Federal contract information, or FCI, triggers the 15 basic safeguarding requirements in FAR 52.204-21, which CMMC Level 1 mirrors. Controlled unclassified information, or CUI, triggers NIST SP 800-171, which CMMC Level 2 mirrors. Most contractors hold FCI. Only some hold CUI, and your contract says which.
What FCI is
The FAR clause defines federal contract information as non-public information that the Government provides, or that is generated for it, under a contract to develop or deliver a product or service. It excludes information the Government publishes to the public and simple transactional information such as data needed to process payments.
What the 15 requirements ask
In plain terms, paragraph (b)(1) of the clause asks you to:
- limit system access to authorized users, processes and devices
- limit users to the transactions and functions they may perform
- verify and control connections to external systems
- control information posted on public systems
- identify users, processes and devices
- authenticate them before access
- sanitize or destroy media holding FCI before disposal or reuse
- limit physical access
- escort visitors, log physical access and manage devices
- monitor and protect boundary communications
- put public-facing components on separate subnetworks
- find, report and fix flaws promptly
- protect against malicious code
- keep malicious code protection updated
- run periodic scans and real-time scans of files from outside sources
Three of these, 12 through 15, land hardest on a software team.
How the levels line up
The CMMC rule at 32 CFR 170.14 says Level 1 has 15 practices that correspond to the FAR clause paragraphs. Level 2 requirements are identical to NIST SP 800-171 Rev. 2. Level 3 has 24 requirements selected from NIST SP 800-172. The section says assessment of the requirements is prescribed by NIST SP 800-171A and 800-172A.
How to tell which you hold
- Read the clauses in the contract for FAR 52.204-21, DFARS safeguarding language or mention of CUI.
- Ask in writing whether the work involves CUI, and which categories.
- Look for CUI markings on documents you receive.
- If there is no CUI, you still likely hold FCI whenever you perform a federal contract.
Do not mark things CUI yourself. The agency decides that. Our post on what CUI is covers the check in more depth: What is CUI and how do you know if you handle it?
What to do next
If only FCI is in scope, work through the 15 items and write down how each is met. If CUI is in scope, plan the larger program and its scope boundary. Our post on scoping explains the asset categories: CMMC assessment scope.
Quick check
Does holding FCI mean I need NIST 800-171?
Not by itself. The FAR clause sets 15 basic requirements for FCI. NIST SP 800-171 applies when CUI is involved and the contract says so.
How many practices does CMMC Level 1 have?
Fifteen, per 32 CFR 170.14, corresponding to the FAR 52.204-21 requirements.
Safeguard's asset discovery and SBOM scanning help with items such as flaw finding and inventory, and compliance and evidence automation stores the proof. A free scan is at gold.safeguard.sh/scan.
Sources
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
- 32 CFR 170.14, CMMC model
Last reviewed: 19 October 2026.
