Part Three: FAR Ruling 52.204-21 Definitions

By Eric Noonan • July 19, 2016

This is part three of a continuing series on the Federal Acquisition Register ruling 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.  If you haven’t read part one or part two,  please take a few minutes to read it before continuing.

The recent FAR ruling, released with input from the General Services Administration (GSA) and the National Aeronautics and Space Administration (NASA), have expanded on definitions that affect contractor organizations that process or store Federal contract information on behalf of the federal government in support of government contracts.  This post with explore the definitions in an attempt to bring a little clarity to the vague terms that apply to these systems.

Covered contractor information system:  This is an umbrella term covering unclassified information systems that are owned or operated by a contractor.   A covered contractor information system can apply to a single system, or multiple systems networked together.  File servers, data backup systems, desktop, and mobile endpoints can be considered a covered contractor information system if it processes, stores or transmits Federal contract information.

Federal contract information: This means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. This does not include information provided by the Government to the public (such as that on public web sites) or simple transactional information, such as that necessary to process payments.

Information system: This term as defined by FAR clause 52.204-21, is a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.  The traditional definition of an information system is any organized system for the collection, organization, processing, storage, and communication of information.  Organizations and people use information systems to collect, filter, process, create and distribute data often times using networked computers.  A typical information system is made up of hardware, software, data, policies and procedures, people, and feedback.

Information: Traditionally, information is defined as facts provided about something or someone or something that is conveyed or represented by a particular arrangement.  In the context defined by FAR clause 52.204-21, this term means any communication or representation of knowledge such as facts, data or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.  It is important to note that any medium is covered under this definition, so the focus will not just be electronic systems, but also safeguarding digital and non-digital media.

Whether your organization is just learning about the new FAR ruling for the first time, or you are updating your security controls to be compliant, CyberSheath can help you.  Don’t wait to begin your path to compliance.

Cybersheath Blog

3 Reasons Why You Need a Privileged Access Risk Assessment

A privileged account is one used by administrators to log in to servers, networks, firewalls, databases, applications, cloud services and other systems used by your organization. These accounts give enhanced permissions that allow the privileged user to access sensitive data or modify key system functions, among other things. You can…

Incident Response – Learning the Lesson of Lessons Learned

“Those who do not learn from history are condemned to repeat it.” Over the years, variations of this famous quote have been spoken by everyone from philosophers to world leaders. The message — that we must learn from our mistakes or continue to repeat them — is also highly relevant…

What is DFARS 252.204-7012 and NIST SP 800-171?

With the Department of Defense (DoD) promising the release of an update to NIST Special Publication 800-171, it is imperative defense contractors understand what DFARS 252.204-7012 and NIST SP 800-171 Clause is and how noncompliance with the Clause will impact their business.  Compliance is mandatory for contractors doing business with…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Trace Security