Federal Contract Information and Controlled Unclassified Information
The two information types drive everything else: which CMMC level applies, which requirements are in force, and what falls inside the assessment scope.
FCI is information provided by or generated for the Government under a contract to develop or deliver a product or service, and which is not intended for public release. CUI is information the Government creates or possesses, or that an entity creates or possesses for the Government, that requires safeguarding or dissemination controls under law, regulation or Government-wide policy.
Level 1 protects FCI, through the 15 basic safeguarding requirements of 48 CFR 52.204-21. Level 2 protects CUI, through the 110 security requirements of NIST SP 800-171.
Recall
The terms and figures from this lesson, one at a time.
Define Federal Contract Information (FCI).
This deck does not remember you yet. Spaced repetition arrives with accounts.
Check yourself
By QualExam editorial. Written against the awarding body’s published blueprint and checked against it on every build.
Source: ISACA CCA/CCP Exam Candidate Guide
Last checked against the source: 2026-09-22