EXECUTIVE BRIEF
Understanding what qualifies as FCI and how to protect it is essential for Department of Defense (DoD) subcontractors. The Cybersecurity Maturity Model Certification (CMMC) framework outlines the baseline safeguards required to remain compliant and contract-eligible.
Dig deeper and continue reading below.
FCI refers to data created or used in delivering products or services under federal contracts that isn’t meant for public release. Subcontractors handling FCI—even without direct DoD interaction—must comply with CMMC Level 1, which involves 17 self-assessed cybersecurity practices.
FCI is defined as "information provided by or generated for the government under a contract to develop or deliver a product or service to the government but not intended for public release."
Here's What Contractors Need to Know:
FCI is the baseline information type protected under CMMC Level 1. While it might seem less sensitive than CUI, FCI still contains proprietary, strategic, or otherwise valuable details about federal operations. Mishandling this data could compromise federal supply chain integrity and lead to penalties or lost contract opportunities.
In many contracts, flow-down clauses require subcontractors to meet specific cybersecurity standards. If your prime contractor is subject to these rules, chances are you are too — and in some instances, this may require you to comply with CMMC Level 2, especially if CUI is involved.
CMMC Level 1 is tailored specifically to the protection of FCI. It includes 17 basic cyber hygiene practices outlined in FAR 52.204-21. These are:
Unlike higher CMMC levels, Level 1 requires a self-assessment that must be submitted annually to the SPRS.
Important Note: Subcontractors should be aware that presenting a falsely compliant posture—intentionally or not—could expose them to False Claims Act liability, especially if gaps in security controls are later discovered during a contract review or audit.
If you receive federal contract documents, work on deliverables for a federal agency, or communicate with a prime contractor about project specifications, you're probably handling FCI. It may include:
Ask your prime contractor or consult your contract documents to confirm. When in doubt, treat uncertain data with the same protections required for FCI.
To comply with CMMC Level 1, subcontractors should:
CMMC compliance can feel complex—but you don’t have to figure it out on your own. While ISI does not offer services specific to achieving CMMC Level 1, we support contractors who are preparing for or required to meet CMMC Level 2 compliance. This level covers the protection of CUI and applies to an estimated 75–80% of contractors in the defense industrial base.
If you’re serious about sustaining current contracts and growing your business within the DoD supply chain, targeting Level 2 is your best strategic path forward.
No. FCI is less sensitive and requires CMMC Level 1 protection. CUI requires Level 2.
No. A self-assessment is sufficient for CMMC Level 1.
You risk disqualification from current and future contracts and potential legal consequences.
For organizations handling FCI, DoD provides guidance on CMMC Level 1 requirements, including the 17 cybersecurity practices outlined in FAR 52.204-21. You can also visit the Cyber Accreditation Body (CyberAB) website for current updates and training resources:
While CMMC Level 1 only requires a self-assessment, subcontractors should take the process seriously—especially with growing attention on compliance enforcement and supply chain security.
Looking ahead: Many contractors will eventually need to meet CMMC Level 2 standards, which apply to CUI and require a more rigorous assessment. ISI helps DoD subcontractors prepare for Level 2 compliance—supporting long-term growth and resilience in the defense industrial base.