ResourcesGlossary
What is FCI?
FCI is information provided by or generated for the government under a contract that is not intended for public release: the trigger for CMMC Level 1.
FCI stands for Federal Contract Information.
Federal Contract Information (FCI) is non-public information created or received while performing a federal contract. Handling FCI (but not CUI) generally puts an organization at CMMC Level 1.
Level 1 covers 17 basic safeguarding practices from FAR 52.204-21 and is met with an annual self-assessment and senior-official affirmation — no third-party assessor required.
The line between FCI and CUI matters: assuming you are FCI-only when you actually handle CUI is one of the most common and costly scoping mistakes organizations make.
Related records
Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.
- proof.state
- Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- proof.change
- Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
- proof.agency
- Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- architecture
- Architecture. How the chain is built and where the evidence is stored in each delivery mode.
- authorization
- Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
- baseline
- NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.
Related terms and reading
Know the term. Then see the record behind it.
- Published
- Last updated