Information that is not intended for public release and is provided by, or generated for, the U.S. government under a federal contract to develop or deliver a product or service. Unlike Controlled Unclassified Information (CUI), which is subject to specific safeguarding requirements under federal law and regulation, federal contract information (FCI) is considered less sensitive but still requires protection from unauthorized access or disclosure.

Examples of federal contract information (FCI) include contract details, schedules, deliverables, pricing information, or internal communications related to fulfilling a government contract. While this data may not rise to the level of national security concern, its exposure could still pose risks such as competitive disadvantage, loss of government trust, or increased vulnerability to targeted attacks. Understanding FCI vs CUI is crucial for federal defense contractors to ensure appropriate cybersecurity measures are in place.

The protection of federal contract information (FCI) is codified in FAR 52.204-21, which requires contractors to implement 15 basic safeguarding measures. These practices form the foundation of CMMC Level 1 (Foundational), ensuring that even the most basic DoD contracts maintain a minimum level of cybersecurity hygiene. Achieving FCI compliance is a critical step in federal contract compliance and defense contracting.