FAR Clause 52.204-21 Basic Safeguarding of Covered Contractor Information Systems.
Effective June 15, 2016, all contracts awarded by any U.S. federal agency, including DoD, must include Federal Acquisition Regulation (FAR) Clause 52.204-21, which requires immediate implementation of 15 controls, which equate to 17 NIST SP 800-171 controls for basic safeguarding of any internal systems with non-public “federal contract information” or FCI.