What is Federal Contract Information (FCI)?

What counts as FCI

FAR 52.204-21 defines FCI as information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service to the government. Two things are excluded: information the government provides to the public, such as on public websites, and simple transactional information, such as what is needed to process payments.

That makes FCI a wide category. Contract documents, statements of work, delivery schedules, correspondence with the contracting officer and internal records about the work can all be FCI. Almost any company with a Department of Defense contract handles some.

How FCI relates to CUI

Controlled Unclassified Information is a narrower set that also needs protection under a specific law, regulation or policy. Contract information that falls in a CUI category is CUI, and the stricter rules apply to it.

The difference decides the CMMC level: FCI alone means Level 1, and any CUI means Level 2 or above. Settle which you hold before scoping anything else.

• FCI only. CMMC Level 1: 15 requirements and an annual self-assessment.
• CUI. CMMC Level 2: the 110 requirements of NIST SP 800-171, with a C3PAO assessment for most contracts.
• CUI on the most sensitive programmes. CMMC Level 3: Level 2 plus requirements from NIST SP 800-172.

What Level 1 asks for

The 15 requirements are basic hygiene: limiting system access to authorised users, identifying and authenticating them, sanitising media before disposal, controlling physical access and escorting visitors, separating publicly accessible systems from internal networks, fixing flaws promptly and running up-to-date malware protection.

Each year the contractor assesses itself against all 15, enters the result in the Supplier Performance Risk System (SPRS), and a senior official affirms that it is accurate. All 15 must be met. A Plan of Action and Milestones is not allowed at Level 1.

The affirmation is a statement to the government, so an inaccurate one carries legal risk. Keep the evidence that supports each requirement.

Related terms

Controlled Unclassified Information (CUI)

US government information that is not classified but must be protected under law or policy. Handling CUI brings a defence contractor under CMMC Level 2.

NIST SP 800-171

The US standard of 110 security requirements for protecting Controlled Unclassified Information in non-federal systems, and the control set behind CMMC Level 2.

Plan of Action and Milestones (POA&M)

The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.

C3PAO

A CMMC Third-Party Assessment Organisation: a company authorised by the Cyber AB to carry out CMMC Level 2 certification assessments for US defence contractors.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.