FCI
What Is FCI? Plain Examples for Defense Suppliers
A plain-English definition of Federal Contract Information with real examples, how it differs from CUI, and why it decides whether CMMC Level 1 applies.
You keep seeing the term FCI, and every explanation is the same dictionary sentence that does not tell you what it looks like in your own files. Suppliers ask the same two things on the forums. Give me a real example, and how far down the supply chain does it reach. Here are plain answers.
The short version. Federal Contract Information is non-public information the government provides to you, or that you generate for the government, under a contract to deliver a product or service. It is not intended for public release. It is not the more sensitive CUI. If you handle FCI, that is what puts CMMC Level 1 in view.
The Definition, in Plain Words
The formal definition comes from FAR 52.204-21. Strip it down and it means information tied to a federal contract that is not meant to be public. Two parts matter. It is connected to a government contract, and it is non-public. If both are true, it is generally FCI.
It does not have to be marked. Unlike CUI, FCI carries no special label. That is exactly why it catches people off guard. There is no stamp to look for, so you have to reason about the information itself.
Real Examples of FCI
Here is what FCI tends to look like inside a supplier.
- A purchase order or contract from a government customer or a prime, where the details are not public.
- Quotes and pricing you prepared for a government contract.
- Delivery schedules and shipping information for a contract.
- Non-public emails and communications about performing the work.
- Statements of work and task orders that are not published.
And here is what is usually not FCI.
- Information already published or intended for public release.
- Purely commercial, off-the-shelf transactions with no government contract behind them.
FCI or CUI? Why It Matters
FCI and CUI sit at different levels, so telling them apart is what decides your path.
- FCI is the broader, less sensitive category tied to Level 1 and its 15 requirements under FAR 52.204-21.
- CUI is more sensitive information the government marks or specifies, for example controlled technical drawings and specifications. It belongs to Level 2 and the 110 controls of NIST SP 800-171.
A useful signal is marking. CUI is generally marked or identified by the government. FCI is not. When something arrives marked CUI, it points toward Level 2. When your government-related information is non-public but unmarked, it is often FCI.
Where Scope Is Your Decision
One boundary we hold. We will not tell you that a specific document or system of yours is FCI, CUI, or out of scope. That is a determination about your own environment, and it stays with you and, where needed, your contracting officer or counsel. What a good system does is give you the facts the call turns on and keep your reasoning and evidence in one place once you decide.
If you handle FCI, AssessrLog is the system of record for the Level 1 self-assessment that follows. Scope where your information lives, work the objectives, and keep the evidence behind each determination together. The free readiness check is a low-commitment way to start thinking it through.
Frequently Asked Questions
What is a simple example of FCI? A non-public purchase order from a government contract, or the delivery schedule and non-public emails tied to performing that contract.
Does FCI have to be marked? No. Unlike CUI, FCI carries no special marking. You reason about whether the information is government-related and non-public.
Is FCI the same as CUI? No. FCI is broader and less sensitive, tied to Level 1. CUI is more sensitive, usually marked, and tied to Level 2 and NIST SP 800-171.
Do COTS transactions count as FCI? Purely commercial, off-the-shelf transactions with no government contract behind them are generally not FCI. The connection to a federal contract is what matters.
If I handle FCI, what do I have to do? FCI puts CMMC Level 1 in view, a self-assessment against 15 requirements and 59 objectives, affirmed annually in SPRS. Confirming that FCI is what you handle is your determination to make.