What Is Federal Contract Information? Safeguards and CMMC Rules

Federal Contract Information, or FCI, is any non-public information the government provides to you, or that you generate for the government, while performing a contract to develop or deliver a product or service. If your company handles FCI, you are legally required to apply the 15 basic cybersecurity safeguards in FAR clause 52.204-21 to every system that stores, processes, or transmits it. Two categories are carved out of the definition: information the government has already released publicly, and simple transactional data used to process payments.1Acquisition.GOV. FAR 4.1901 Definitions

The definition is deliberately wide. It reaches data in any format, whether digital files, paper documents, emails, or verbal briefings, so long as the information came from the government or was created on its behalf during contract performance. You do not get to decide whether a given item feels sensitive enough to protect. If it was generated for the government and it is not public, it is FCI, and the safeguarding obligation attaches.

What FCI Looks Like in Practice

Most contractors touch FCI every day without labeling it. Typical examples include:

  • Contract documents such as award letters, modifications, statements of work, and delivery schedules from the contracting office.
  • Emails and messages between your staff and government officials about milestones, technical issues, or schedule changes.
  • Internal plans your company writes to explain how it intends to meet government specifications or quality standards.
  • Performance and quality reports, logs, and status updates produced for government oversight.
  • Invoices that describe specific services rendered, labor categories, or proprietary methods used on the contract.
  • Draft deliverables, including working versions of reports, research notes, or technical documents built for an agency, even ones that were never finalized.

None of this is classified national security information. It is simply non-public, and the government expects you to keep it that way.

What Does Not Count as FCI

FAR 4.1901 excludes two categories so contractors don’t over-protect routine material.1Acquisition.GOV. FAR 4.1901 Definitions

The first is anything the government has already released to the public. Data posted on agency websites, published solicitations on SAM.gov, and publicly available reports don’t become FCI just because you download or cite them.

The second is simple transactional information needed to process payments. Bank account details for electronic funds transfers, routing numbers, and basic business contact information submitted for invoicing don’t trigger FCI requirements.

Sorting these correctly matters in both directions. Treating public solicitation data as restricted wastes effort. Treating a detailed technical invoice as ordinary payment data can leave protected content exposed.

How FCI Differs From Controlled Unclassified Information

FCI and Controlled Unclassified Information (CUI) overlap, but they are not the same, and the difference decides which cybersecurity standard applies to you. CUI is information the government creates or possesses, or that an entity creates on the government’s behalf, that a law, regulation, or government-wide policy requires an agency to protect using specific safeguarding or dissemination controls. All CUI held by a contractor is also FCI, but not all FCI rises to the level of CUI.2CUI Program Blog. FCI and CUI, What Is the Difference?

The distinction shows up in the control set:

  • FCI that is not CUI is governed by the 15 basic safeguarding controls in FAR 52.204-21.
  • CUI is governed by the 110 controls in NIST Special Publication 800-171, covering areas such as access management, incident response, and audit logging.2CUI Program Blog. FCI and CUI, What Is the Difference?

CUI also comes with formal marking requirements: documents must carry headers and footers that identify the CUI category and any dissemination restrictions. FCI has no comparable marking mandate, though tracking it internally is the only realistic way to make sure the right controls follow the data.

The 15 Required Safeguards

FAR 52.204-21 sets out 15 controls that apply to every information system that processes, stores, or transmits FCI.3Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems These are legal minimums, not suggestions. They fall into a few practical groups.

Access controls limit system access to authorized users, processes, and devices; restrict each user to only the transactions and functions they are permitted to perform; verify and restrict connections to external systems; and control what gets posted to publicly accessible systems.

Identification and authentication requirements mean identifying all users, processes, and devices, and verifying identity before granting access.

Physical protections require limiting physical access to systems, equipment, and server rooms to authorized people, escorting visitors, monitoring visitor activity, keeping physical-access audit logs, and managing keys, badges, and similar access devices.4eCFR. 48 CFR 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems

Communications and network protections require monitoring and controlling traffic at external and key internal network boundaries, and separating publicly accessible components from internal networks either physically or logically.

System integrity requirements cover identifying and fixing system flaws promptly, protecting against malicious code, updating malware protection when new releases come out, and running periodic scans along with real-time scans of files from external sources.

Media sanitization requires that any media containing FCI be sanitized or destroyed before it is disposed of or reused.3Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems

Government auditors can review your systems to confirm the controls are in place. Falling short on even one can put a contract at risk.

Subcontractor Flow-Down

Prime contractors must flow FAR 52.204-21 down to every subcontractor whose systems will store or transmit FCI, including subcontracts for commercial products and services. The only exception is subcontracts for commercially available off-the-shelf (COTS) items.3Acquisition.GOV. FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems

So the 15-control baseline reaches every tier. If you are a subcontractor and FCI passes through your systems, even briefly, you are on the hook. Primes should verify subcontractor compliance as part of their own risk management, because a breach anywhere in the chain can jeopardize the whole contract.

CMMC Level 1 for DoD Contractors

The Cybersecurity Maturity Model Certification (CMMC) program adds a verification layer on top of FAR 52.204-21 for Department of Defense contracts. The CMMC final rule at 32 CFR Part 170 took effect on December 16, 2024, and DoD began a phased rollout in late 2025.5Federal Register. Cybersecurity Maturity Model Certification (CMMC) Program

CMMC Level 1 maps directly to the 15 FAR 52.204-21 controls and is the tier that applies to contractors handling FCI. Phase 1 runs from late 2025 through late 2026 and focuses on Level 1 and Level 2 self-assessments. During that phase, DoD solicitations may require a Level 1 self-assessment as a condition of award.6DoD CIO. Cybersecurity Maturity Model Certification

To meet Level 1, you have to:

  • Assess your own systems against all 15 controls and calculate a compliance score.
  • Have a senior official formally attest to the accuracy of the assessment, and renew that attestation annually.7Defense Logistics Agency. Cybersecurity Resources for Suppliers
  • Submit your score through the Supplier Performance Risk System (SPRS) inside the Procurement Integrated Enterprise Environment (PIEE) platform.7Defense Logistics Agency. Cybersecurity Resources for Suppliers

Unlike Level 2, which can require an independent third-party audit, Level 1 relies entirely on self-assessment. The annual senior-official attestation, however, carries legal weight.

What Non-Compliance Costs

Failing to protect FCI can trigger penalties well beyond a warning letter. The most immediate risk is contract-level: the contracting officer can terminate for default, suspend payments, or debar the company from future awards. Those remedies alone can be devastating for a small or mid-sized contractor that depends on federal work.

A more severe risk comes from the False Claims Act (FCA). When a contractor certifies, explicitly or by implication, that it meets FAR 52.204-21 or CMMC requirements but does not, the government can pursue FCA liability. Damages include a per-claim civil penalty (adjusted annually for inflation), the amount the government paid on the contract, and treble damages at three times that amount. Even an implied false certification, where the company never expressly claimed compliance but failed to disclose a shortfall, can support liability.

The Department of Justice has made cybersecurity enforcement a priority through its Civil Cyber-Fraud Initiative, and the risk of an FCA action will grow as CMMC turns cybersecurity verification into a condition of contract award. If you find gaps in your controls, close them and document the remediation rather than waiting for someone else to find them.