I'm not a full-time sysadmin—more of a jack-of-all-trades in IT, working in desktop support and asset management. Recently, a freelance client asked for my help with self-certifying and writing a compliance letter for FAR 52.204-21, which covers the basic safeguarding of contractor information systems. They use Google Workspace, but I'm unsure about their system details. Is this a daunting task? Should I accept it or turn it down? They also want an estimate for costs and a timeline, but I'm completely in the dark on that.
3 Answers
FAR 52.204-21 is more about basic safeguarding, so it’s less intense compared to requirements like CMMC or NIST 800-171. Your goal here is mainly to ensure basic security elements like access control, MFA, patching, and malware protections are in place. The challenge is that you’d be attesting to the organization's compliance, so knowing their environment is crucial. Start with a small assessment to see what they have. If their system is simple and mostly cloud-based, it can be a manageable project. I'd advise offering a paid assessment first to familiarize yourself with their setup and then decide if you want to assist with the certification.
You'll need to tackle this in two main parts. First, get a list of requirements from FAR 52.204-21. Look through them and estimate how much time it will take to check each one off. Depending on your relationship with the client, you might consider including some costs in the remediation phase. Secondly, after conducting the audit, prepare to estimate the remediation work. A key focus will probably be implementing Multi-Factor Authentication (MFA). Just keep in mind that Google Workspace might not meet all standards perfectly, so you could need to consider migrating to O365 instead. Breaking it down this way will help clarify your estimates.
Thanks! I honestly think I might pass on it…
Before diving in, check if your client also needs to meet CMMC requirements. Google Cloud and Workspace have support for these compliance needs since they’re significant providers for the Department of Defense and Intelligence Community. However, just because they use Google doesn’t mean they are automatically compliant. I suggest looking over the FAR requirements thoroughly and considering professional assistance if this is your first time tackling such a certification. It’s a substantial responsibility, and getting it wrong could have serious consequences.
Thank you!
Thank you sir!