Federal Contract Information, usually shortened to FCI, is any nonpublic information the government gives you, or that you create for the government, while performing a contract to develop or deliver a product or service. The definition sits in FAR 52.204-21, and holding this kind of data obligates the contractor to put 15 baseline security controls in place on any system that stores, processes, or transmits it.1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems For Department of Defense work, that same 15-control baseline is now the foundation of CMMC Level 1, so identifying FCI correctly has direct consequences for contract eligibility.
The Two-Part Test in FAR 52.204-21
FAR 52.204-21 defines FCI as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government.”1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems Two conditions have to be true at the same time. The information was never cleared for public release, and it exists because of a government contract for a product or service. If either half fails, it isn’t FCI.
The clause carves out two categories on its face. Anything the government has already made public, such as data posted on an agency website, falls outside the definition. So do simple transactional records like invoices and payment-processing data, because those support routine business operations rather than the delivery of a product or service.1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems The carve-outs matter because they keep contractors from having to wrap security controls around every routine piece of paperwork a contract generates.
What Counts as FCI
FCI moves in two directions. One direction is information the government hands you so you can do the work: technical requirements, project parameters, internal agency contacts, background data needed to build a deliverable. The other is information you generate for the government during performance: progress reports, draft deliverables, design documents, status updates.2CUI Program Blog. FCI and CUI, What Is the Difference? Both directions carry the same safeguarding obligations.
In day-to-day practice, the data that most often qualifies includes contract performance reports, organizational charts listing personnel assigned to a federal project, emails between agency officials and contractor staff about deliverables, internal project schedules, meeting minutes from sessions with government representatives, and unreleased technical specifications or design documents. None of this needs to be classified or carry a security marking. Its origin and its purpose are what put it in scope.
What Does Not Count as FCI
Public-domain information is the clearest exclusion. If an agency has already published data on its website or released it through a public records process, applying FCI controls to your copy of that same data adds nothing. The definition exists to protect nonpublic information.
Routine payment data is the other explicit exclusion. Standard invoices, electronic funds transfer banking details, and similar records that exist only to get the contractor paid don’t trigger the safeguarding requirements.1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems The logic is that these records support accounting, not the development or delivery of a product or service.
How FCI Differs From Controlled Unclassified Information
The confusion between FCI and Controlled Unclassified Information (CUI) trips up contractors constantly, and getting it wrong means either over-investing in controls you don’t need or missing requirements you do. The short version: all CUI held by a government contractor is also FCI, but not all FCI rises to the level of CUI.3DCSA. CUI Frequently Asked Questions
FCI is the broader bucket, covering any nonpublic information exchanged under a contract to deliver a product or service. CUI is a subset made up of specific categories of sensitive information designated by law, regulation, or government-wide policy: export-controlled technical data, privacy-protected records, law enforcement sensitive information, and similar categories. CUI documents also carry formal marking requirements, with the “CUI” designation appearing at minimum in the banner and footer.3DCSA. CUI Frequently Asked Questions FCI that isn’t also CUI has no equivalent marking rule.
The security bar is very different too. FCI requires the 15 basic controls in FAR 52.204-21. CUI requires all 110 controls in NIST Special Publication 800-171, a much more demanding framework. If a contract involves only FCI, Level 1 compliance is enough. Once CUI enters the picture, the contractor is looking at Level 2 under CMMC, which often calls for a third-party assessment rather than a self-assessment.
Which Contracts Trigger the Safeguarding Rules
The rules apply broadly. FAR 4.1902 states that the basic safeguarding subpart applies to all acquisitions, including commercial products and commercial services, whenever a contractor’s information system may contain FCI.4eCFR. 48 CFR 4.1902 – Applicability There is no dollar threshold. A small commercial services contract triggers the same baseline as a large systems-integration deal, as long as FCI will live on or move through the contractor’s systems.
The main exception is commercially available off-the-shelf items. Contracts for products sold off the shelf without modification sit outside the clause, because a COTS vendor isn’t receiving or generating nonpublic government information while selling a standard product.1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
The clause targets what it calls “covered contractor information systems,” meaning systems owned or operated by the contractor that process, store, or transmit FCI.1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems Government-owned systems are already covered by federal information security standards. The clause is aimed at the gap: your infrastructure, where government data may sit outside the government’s direct control.
The 15 Basic Safeguarding Controls
FAR 52.204-21 spells out 15 minimum security controls that every covered contractor must implement. These are contract terms, not suggestions, and a contracting officer can verify compliance. They fall into a few natural groups.1Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
Access controls make up the largest cluster. Restrict system access to authorized users, processes acting on their behalf, and authorized devices. Limit what those users can actually do to the transactions and functions they need. Control and limit connections to outside systems. Control what gets posted or processed on any publicly accessible system. Identify every user, process, or device before granting access, and verify those identities as a prerequisite to entry.
Physical security covers the tangible side. Restrict physical access to systems, equipment, and operating environments to authorized individuals. Escort visitors, monitor their activity, keep physical access logs, and manage keys and badges. Sanitize or destroy any media containing FCI before disposing of equipment or releasing it for reuse.
Network and communications protections address the digital perimeter. Monitor, control, and protect communications at external and key internal boundaries. Separate publicly accessible components from internal networks, either physically or logically.
System maintenance and malware defense round out the list. Identify, report, and fix system flaws promptly. Deploy antivirus and anti-malware tools at appropriate points. Keep those protections current whenever new releases come out. Run periodic system scans and real-time scans of files from external sources as they’re downloaded, opened, or executed.
If you’ve worked in IT, none of this will shock you. These are baseline hygiene practices. What matters is that they’re written into the contract clause, so missing even one is a compliance gap, not just a shortfall against best practice.
Flow-Down to Subcontractors
Prime contractors cannot push the obligation away by subcontracting the work. FAR 52.204-21(c) requires primes to include the substance of the entire safeguarding clause in any subcontract where the subcontractor may have FCI on or passing through its information systems.5eCFR. 48 CFR 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems This applies even to subcontracts for commercial products and services. The COTS carve-out is again the only exception.
Every tier of the supply chain that handles FCI has to meet the same 15 controls. A prime that fails to include the clause in its subcontracts has a compliance problem of its own, separate from whatever the subcontractor does or doesn’t do with the data. In practice, this is where gaps most often show up. Large primes tend to have mature security programs; their small-business subcontractors may not even realize they’re holding FCI.
How CMMC Level 1 Fits In
The Cybersecurity Maturity Model Certification program, governed by 32 CFR Part 170, adds an enforcement layer on top of FAR 52.204-21 for Department of Defense contracts.6eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification Program CMMC Level 1 maps directly onto the same 15 basic controls. If you handle FCI and no CUI, Level 1 is your target.
Level 1 compliance requires an annual self-assessment. Contractors evaluate their own systems against the 15 controls and submit the results through the Supplier Performance Risk System. A senior official within the company must then affirm continued compliance at the initial assessment and each year afterward.7DoD CIO. CMMC Self-Assessment Guide – Level 1 No third-party assessor is required. Contractors can hire outside help, but the result is still classified as a self-assessment rather than a certification.
What Happens if You Don’t Comply
The consequences have teeth, though they’re more nuanced than a simple “you lose the contract” warning. The 2016 final rule that established FAR 52.204-21 clarified an important point: as long as the required safeguards are actually in place, a failure of those controls to prevent a breach does not by itself amount to a breach of contract.8Federal Register. Federal Acquisition Regulation – Basic Safeguarding of Contractor Information Systems The government is checking whether you built the walls, not guaranteeing they can never be breached.
Failing to implement the controls at all is different. A contractor that never puts the safeguards in place faces potential contract termination for default. In serious or repeated cases, the government can pursue debarment, which bars the company from receiving any federal contracts for a period that generally does not exceed three years.9Acquisition.GOV. FAR 9.406-4 Period of Debarment
The Department of Justice has added significant financial risk through its Civil Cyber-Fraud Initiative, which uses the False Claims Act against contractors who misrepresent their cybersecurity compliance. Under the False Claims Act, a contractor that knowingly submits a false statement about meeting required security controls faces treble damages plus a civil penalty of $14,308 to $28,619 per false claim.10Office of the Law Revision Counsel. 31 USC 3729 – False Claims The per-claim structure means the numbers escalate quickly once a contractor has submitted compliance affirmations across multiple contracts.
DOJ has secured multiple settlements against defense contractors for cybersecurity misrepresentations in recent years, ranging from under $1 million to $9.8 million. Several specifically involved contractors who claimed compliance with FAR 52.204-21 or NIST 800-171 without actually implementing the required controls. CMMC’s annual affirmation requirement adds another layer of exposure, because a senior official personally attesting to compliance creates a clear paper trail if the affirmation later turns out to be false.