# Account requirements for small federal contractors

FAR 52.204-21 requires limiting access to authorized users and verifying each one. Defense work with CUI adds NIST SP 800-171 Rev. 2, including MFA.

Updated: October 16, 2026

A small company that sells to the federal government meets account rules at two levels. FAR clause 52.204-21 applies to systems that hold federal contract information. It requires you to limit access to authorized users and to identify and verify each one before letting them in. If you work with controlled unclassified information (CUI) on a defense contract, NIST SP 800-171 Revision 2 applies on top. Its access control and identification families add least privilege, multi-factor authentication (MFA) and rules for inactive accounts and passwords.

## Which rules apply to you

Federal contract information (FCI) is information not intended for public release that is provided by or generated for the government under a contract. FAR 52.204-21 defines it to exclude information the government publishes and simple transactional information, such as payment data. A covered contractor information system is any system you own or operate that processes, stores or sends FCI.

For defense contracts, two more layers can apply. DFARS 252.204-7012 requires systems with covered defense information to meet the SP 800-171 requirements in effect when the solicitation is issued, or as the contracting officer authorizes. The Cybersecurity Maturity Model Certification (CMMC) program, in 32 CFR Part 170, is a framework for assessing whether contractors meet these protections. Under 32 CFR 170.14:

- CMMC Level 1 uses the 15 requirements of FAR 52.204-21(b)(1)(i) through (xv).
- CMMC Level 2 is identical to NIST SP 800-171 Revision 2.
- CMMC Level 3 adds selected requirements from NIST SP 800-172.

32 CFR 170.2 incorporates SP 800-171 Revision 2, dated February 2020 and updated January 28, 2021. CMMC Level 2 assessments use Revision 2, so the requirement numbers below come from Revision 2. DFARS 252.204-7021 then requires a contractor to hold the CMMC status the contract specifies for every system that handles FCI or CUI. Contractors must also affirm continued compliance each year in the Supplier Performance Risk System (SPRS).

## What FAR 52.204-21 asks of accounts

Five of the clause's 15 basic requirements are about access:

- (b)(1)(i) Limit system access to authorized users, processes acting for them, or devices.
- (b)(1)(ii) Limit access to the types of transactions and functions authorized users are allowed to do.
- (b)(1)(iii) Verify and control or limit connections to and use of external systems.
- (b)(1)(v) Identify system users, processes acting for them, or devices.
- (b)(1)(vi) Authenticate, or verify, the identities of those users, processes or devices before allowing access.

The clause doesn't mention MFA or password rules. Paragraph (c) requires you to put the substance of the clause into subcontracts where the subcontractor may have FCI in its systems, except for commercially available off-the-shelf items.

## What NIST SP 800-171 Rev. 2 adds for CUI

Families 3.1 (Access Control) and 3.5 (Identification and Authentication) hold most of the account rules. Two requirements from other families matter as well.

| Requirement | What it asks |
| --- | --- |
| 3.1.1 | Limit access to authorized users, processes acting for them and devices |
| 3.1.2 | Limit access to the transactions and functions each user is permitted |
| 3.1.5 | Least privilege, including for privileged accounts |
| 3.1.6 | Use non-privileged accounts for non-security work |
| 3.1.7 | Keep non-privileged users from privileged functions, and log those functions |
| 3.1.8 | Limit unsuccessful sign-in attempts |
| 3.1.11 | End a user's session automatically after a defined condition |
| 3.3.2 | Make each user's actions uniquely traceable to that user |
| 3.5.1 and 3.5.2 | Identify users and verify their identity before access |
| 3.5.3 | MFA for local and network access to privileged accounts, and for network access to non-privileged accounts |
| 3.5.5 and 3.5.6 | Don't reuse identifiers for a set period, and disable them after a set period of inactivity |
| 3.5.7, 3.5.8 and 3.5.10 | Minimum password complexity, no reuse for a set number of generations, and passwords stored and sent only in protected form |
| 3.9.2 | Protect systems with CUI during and after terminations and transfers |

Requirement 3.5.3 reaches past admin accounts. SP 800-171 defines network access as access through a network, the internet included. So an ordinary account that people sign in to over the internet needs a second factor too. A footnote adds that the requirement doesn't mean a government-style smart card, and that commercial products, from key fobs and smart cards to software, are available.

## Shared accounts under SP 800-171

The discussion under 3.5.1 says that managing individual identifiers doesn't apply to shared system accounts. It also says organizations may require unique identification of individuals in group accounts. Requirement 3.3.2 points the same way. Audit records should link each action to an individual where feasible, so people can be held accountable.

A shared login on a system in scope therefore needs some other record of who used it each time. Departures also need care under 3.9.2. In practice, if the person who leaves knew a shared password, protecting the system under 3.9.2 means changing it for everyone else.

## What to prepare before you bid

1. List every system and cloud app that holds FCI or CUI, including email and file sharing.
2. For each account, record who is authorized to use it and what it can do (FAR (b)(1)(i) and (ii); 3.1.1, 3.1.2).
3. Mark admin accounts and shared accounts. For shared ones, decide how you will trace each use to a person (3.3.2).
4. Turn on MFA for admin accounts and for every account people sign in to over a network, the internet included (3.5.3).
5. Write the steps for removing access when people leave or change roles, including shared passwords they knew (3.9.2).
6. Check that subcontracts carry the clause where the subcontractor will hold FCI (FAR 52.204-21(c)).

For removing access when a vendor or subcontract ends, see [Checklist for taking back access when a vendor contract ends](/guides/outsourcing-access/access-recovery-at-contract-end).


## Frequently asked questions

**Does FAR 52.204-21 apply to subcontractors?**

Yes, when a subcontractor may have federal contract information in its systems. Paragraph (c) requires the prime to put the substance of the clause in those subcontracts, except for commercially available off-the-shelf items.

**Which revision of NIST SP 800-171 does CMMC use?**

Revision 2. The CMMC rule, 32 CFR 170.2, incorporates SP 800-171 Revision 2, February 2020, updated January 28, 2021. Level 2 requirements are identical to it.

**Is MFA required for small contractors?**

FAR 52.204-21 asks you to verify each user but doesn't name MFA. For CUI, SP 800-171 Rev. 2 requirement 3.5.3 requires MFA for privileged accounts and for network access to all other accounts.

**Can we use shared accounts on systems with CUI?**

SP 800-171 doesn't ban them. Requirement 3.3.2 asks that each user's actions be uniquely traceable to that user, so a shared login needs another way to tie each use to a person.

## Sources

- [FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Nov 2021), Acquisition.gov](https://www.acquisition.gov/far/52.204-21)
- [32 CFR 170.2, Incorporation by reference (Cornell LII)](https://www.law.cornell.edu/cfr/text/32/170.2)
- [32 CFR 170.14, CMMC Model (Cornell LII)](https://www.law.cornell.edu/cfr/text/32/170.14)
- [NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (February 2020, updated January 28, 2021)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf)
- [DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (May 2024), Acquisition.gov](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.)
- [DFARS 252.204-7021, Contractor Compliance with the Cybersecurity Maturity Model Certification Level Requirements (Nov 2025), Acquisition.gov](https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-level-requirements.)

## How Junify handles this

**Doing this by hand** You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.

**With Junify** For cloud logins your team has to share, Junify supplies the person behind each use. An admin assigns who may use the account. People verify on their own phone and sign in without seeing the password, so Junify records who used which account and when, person by person. Change the password at setup so only Junify holds it. When someone leaves the contract, remove their access and they can't open the account through Junify again.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&from=guide&cluster=compliance&slug=federal-contractor-account-requirements)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [What access logs need to show when you decide whether to report a breach](/guides/compliance/breach-notification-access-logs): Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
- [Password sharing and the federal anti-hacking law (CFAA)](/guides/compliance/cfaa-password-sharing): The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
- [What CIS Controls 5 and 6 (v8.1) ask of your accounts](/guides/compliance/cis-controls-account-access-management): Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.