Adequate security means protective measures commensurate with the consequences and probability of loss, misuse, or unauthorized access to or modification of information. “The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections” as outlined in CFR 252.204–7012.
Source: CFR 252.204–7012 Safeguarding covered defense information and cyber incident reporting.