# What Is FCI? Federal Contract Information for Small DoD Suppliers

URL: https://limehawk.io/reports/what-is-fci
Published: 2026-10-02
Author: Corey Watson, Managing Member
Topic: Guides
Read time: 6 min

FCI is non-public information provided by or generated for the government under a contract. If your systems hold it, FAR 52.204-21 and CMMC Level 1 apply.

> **TL;DR** Federal Contract Information (FCI) is information that isn't meant for public release and is provided by or generated for the government under a contract to deliver a product or service. The definition lives in FAR 4.1901. It leaves out two things: information the government has already made public, and simple transactional information like what's needed to process payments. For a machine shop on a defense subcontract, FCI is mostly ordinary paperwork: the purchase order, the contract terms, delivery schedules, and the emails about them. If FCI sits on your computers, FAR 52.204-21 applies, and on DoD work that means CMMC Level 1. CUI is a separate, stricter category.

- Safeguards FCI triggers: 15

## What is FCI?

FCI, or Federal Contract Information, is information that is "not intended for public release" and is "provided by or generated for the Government under a contract to develop or deliver a product or service to the Government." That's the definition in [FAR 4.1901](https://www.acquisition.gov/far/4.1901). It's broad on purpose. If it came to you because of a government contract, or you made it for one, and it isn't public, assume it's FCI.

The CMMC rule doesn't write its own version. [32 CFR 170.4](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) just says FCI "is defined in 48 CFR 4.1901." So the FAR definition is the one that counts for CMMC too.

One housekeeping note. Under the government's FAR overhaul, the same definition now also appears at [FAR 40.301](https://www.acquisition.gov/far-overhaul/far-part-deviation-guide/far-overhaul-part-40), and the safeguarding clause is numbered 52.240-93 in agencies using that deviation. The DoD's [Part 40 class deviation](https://www.acquisition.gov/sites/default/files/page_file_uploads/DoD_RFO_Deviation_Part-40.pdf) took effect February 1, 2026. The wording is the same. You'll see both numbers in contracts for a while.

## What is not FCI?

The FAR definition carves out exactly two things. FCI does not include "information provided by the Government to the public (such as that on public Web sites)" or "simple transactional information, such as that necessary to process payments." Anything else that is non-public and tied to the contract stays in.

In practice:

- **Public information isn't FCI.** If the government already posted it, like a solicitation on a public website, it isn't FCI just because a copy is on your server.
- **Payment processing details aren't FCI.** The FAR's own example is the information "necessary to process payments." Don't stretch it. The definition doesn't say every invoice or every email that mentions money is exempt.
- **Your own commercial work isn't FCI.** The definition only covers information tied to a government contract. A job for a private customer with no government contract behind it doesn't qualify.

The carve-outs are narrow. When people get FCI wrong, it's usually because they decided their contract paperwork is "just business stuff." It usually isn't.

## What does FCI look like at a machine shop?

At a small machine shop supplying a defense prime, FCI is mostly ordinary contract paperwork that isn't public. The purchase order for the parts, the contract or subcontract terms, the delivery schedule, and the email back and forth with the buyer about quantities and dates all fit the definition. So do the quotes and status updates you generate for that contract.

That paperwork doesn't live in one place. It's in:

- The office manager's inbox and the shared mailbox the buyer emails.
- The ERP or job-tracking system where the PO gets entered.
- A file share or cloud folder where the paperwork gets saved.
- Laptops and phones that sync that mail.
- The printer or scanner if it stores jobs.

That's why FCI turns into an IT question. The FAR calls any contractor-owned system that "processes, stores, or transmits Federal contract information" a [covered contractor information system](https://www.acquisition.gov/far/4.1901). Every one of those is in scope.

FCI also flows down. [FAR 52.204-21](https://www.acquisition.gov/far/52.204-21), paragraph (c), requires the prime to put the clause in subcontracts, including subcontracts for commercial products and services, other than commercially available off-the-shelf (COTS) items. If you're two tiers down from the prime, the clause can still reach you.

## What's the difference between FCI and CUI?

FCI is the floor. CUI is a narrower, more sensitive category with its own legal basis and much heavier requirements. Controlled Unclassified Information is defined at [32 CFR 2002.4(h)](https://www.ecfr.gov/current/title-32/subtitle-B/chapter-XX/part-2002) as information that "a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls." We cover CUI in detail in [What Is CUI?](/reports/what-is-cui)

| | FCI | CUI |
|---|---|---|
| Defined in | FAR 4.1901 | 32 CFR 2002.4(h) |
| What it is | Non-public information provided by or generated for the government under a contract | Information that law, regulation, or government-wide policy says needs safeguarding or dissemination controls |
| Federal safeguards | FAR 52.204-21, 15 basic requirements | NIST SP 800-171 (Rev 2 under the CMMC rule), 110 requirements |
| CMMC level on DoD work | Level 1 | Level 2 (some programs Level 3) |
| How you spot it | By the definition. There's no FCI banner marking in the FAR. | Usually marked by the government or the prime |

The practical test for a shop: if a drawing or spec shows up marked CUI, you've left Level 1. That's [CMMC Level 2](/reports/cmmc-level-2-requirements) territory. FAR 52.204-21 says so itself in paragraph (b)(2). It "does not relieve the Contractor" of the separate CUI safeguarding requirements.

## What does FCI require you to do?

If FCI lives on your systems, you have to apply the 15 basic safeguarding requirements in [FAR 52.204-21](https://www.acquisition.gov/far/52.204-21), paragraph (b)(1), to those systems. They're the basics: limit access to authorized users, know who and what is on the network, authenticate logins, sanitize old media, lock the doors, protect the network boundary, patch, and run malware protection.

On DoD contracts, FCI is also what triggers CMMC Level 1. The CMMC rule at [32 CFR 170.14](https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170) sets the Level 1 requirements as the ones in 52.204-21(b)(1)(i) through (xv). You assess yourself every year, post the result in SPRS, and a senior official affirms it. We walk through all 15 and the SPRS steps in our [CMMC Level 1 guide](/reports/cmmc-level-1).

Where the rollout stands: the DoD suspended the Phase 2 transition on July 13, 2026, and that pause was about third-party Level 2 assessments. Level 1 self-assessments remain in place. If you hold FCI on a DoD contract, Level 1 applies now.

## Key takeaways

- FCI is non-public information provided by or generated for the government under a contract. The definition is in FAR 4.1901.
- Two things are excluded: information the government already made public, and simple transactional information such as what's needed to process payments.
- At a machine shop, FCI is everyday contract paperwork: the PO, the terms, delivery schedules, and the email threads about them.
- Any system that processes, stores, or transmits FCI is a covered contractor information system, and FAR 52.204-21's 15 safeguards apply to it.
- On DoD work, FCI alone means CMMC Level 1. CUI is a separate, stricter category that means Level 2.

## What this looks like when we do it

We're not a C3PAO or a Registered Practitioner Organization, and we don't do CMMC assessments. What we do is the IT work under them. For a shop with FCI, the first job is finding where it lives. We trace the PO from the buyer's email to the inbox, the ERP, the file share, and every laptop and phone that syncs them. That map becomes your scope.

Then we close the gaps the 15 safeguards look for: shared logins, former employees still active, a firewall nobody has reviewed, patching that quietly stopped. The evidence comes out of the same tools that run the controls, so your affirming official signs based on reports, not a hunch. On the plant floor, we isolate older controllers and legacy Windows instead of forcing replacements. More on that on our [manufacturing IT support page](/industries/manufacturing).

If you're a supplier figuring out what counts as FCI in your office, our [manufacturing IT page](/industries/manufacturing) covers how we set up shops like yours. [Book a call](/contact) and we'll map it with you.