Terms / What you protect

Federal Contract Information (FCI)

FCI is information a contract provides to you or generates for the Government that is not for public release. Holding only FCI means CMMC Level 1.

Also called FCI, Federal Contract Information.

Official Source Material

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments.

Source: 48 CFR 4.1901, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

Almost every Government contract gives you Federal Contract Information.

Federal Contract Information (FCI) is any information provided by or generated for the Government under a contract that is not meant for public release. The CMMC rule does not define it. 32 CFR 170.4 points to 48 CFR 4.1901, which is the definition this page quotes. Your statement of work, your delivery schedule, an email thread with the contracting officer about deliverable scope, and the drafts you send back are all FCI. Assume you hold it the day the contract is signed.

FCI alone puts you at CMMC Level 1, not Level 2.

Level 1 is the 15 requirements in FAR 52.204-21, the basic safeguarding clause. You check them yourself each year and affirm the result in SPRS, the Supplier Performance Risk System. Level 1 allows no POA&M, the plan that holds open items for 180 days. Meet all 15 before you affirm. Level 2 applies when the contract also involves Controlled Unclassified Information, the narrower category that a law or regulation requires you to safeguard. The solicitation states which level applies. Read it before you buy anything for Level 2.

The two exclusions are narrower than they look.

The definition leaves out information the Government has released to the public and simple transactional information, such as an invoice number or a bank routing number. A change order discussion, a kickoff schedule, and a draft deliverable are none of those things, so they are FCI. If you cannot point to where the Government published it, treat it as FCI.

What falls short

A statement that you hold no FCI because nothing arrived with a marking. FCI carries no marking. The definition turns on whether the Government released the information to the public, not on a banner.
A Level 1 self-assessment that covers only the server room. FCI lives in mailboxes and shared drives, and every asset that processes, stores, or transmits it is in scope.
A personal email account or phone used for contract correspondence and left out of the assessment. That mailbox holds FCI and is in scope.

Edge cases

A prime contractor asks you for a Level 2 assessment when it only sends you FCI. Under 32 CFR Part 170, section 170.23, a subcontractor that will only process, store, or transmit FCI needs a CMMC Status of Level 1 (Self). Ask the prime in writing what it will share and which level the subcontract states.
The Government publishes a document it sent you earlier. It stops being FCI once released, but the mailbox and drive that held it are still part of the system you assess.
Your only Government work is selling commercial off-the-shelf items with no changes. Under 32 CFR 170.3 the CMMC Program requirements do not apply to a contract exclusively for those items. A contract that adds any service or customization is no longer exclusively for them.

Over-engineering

A Level 2 build for a shop that only holds FCI. Level 1 is the 15 requirements in FAR 52.204-21 and a yearly self-assessment you affirm in SPRS, the Supplier Performance Risk System.
A separate enclave for FCI, meaning a walled-off network that holds only the Government work. Nothing requires you to keep FCI apart from the rest of your business. Your ordinary systems, with the 15 Level 1 requirements applied, are the expected answer.
Marking and labeling FCI. No rule asks you to mark it. Knowing which systems hold it is enough.

Connects to

FAR 52.204-21 The clause holding the 15 basic safeguarding requirements for Federal Contract Information. It is the whole of CMMC Level 1. The contract
Plan of Action and Milestones (POA&M) A POA&M lists the CMMC requirements you have not met, who fixes each one, and by when. It buys a Conditional status and 180 days, not a pass. Assessment
Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
Prime contractor The company holding the contract directly with the Government. It owns the CMMC obligation for the whole supply chain beneath it. The contract
32 CFR Part 170 The regulation that creates the CMMC Program: the levels, the assessment types, the scoping rules, and the affirmation you sign each year. The contract

Referenced by

DFARS 252.204-7012 The contract clause that put NIST SP 800-171 on your systems and requires you to report a cyber incident to DoD within 72 hours. The contract
DFARS 252.204-7019 The solicitation provision that makes a current NIST SP 800-171 score in SPRS a condition of being considered for award. The contract
DFARS 252.204-7021 The contract clause that requires a current CMMC status at the level the contract names, an annual affirmation, and flow-down to subcontracts. The contract
FAR 52.204-21 The clause holding the 15 basic safeguarding requirements for Federal Contract Information. It is the whole of CMMC Level 1. The contract
Flow-down Passing a contract requirement to your suppliers. Under 32 CFR 170.23 the CMMC level you flow down depends on what each supplier will handle. The contract
Prime contractor The company holding the contract directly with the Government. It owns the CMMC obligation for the whole supply chain beneath it. The contract
Subcontractor Any company furnishing supplies or services under a prime contract. CMMC reaches every tier that handles FCI or CUI, not just the first. The contract
Controlled Unclassified Information (CUI) CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2. What you protect
Enclave A separated environment built to hold the controlled work and nothing else. It is the usual way a small company keeps its assessment small. Scope and assets
Self-assessment An assessment you conduct on your own system. It carries the same requirements as a certification assessment and the same legal weight. Assessment
CMMC The Cybersecurity Maturity Model Certification. It is the program that verifies a defense contractor meets the security requirements already in its contract. Certification
Level 1 The 15 basic safeguarding requirements for FCI, assessed by you every year. No plan of action is permitted at Level 1, ever. Certification
AC.L2-3.1.20 External Connections Access Control (AC)
AC.L2-3.1.22 Control Public Information Access Control (AC)
MP.L2-3.8.3 Media Disposal Media Protection (MP)
SC.L2-3.13.1 Boundary Protection System and Communications Protection (SC)