sha3:c3ea41dfb5557e09963aad865c19ce3d614d81860af624c28cb7a50c4f66e0baIntacte2ffcc7adced4baa4ca954ca859c36c3c04955953cf7be2bdf4762d21f06c462prev:dd9307ef76ebRegisterGlossary
What is FCI?
FCI is information provided by or generated for the government under a contract that is not intended for public release: the trigger for CMMC Level 1.
f979da5aa35e9854fc406d3dda73806ac25ef062aef61a624bf8f3ee9686f0b1prev:e2ffcc7adcedFCI stands for Federal Contract Information.
Federal Contract Information (FCI) is non-public information created or received while performing a federal contract. Handling FCI (but not CUI) generally puts a contractor at CMMC Level 1.
Level 1 covers 17 basic safeguarding practices from FAR 52.204-21 and is met with an annual self-assessment and senior-official affirmation — no third-party assessor required.
The line between FCI and CUI matters: assuming you are FCI-only when you actually handle CUI is one of the most common and costly scoping mistakes contractors make.
c3ea41dfb5557e09963aad865c19ce3d614d81860af624c28cb7a50c4f66e0baprev:f979da5aa35eRelated records
Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.
- proof.state
- Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- proof.change
- Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
- proof.agency
- Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- architecture
- Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.
Related terms and reading
Know the term. Then see the record behind it.
- Sealed
- Last amended