Safeguarding requirements pass from the government to the prime, from the prime to you, and from you to anyone you subcontract. If you handle non-public information to perform the work, the 15 requirements in FAR 52.204-21 apply — regardless of how many tiers up the award sits.
FCI is the ordinary, non-public material the government or a prime hands you so you can perform the contract. It is not classified and it is not exotic. For aircraft parts suppliers, it usually looks like this:
A tier-one supplier sends a flow-down packet and asks you to confirm your status in writing before the next release. That is the moment this stops being theoretical.
Three requirements this trade tends to miss — not because the work is hard, but because nobody was ever asked to write it down.
The assessment scores all 17 assessable practices, not just these three. These are simply the ones that come up most often.
All 15 requirements in plain English, with a column for what counts as evidence for each one. Most people fill it out in about twenty minutes and know exactly where they stand. No call, no obligation — it is a one-page PDF.
The checklist tells you what the requirements are. This tells you which onesyou miss. Twelve questions, written for a business owner rather than an auditor, and a gap report that puts the fixes in order — quick wins first. Nothing is stored until you ask for the report.
Do you hold or bid on DoD contracts or subcontracts?
Same assessment, written for a different shop floor.