What counts as federal contract information (FCI) on a plain services contract, and what must I do about it?

Federal Contract Information (FCI) is information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. The contract itself, the cleaning schedules, and the badge lists for your staff likely count as FCI because they are not intended for public release and are generated under the contract for the service you provide. Your invoices and information available on a public website generally would not be considered FCI. Your contract includes FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems, which lists 15 security requirements. This clause requires you to safeguard FCI, but it does not trigger any CMMC rules for your civilian contract. CMMC is a Department of Defense program, and while CMMC Level 1 aligns with the 15 requirements of FAR 52.204-21, your contract is not subject to CMMC.