FAR 52.204-21 in the FAR overhaul: now 52.240-93 under the deviation, proposed 52.240-5

FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems. Renumbered: the deviation text carries it under a new number, as the deviation text and GSA table list it; confidence high. As at 27 Sep 2026.

Codified52.204-21eCFR, clause dated NOV 2021

Under the deviation52.240-93RFO model deviation text, FAR Part 52 (issued 28 Oct 2025, updated 1 Jul 2026)

Proposed permanent number52.240-591 FR 37550, 23 Jun 2026

Renum. means renumbered: the deviation text carries it under a new number.

Sources last checked 27 Sep 2026 (dataset version 1). What changed and when. An existing contract's clauses are not rewritten by a later deviation or proposed rule; they change only by modification.

What the source says changed

No official source in the set states what changed in the text; the number and title are as listed.

Why this disposition

GSA P&C Table row 52.240-93 (Basic Safeguarding of Covered Contractor Information Systems): note lists 52.204-21 under "Replaces"

Confidence: high. Read from an official table or the deviation or rule text itself.

Titles and where each is prescribed

codified: Basic Safeguarding of Covered Contractor Information Systems
under the deviation: Basic Safeguarding of Covered Contractor Information Systems
prescribed at 4.1903 (codified); 40.303-2 (deviation text)

The proposed rule's words: FR 2026-12559 Part 40 consolidation table: "52.240-5, Covered Federal Information" | 52.204-21, Basic Safeguarding of Covered Contractor Information Systems

Which agencies

DoD adopted the FAR Part 52 deviation text by class deviation 2026-O0038, effective 1 Feb 2026. GSA's provision and clause table lists this clause effective 3 Nov 2025. Confirm which deviation your contracting officer's agency has adopted.

The 33 agencies acquisition.gov lists as having issued a class deviation for FAR Part 40 (first issued August 14, 2025)

Consumer Financial Protection Bureau (CFPB); National Labor Relations Board (NLRB); Department of Energy DOE; National Science Foundation (NSF); Office of Personnel Management (OPM); Department of the Interior (DOI); Pension Benefit Guaranty Corporation (PBGC); Department of Defense (DoD); Housing and Urban Development (HUD); Department of Labor (DOL); Millennium Challenge Corporation (MCC); Department of Homeland Security (DHS); National Archives and Records Administration (NARA); United States Department of the Treasury; Environmental Protection Agency (EPA); Department of Education (ED); Merit Systems Protection Board (MSPB); Department of State (DOS); National Aeronautics and Space Administration (NASA); Udall Foundation (UDALL); Social Security Administration (SSA); Health and Human Services (HHS); Department of Justice (DOJ); Department of Transportation (DOT); Securities and Exchange Commission (SEC); Consumer Product Safety Commission (CPSC); Department of Veterans Affairs (VA); Nuclear Regulatory Commission (NRC); United States Department of Agriculture (USDA); Commodity Futures Trading Commission (CFTC); General Services Administration (GSA); Department of Commerce (DOC); Federal Communications Commission (FCC).

Subcontractors

Tracking which subcontractors have declared a current SPRS assessment for this clause: Subcontractor CMMC Tracker

What flows down

Under the deviation text: flows down under its own paragraph (c). The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products, other than commercially available off-the-shelf items, or commercial services), in which the subcontractor may have Federal contract information residing in or transiting through its information system.
Commercial products and services: included. COTS items: excluded. What goes down: the substance of the clause. FAR Overhaul - Part 52, Solicitation Provisions and Contract Clauses (RFO model deviation text) issued 28 Oct 2025, updated 1 Jul 2026
Codified text (eCFR): flows down under its own paragraph (c). The Contractor shall include the substance of this clause, including this paragraph (c), in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the subcontractor may have Federal contract information residing in or transiting through its information system.
Commercial products and services: included. COTS items: excluded. What goes down: the substance of the clause. 48 CFR part 52 (codified FAR clauses) current to 24 Sep 2026 (issue 18 Sep 2026)
Named for flow-down in 52.244-6(b)(1): other than subcontracts for commercially available off-the-shelf items, if flow down is required in accordance with paragraph (c) of FAR clause 52.204-21. It is not in the deviation's 52.244-6(b)(2) table. 48 CFR 52.244-6 current to 24 Sep 2026

Sources, with their dates

48 CFR part 52 (codified FAR clauses) current to 24 Sep 2026 (issue 18 Sep 2026), clause dated NOV 2021
FAR Overhaul - Part 52, Solicitation Provisions and Contract Clauses (RFO model deviation text) issued 28 Oct 2025, updated 1 Jul 2026
GSA RFO Part 52 Provision and Clause Table 1 Apr 2026, disposition "Removed"
DoD RFO class deviation file: 2026-O0038_TAB_A_Deviation_Memo_Part_52.pdf 20 January 2026, effective 1 Feb 2026
Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul Parts 1, 2, 4, 33, 39, 40, and 53 23 Jun 2026, 91 FR 37550, FAR Case 2026-001

Questions

What is FAR 52.204-21 called after the FAR overhaul?

FAR 52.204-21 in the FAR overhaul: now 52.240-93 under the deviation, proposed 52.240-5. The codified number is 52.204-21; the deviation text lists 52.240-93; the proposed rule 91 FR 37550 lists 52.240-5. As at 27 Sep 2026.

Which number does a contract carry for FAR 52.204-21 after the FAR overhaul?

Which number a given contract carries depends on the deviation the contracting agency has adopted and the date of the solicitation or modification. DoD adopted the FAR Part 52 deviation text effective 1 Feb 2026. Confirm which deviation your contracting officer's agency has adopted.

Is the change to FAR 52.204-21 final?

No final FAR overhaul rule had been published in the Federal Register as at 27 Sep 2026. The proposed rule 91 FR 37550 lists 52.240-5.

Read your whole list: run 52.204-21 in the finder, or paste every clause of a contract, flow-down exhibit or template on the landing page. As at 27 Sep 2026.