What Is FCI (Federal Contract Information)?

FCI is the broadest category of protected information in federal contracting. It covers non-public information exchanged in the course of performing a government contract: statements of work, delivery schedules, performance reports, technical correspondence, and similar material. Two things are carved out: information the government has released publicly, and basic transactional information such as what is needed to process payments.

Nearly every company with a federal contract handles FCI, which is why the safeguarding floor is set low and applied widely. FAR 52.204-21 imposes 15 basic requirements, including limiting system access to authorized users, sanitizing media before disposal, and applying security patches. Under CMMC these 15 requirements form Level 1, verified through an annual self-assessment with results entered in SPRS and affirmed by the company's Affirming Official.

The practical implication is that a contractor cannot opt out of cybersecurity obligations by avoiding CUI. If a company touches only FCI, its burden is lighter, but it still must assess itself honestly and affirm compliance, and a false affirmation carries legal exposure. Companies unsure whether they hold FCI, CUI, or both should map their contract data flows first, since that determination drives everything downstream. Our defense and government practice covers how to make that call, and NIST 800-171 vs CMMC explains where the levels diverge.