Cybersecurity Requirements
Federal contracts carry a layered set of cybersecurity obligations. Every contractor starts with a common baseline under the FAR, and additional requirements attach based on the agency, the data you handle, and the technical frameworks your contract incorporates. This hub organizes those federal layers so you can quickly identify what applies to your work — separate from state and local requirements, which are covered under State & Local Requirements.
Start Here: The Baseline You Already Owe
Before any FAR or DFARS clause applies, federal and state law already requires your business to secure data and report breaches — the FTC Act, all-50-state breach laws, and rules like GLBA and HIPAA. The contractor requirements build on top of that legal baseline. Make sure you meet it first.
Explore the Requirements
FAR Baseline
The 15 basic safeguarding requirements in FAR 52.204-21 that apply to any contractor system holding Federal Contract Information. Start here — it's the floor every federal vendor must meet.
OpenCybersecurity Frameworks
The technical playbooks federal clauses point to — NIST SP 800-171, NIST SP 800-53, the NIST CSF, CMMC, and FedRAMP. Use this when you need to understand what a clause actually requires you to implement.
OpenFederal Agency Requirements
Agency supplements that add their own cyber clauses on top of the FAR — DFARS for DoD, HHSAR for HHS, NFS for NASA, and others. Use this if you know which agency is buying your work.
OpenFederal Statutes
The underlying laws — FISMA, the CUI Executive Order, the FedRAMP Authorization Act, and the False Claims Act as applied to cyber — that give every clause its teeth. Useful when you need to trace a requirement back to its source.
OpenIndustry-Based Requirements
Sector-specific obligations that layer on top of the federal baseline — defense, healthcare, finance, critical infrastructure, and more. Use this when your industry carries its own regulated data or security standards.
OpenState & Local Requirements
State cybersecurity laws, breach notification requirements, and GovRAMP participation rules affecting government contractors. National compliance means meeting both federal and state obligations.
Open