Blog Layout

FAR Subpart 4.19 Basic Safeguarding Clause – What to Know

gov IRG • April 9, 2017

Effective June 15, 2016, the DoD, GSA, and NASA issued a final rule “amending the Federal Acquisition Regulation (FAR) to add a new subpart and contract clause for the basic safeguarding of contractor information systems that process, store or transmit Federal contract information.” (Federalregister.gov).

The new subpart FAR 4.19, Basic Safeguarding of Covered Contractor Information Systems, includes contract clause 52.204-21.  The rule is mandatory, and effective immediately upon contract award or contract modification execution.

Law.Cornell.edu notes that the clause, “Does not relieve the Contractor of any other specific safeguarding requirements specified by Federal agencies and departments relating to covered contractor information systems generally or other Federal safeguarding requirements for controlled unclassified information (CUI)”.

The clause states that contractors must perform basic protection requirements to ensure data integrity and confidentiality, and identifies  15 security measures for safeguarding a covered contractor information system:

(i) Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

(ii) Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

(iii) Verify and control/limit connections to and use of external information systems.

(iv) Control information posted or processed on publicly accessible information systems.

(v) Identify information system users, processes acting on behalf of users, or devices.

(vi) Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.

(vii) Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.

(viii) Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.

(ix) Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

(x) Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.

(xi) Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

(xii) Identify, report, and correct information and information system flaws in a timely manner.

(xiii) Provide protection from malicious code at appropriate locations within organizational information systems.

(xiv) Update malicious code protection mechanisms when new releases are available.

(xv) Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

Arrowhead encourages government contract holders to read your contracts thoroughly when evaluating your compliance posture with 52.204-21.  In doing so, it is helpful to understand the differences between relevant National Institute of Standards and Technology publications NIST 800-53 and NIST 800-171.

NIST 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, is the older of the two publications that discusses the security of  federal  information systems.  Unless you are a contractor operating a federal information system on behalf of the government, it probably does not apply to you. To be certain, check to see if 800-53 compliance is included into your contract clauses.

NIST 800-171, Protecting Uncontrolled Classified Information in Nonfederal Information Systems and Organizations, is used when CUI is resident in  non-federal  information systems and organizations.  The NIST 800-171 publication condenses some of the 800-53 compliance points and is intended for use by federal agencies with recommended standards for protecting the confidentiality   of Controlled Unclassified Information.  The requirements apply only to components of nonfederal information systems that process, store, or transmit CUI, or provide security protection for those components when the information systems where the CUI resides are  not  operated by organizations on behalf of the federal government. (Source: NCMA).

Contractors must implement security requirements in NIST 800-171 no later than December 31, 2017.

Further, contractors must include a paragraph referencing the clause in their subcontracts where the sub may have Federal contract information “residing in” or “transiting through its information system.”

For more information on this topic, call Arrowhead Solutions to see how we can help you with your government contract compliance needs.

November 5, 2024
The Single Audit threshold for organizations that receive Federal awards has been increased from $750,000 to $1 million, effective for fiscal periods starting on or after October 1, 2024. This adjustment is designed to streamline audit requirements and is intended to allow federal oversight resources to focus on larger awards. Here is a look at what this change means for organizations and how to prepare. What Is a Single Audit? A Single Audit is an audit of a non-federal entity’s financial statements and federal award expenditures, conducted to ensure that federal funds are used in compliance with relevant laws and regulations. Single Audits must adhere to Generally Accepted Auditing Standards (GAAS), Generally Accepted Government Auditing Standards (GAGAS) issued by the Comptroller General of the United States, and the Uniform Guidance. These audits assess compliance with federal award conditions and verify that organizations follow applicable financial and regulatory requirements. The Uniform Guidance, outlined in Title 2 of the Code of Federal Regulations, Part 200, establishes the standards for recipients of federal funds. It includes rules on cost principles, administrative requirements, and audit obligations to promote consistency in the management of federal awards. The New $1 Million Threshold – WHAT DOES THIS MEAN FOR BUSINESSES? Starting in fiscal years beginning on or after October 1, 2024, only organizations with federal expenditures of $1 million or more in a single fiscal year will be required to undergo a Single Audit. This threshold increase is intended to lessen the audit burden for entities with smaller awards and allocate audit resources toward higher-dollar programs. This change may benefit various organizations, including universities, non-profits, healthcare providers, and smaller government entities, that receive federal funding but typically fall below the $1 million expenditure mark. Key Points to Consider 1. Reduced Audit Burden : Organizations with federal awards under $1 million will no longer need to undergo a Single Audit, which may reduce administrative expenses and allow staff to focus more on their core programs. 2. Focused Oversight : With a higher threshold, federal audit efforts can concentrate on larger awards, where potential compliance risks may be greater. 3. Compliance Responsibility : Even if a Single Audit is not required, entities must still comply with federal requirements for award expenditures and conditions. Internal audits and controls remain essential for ensuring compliance.  4. Preparing for the Change : Organizations with federal expenditures that may vary across fiscal years should monitor their spending closely to determine when a Single Audit is needed. Resources for Navigating Single Audit Requirements While the threshold has increased, maintaining compliance with federal standards remains critical. The following resources provide additional information on Single Audits and compliance under Uniform Guidance: - Council on Governmental Relations (COGR): 2024 Uniform Guidance Readiness www.cogr.edu/sites/default/files/UG%20Readiness%202024_5th%20Look_Final%20Draft_9.17.24.pdf - U.S. Department of Health & Human Services: Office of Inspector General - Single Audit FAQs oig.hhs.gov/compliance/single-audits/frequently-asked-questions-faqs/single-audits-faqs/ The increase in the Single Audit threshold is likely to reduce administrative demands for many organizations. However, maintaining sound internal controls for managing and reporting federal funds remains essential. Preparing now for these changes will help organizations transition smoothly and stay compliant with federal requirements. Consulting with audit professionals or compliance advisors is recommended to ensure internal processes align with the latest federal guidelines. About govIRG govIRG is the government contract specialist with deep expertise across CFO Services, Contracts Management, Accounting, Accounting System Implementations, and Human Resources. Our mission is to provide government contractors with peace of mind by simplifying compliance and increasing business value. With a dedicated team focused on the unique needs of government contractors, govIRG delivers tailored solutions that streamline processes, ensure regulatory compliance, and foster business growth. We are the audit professionals you need. If you have any questions, please contact us.
By Chuck Anderson and Associates at govIRG October 4, 2024
Government contractors with cost-reimbursable contracts are required to submit provisional billing rates (PBRs) annually. While this may seem like a tedious compliance requirement, it’s actually an exercise that all companies should perform in some form. The insights gained not only help with billing on cost-reimbursable contracts but also offer a deeper understanding of a company’s finances. Developing PBRs is essentially a budgeting exercise that provides indirect rates representing the company’s break-even point. These rates are then used for invoicing on cost-reimbursable contracts in the following year. There are various ways to determine these rates, but the key requirement is that the process be well-documented and the data organized in a clear, intuitive format. Before starting the budgeting process, it’s crucial to ensure your Chart of Accounts (COA) is structured to categorize costs by “objective.” Typically, this structure will divide your COA into sections for recording costs such as Direct, Fringe, Overhead, G&A, and Unallowable. With this setup, you can easily identify and present the necessary details for calculating and submitting your PBRs. The budgeting process itself will vary based on the size, structure, and complexity of your business. The goal is to balance the time and cost of developing the budget with the accuracy of the results. govIRG can help you find the “sweet spot” to deliver an accurate forecast with the right level of effort. Our team can support this process at whatever level is appropriate for your company. Whether you need simple calculations and presentation or a deep dive into the details, we have the expertise to help you efficiently and accurately prepare your annual PBR.  Government contractors operate in a world where compliance is key. While developing PBRs may seem like a compliance obstacle, it’s actually a great opportunity to improve your company’s management. govIRG’s comprehensive approach to compliance management helps contractors avoid cash flow issues, stay compliant with government regulations, and ultimately increase the value of their business.
By Kevin Hoskins August 23, 2024
SBIR , or Small Business Innovation Research , and STTR , or Small Business Technology Transfer , are government-funded programs designed to engage small businesses in research and development efforts across the United States. These programs aim to boost the commercialization of federally funded research, enhance national investment, and foster technological innovation. The difference between SBIR and STTR The SBIR program is a three-phase award system that offers qualified small businesses the opportunity to propose innovative solutions that address the federal government’s specific research and development needs. The three phases are as follows: Phase I focuses on creating a proof of concept for the innovation; Phase II involves continuing research and development efforts; and Phase III is dedicated to pursuing commercialization in the private sector. STTR is intended to promote technology transfer by facilitating cooperative research and development between small businesses and research institutions. The key distinction from SBIR is that STTR requires the small business to formally partner with a research institution. At the time you apply for a SBIR you might also be eligible for “TABA (Technical and Business Assistance)” funds that is in addition to the SBIR funding to help you with your IP (Intellectual Property), Accounting System setup, and other things. You might also be eligible for R&D (Research & Development) Credits when you win an SBIR. GovIRG is committed to helping businesses thrive by simplifying compliance and increasing their business value. Our goal is to help businesses understand the available options and resources that can set them on the path to success. Some of this article references information found from SBIR.gov and U.S. Department of Education.
More Posts
Share by: