical Access Logs, and Manage Access Devices.
Requirement:
Escort visitors and monitor all visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
What it Means:
Your organization must manage visitor access and maintain appropriate oversight of physical entry to their facilities and controlled environments.
This safeguard contains several related responsibilities:
Escort Visitors: Ensure visitors are accompanied as required by the organization's procedures and the environment.
Monitor Visitor Activity: Prevent visitors from entering restricted areas or interacting with protected equipment without authorization.
Maintain Physical Access Logs: Record physical access as required, using a method appropriate to the facility.
Manage Physical Access Devices: Control keys, badges, access cards, codes, and similar entry/exit devices so that they are issued, tracked, recovered, or disabled as appropriate.
Specific implementation will depend on your organization's facilities and operating arrangements.
Why it Matters:
Visitors, vendors, maintenance personnel, and temporary workers may have legitimate reasons to enter a facility without being authorized to access FCI or associated systems.
Movies are not farfetched that portray perpetrators disguised as electricians or a cleaning crew who look like they’re doing ordinary work and fail to arouse suspicion.
Without appropriate oversight, an individual or team could photograph sensitive information, connect unauthorized equipment, or enter an area containing protected systems.
Practical Example:
A contractor requires visitors to sign in, wear visitor identification, and remain accompanied while in restricted work areas. The company maintains physical access records and assigns badges only to authorized personnel.
When person leaves employment, the organization retrieves the badge and disables any associated access permissions. Lost keys or badges are handled through a clearly defined procedure.
What to Verify:
Are visitor sign-in and escort procedures established?
Is visitor activity monitored in controlled areas?
Are physical access records maintained?
Are keys, badges, cards, and entry codes controlled?
Are access devices recovered or disabled when no longer authorized?
Key Takeaway:
Physical access management is an essential part of protecting FCI. A strong digital access policy cannot compensate for uncontrolled entry to sensitive work areas.
FCI Safeguard 10: Monitor, Control, and Protect Organizational Communications.
Requirement:
Monitor, control, and protect organizational communications at the external boundaries and key internal boundaries of information systems.
What it Means:
Organizations must manage and protect communications entering, leaving, and moving between important parts of their information systems.
Communications may include internet traffic, email, file transfers, remote connections, and traffic between internal network segments. Controls may include firewalls, secure communication protocols, network monitoring, and appropriately configured gateways.
The goal is to establish oversight and protection at the boundaries where communications could introduce threats or expose FCI.
Why it Matters:
FCI can be exposed while being transmitted, not just while stored. Unprotected communications may permit interception, unauthorized access, or manipulation of information. Standard email is one of the worst vulnerabilities, allowing phishing attempts to enter and proprietary information to leak out.
Poorly controlled connections allow attackers to move from a compromised device into other parts of the organization's environment.
Practical Example:
A defense contractor uses managed network security controls to restrict inbound and outbound traffic. Remote access is limited to approved services, and employees share contract files through an approved secure collaboration environment rather than relying on uncontrolled transfers. The organization reviews relevant security alerts and investigates suspicious network activity.
What to Verify:
Are network boundaries and important internal boundaries identified?
Are communications monitored and controlled at appropriate points?
Are firewalls and other network controls configured and maintained?
Are remote connections and file-transfer methods appropriately protected?
Can responsible personnel review relevant alerts and investigate suspicious activity?
Gold Comet’s Perspective:
FCI Data Management is a critical component of the wider protection strategy. Contractors should understand where your FCI travels and use appropriate controls for storage, transmission, sharing, and access. Secure collaboration technology can support these activities, but the organization's network and communication controls must also be evaluated.
FCI Safeguard 11: Separate Publicly Accessible System Components From Internal Networks.
Requirement:
Implement subnetworks for publicly accessible system components that are physically or digitally separated from internal networks.
What it Means:
Systems or components that are publicly accessible should be separated from internal networks containing protected business systems.
This separation may be achieved through network segmentation, dedicated network zones, firewalls, or other physical or logical controls. The objective is to reduce the chance that a compromise of a public-facing component will provide direct access to internal systems.
For example, a public company website should not provide an unrestricted path into an internal network that supports FCI-related work.
Why it Matters:
Public-facing systems are exposed to traffic from outside the organization and may attract scanning, exploitation attempts, or other attacks.
If these systems are not appropriately separated, an attacker who compromises one public-facing component may be able to reach your internal resources containing FCI.
Practical Example:
A contractor hosts its public website in a separated network environment. Internal systems used for contract work are placed in a distinct environment, and network rules restrict communication between the two.
Only specifically authorized traffic is permitted between monitored network segments.
What to Verify:
Have public-facing system components been identified?
Are they physically or logically separated from internal networks?
Are firewall and segmentation rules configured appropriately?
Is access between public and internal environments restricted?
Are changes to network architecture reviewed to preserve separation?
Key Takeaway:
Network separation reduces the risk that a problem in a public-facing system will spread to internal resources that handle FCI.
FCI Safeguard 12: Identify, Report, and Correct System Flaws in a Timely Manner.
Requirement:
Identify, report, and correct information and information system flaws in a timely manner.
What it Means:
Your organization must identify weaknesses in software, hardware, configurations, and information systems, report them through appropriate channels, and take corrective action in a timely manner.
Flaws may include software vulnerabilities, unsupported applications, configuration errors, and other weaknesses that could affect system security.
The requirement is not satisfied simply by purchasing security/anti-virus software. You need a defined process for recognizing problems, assigning responsibility, and ensuring that identified issues are addressed as soon as possible. Timing is a critical factor: the longer a problem goes unchecked, the greater the damage and more costly the remediation.
Why it Matters:
Known vulnerabilities can provide attackers with opportunities to gain access, execute malicious code, disrupt services, or steal information.
Delays in correcting serious flaws can leave systems exposed long after a fix or workaround has become available. Cybercriminals are trained to look for known weaknesses and uninstalled patches.
Practical Example:
A small contractor receives a security advisory for an application used on its business systems. The IT provider evaluates whether the affected version is in use, determines the appropriate corrective action, applies the fix, and verifies that the update resolved the issue.
The contractor maintains a record of the issue, the action taken, and any follow-up testing.
What to Verify:
Is there a process for identifying and reporting system flaws?
Are software and hardware inventories sufficiently accurate to identify affected assets?
Are fixes prioritized and applied in a timely manner?
Are responsible personnel assigned to corrective actions?
Is remediation verified and documented?
Gold Comet’s Perspective: Effective audit/security content can help your organization understand the importance of visibility, accountability, and evidence, especially in the FCI self-assessment process. You should maintain records appropriate to all processes so that you will be able demonstrate how identified weaknesses are handled.
FCI Safeguard 13: Protect Systems Against Malicious Code.
Requirement:
Provide protection from malicious code at appropriate locations within organizational information systems.
What it Means:
Organizations must implement appropriate defenses against malicious code, including malware, ransomware, spyware, and other software designed to compromise systems or data. Protection may include endpoint security tools, anti-malware software, email filtering, application controls, and other mechanisms appropriate to the environment.
Protection should be considered at the points where malicious code could enter, execute, or spread rather than only protecting a single network gateway.
Why it Matters:
Malicious code can steal credentials, encrypt files, disrupt operations, or expose FCI. A successful attack may also disrupt or impede a contractor's ability to deliver products or services under a government contract.
Large prime contractors are not the only targets. Small businesses along the DIB supply chain can be particularly vulnerable when security responsibilities are unclear, or endpoint protection is inconsistently deployed.
Practical Example:
A contractor installs managed endpoint protection on company workstations and configures email and file-handling controls to reduce exposure to malicious attachments. Employees are instructed not to run unexpected files or bypass security warnings.
Security alerts are reviewed, and suspected infections are handled through an established response process.
What to Verify:
Is appropriate malicious-code protection deployed where needed?
Are company endpoints and relevant systems covered?
Are protection settings configured and monitored?
Are alerts reviewed and suspicious activity investigated?
Are employees trained to report suspected malware or unusual system behavior?
Key Takeaway:
Malicious-code protection is an ongoing operational responsibility. Deploying a tool without maintaining and monitoring is not a complete security strategy.
FCI Safeguard 14: Keep Malicious-Code Protection Mechanisms Updated.
Requirement:
Update malicious-code protection mechanisms when new releases are available.
What it Means:
Security tools must be maintained so that their detection mechanisms and other relevant components are updated when new releases become available.
Depending on the technology, updates may include malware signatures, detection engines, security intelligence, or other components used to recognize and block malicious code.
This safeguard complements Safeguard 13 which focuses on providing protection; Safeguard 14 addresses keeping that protection current.
Why it Matters:
New malicious-code variants and attack techniques emerge continually. Outdated protection may fail to recognize threats that newer releases can detect.
An organization may believe it has anti-malware protection in place while some devices are running outdated software or have stopped receiving updates.
Practical Example:
A managed service provider configures endpoint security tools to receive updates automatically. A monitoring process identifies devices that have stopped checking in or are running outdated protection components, allowing IT personnel to investigate and correct the issue.
The contractor periodically reviews whether protection is operating across the systems within its scope.
What to Verify:
Are malicious-code protection mechanisms configured to receive available updates?
Can administrators identify devices with outdated or malfunctioning protection?
Are update failures detected and addressed?
Are relevant systems covered by a defined maintenance process?
Can the organization verify that updates are being applied successfully?
Practical Tip:
Ask your IT provider how devices are detected that stop reporting to the security management console. A policy that requires updates is useful, but operational visibility helps determine whether the policy is working.
FCI Safeguard 15: Scan Systems and Files for Malicious Code.
Requirement:
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
What it Means:
Organizations must perform periodic scans of their information systems and real-time scans of files from external sources at the specified points: when files are downloaded, opened, or executed.
Periodic scanning helps identify malicious code that may already be present. Real-time scanning helps detect threats as externally sourced files enter use.
These activities serve different purposes and should not be treated as interchangeable.
Why it Matters:
Malicious files may arrive through email attachments, downloads, shared folders, removable media, or other external sources. A file that appears legitimate may contain malware capable of compromising a device or exposing FCI.
Periodic scans provide another opportunity to detect threats that were missed initially or introduced between scans.
Practical Example:
A contractor configures endpoint security software to scan systems periodically and examine externally sourced files in real time as they are downloaded, opened, or executed. The organization verifies that these features are enabled and that security alerts are reviewed.
Employees are also instructed to report suspicious files and avoid bypassing scanning or security warnings.
What to Verify:
Are periodic system scans configured and performed?
Are files from external sources scanned in real time at the required points?
Are scan failures or disabled protections detected?
Are malicious findings investigated and handled appropriately?
Can the organization verify that scanning is functioning on relevant systems?
Gold Comet’s Perspective:
Secure file-sharing and data-management workflows can help reduce uncontrolled file movement and improve administrative visibility. Your workflows should complement both endpoint and system-level malicious-code protection.
How the 15 FCI Safeguards Work Together
The 15 safeguards are most useful when treated as an integrated baseline with ongoing maintenance rather than 15 isolated checklist items.
Access restrictions and authentication help ensure that only authorized users, processes, and devices can reach systems. External connection controls and network separation reduce exposure. Physical security and media sanitization protect information outside normal digital workflows. Communications protection, vulnerability remediation, and malicious-code defenses help reduce the likelihood and impact of compromise.
Contractors can strengthen this approach through a coordinated combination of:
FCI Data Management: Identify where FCI resides, how it moves, who can access it, and which systems and services are involved.
Secure Data Storage: Protect FCI repositories through appropriate access controls, administration, and information-handling practices.
Zero Trust Architecture: Apply principles such as explicit verification and least privilege to access decisions.
Audit/Security Documentation: Use relevant records, reviews, and operational evidence to support oversight and demonstrate how safeguards are implemented.
These are useful areas for internal planning and technical improvement, but the actual regulatory obligation is found in the wording of FAR 52.204-21 and any other applicable contract requirements.
Preparing for CMMC Level 1: A Practical Contractor Checklist
Before completing a CMMC Level 1 self-assessment, you should work through the following steps:
Determine whether FCI is present. Review contracts, workflows, files, communications, and systems to identify information that meets the FCI definition.
Define the assessment scope. Identify the covered contractor information systems that process, store, or transmit FCI, and understand the relevant system boundaries and dependencies.
Map safeguards to implementation. For each of the 15 requirements, identify the controls, configurations, and procedures used to satisfy it.
Verify operation. Do not rely solely on policy statements or vendor claims. Examine configurations, interview personnel responsible, and test controls as appropriate.
Document results accurately. Maintain records that support the self-assessment requirements and identify any deficiencies. CMMC Level 1 does not permit a plan of action and milestones to substitute for meeting an unmet requirement.
Complete the applicable assessment and affirmation process. Follow current CMMC program rules and applicable contract instructions, including required reporting through the Supplier Performance Risk System (SPRS).
Final Thoughts from Gold Comet: FCI Protection Is an Ongoing Responsibility
Understanding the 15 FCI safeguards is an important step toward CMMC Level 1 readiness, but a written checklist alone does not demonstrate that an organization has implemented the requirements.
Contractors must identify the systems handling FCI, configure and operate appropriate protections, assign responsibility, verify that controls work, and maintain accurate assessment records. These activities should be reviewed as systems, personnel, suppliers, and business processes change.
Gold Comet provides secure data storage, file-sharing, and messaging capabilities that can support an organization's broader FCI protection strategy. Combined with appropriate IT controls and a structured governance, risk, and compliance approach, secure data management can help you establish more consistent control over sensitive contract information.
Ready to strengthen your FCI protection strategy? Contact Gold Comet to discuss how secure data management and controlled collaboration can support your organization's cybersecurity objectives and CMMC Level 1 readiness efforts.
Disclaimer: This article is an educational resource, not legal advice or a certification determination. Applicability depends on contract terms, system scope, and current program requirements. Consult the authoritative FAR clause and official CMMC guidance when making compliance decisions.
Comments