Does my contract include FAR 52.204-21? How to tell if CMMC Level 1 applies
KB-062 | Applies to: All plans | Last reviewed: October 27, 2026 | Version 1.0
Finding the clause in your contracts and purchase orders, and knowing what counts as contract information
KB-062 | Applies to: All plans | Last reviewed: October 27, 2026
CMMC Level 1 is built on the 15 safeguarding requirements in FAR 52.204-21. If that clause is in your contract or purchase order, and your company handles contract information on its computers, the requirements apply. This guide shows you where to look.
Step 1: Search your contracts and purchase orders
Open your current defense contracts, subcontracts, and purchase orders, and search each one for these phrases:
- 52.204-21, or its title, Basic Safeguarding of Covered Contractor Information Systems.
- 252.204-7021, the DFARS clause that states which CMMC level a contract requires.
Clauses are often listed by number only, in a table or a long list near the end of the document. That still counts.
Step 2: Check your customer's flowdown terms
If you're a subcontractor, your purchase order may say it includes your customer's standard terms "by reference" instead of listing every clause. Ask your buyer for their supplier terms and conditions or flowdown clause list, or look for it on their supplier website, and search that document too. FAR 52.204-21 is passed down to subcontractors who may have contract information on their systems, unless the subcontract is only for commercially available off-the-shelf items.
Step 3: Check whether you handle contract information
Federal Contract Information (FCI) is information that is not meant for public release and that the government provides, or that is created for the government, under a contract. It doesn't include information the government has made public, or simple transactional information such as what's needed to process payments.
For most shops, FCI looks like drawings, specs, statements of work, purchase orders, quantities, and delivery schedules for a defense job. If any of that is emailed to you, saved on your computers, or loaded on your machines, you handle FCI.
What you might find
- The clause is there and you handle FCI. CMMC Level 1 applies. Start with the Readiness Check, then the Scoping Worksheet in the folder kit (see KB-040).
- Your contract states CMMC Level 2, or your drawings are marked CUI. That is a different, larger set of requirements. AffirmReady covers Level 1 only. See KB-003.
- You can't find the clause, or you aren't sure. Ask your contracting officer or your customer's buyer which clauses and which CMMC level apply. Their answer is the one that counts.
Keep a copy of what you found, such as the contract page or the buyer's email, in the 0 Start Here folder of your evidence folder kit, and note it on your Scoping Worksheet.
Still need help?
Email support@affirmready.com and include your company name and the email address on your AffirmReady account. Our team is available Monday through Friday, 8:00 AM to 5:00 PM Eastern, and replies within one business day. We can explain the clauses in general, but we can't tell you what your contract requires.
For CMMC Level 1 readiness purposes only. Not legal advice. Your company is responsible for the accuracy of its self-assessment and affirmation.