FCI

Federal Contract Information (FCI) is information not intended for public release that is provided by or generated for the federal government under a contract to develop or deliver a product or service to the government. It does not include information provided by the government to the public (e.g., on public websites) or simple transactional information.

FCI is a broader and lower-sensitivity category than CUI. Almost every defense contract involves FCI in some form. Handling FCI triggers the requirement to comply with FAR 52.204-21 (the basic safeguarding clause) and corresponds to CMMC Level 1.

If a contractor only handles FCI and never CUI, CMMC Level 1 (with annual self-assessment) is sufficient. If the contract involves CUI, the contractor must move to CMMC Level 2.