FAR 52.204‑21 Explained: What Actually Counts as FCI (With Real Contractor Examples)
If you’ve ever thought “we don’t have Controlled Unclassified Information (CUI), so we’re off the hook,” this article is for you. FAR 52.204‑21 sets baseline safeguards for contractor systems that process Federal Contract Information (FCI)—and FCI shows up in more places than you might expect. [acquisition.gov]
Why contractors keep misclassifying FCI
The most common mistake we see: teams assume that if CUI isn’t in scope, no cyber obligations apply. But FCI alone triggers the Basic Safeguarding of Covered Contractor Information Systems clause—FAR 52.204‑21—whenever your systems process, store, or transmit it.
Bottom line: If FCI touches your email, ticketing, endpoints, file shares, or cloud tools, those systems inherit baseline safeguarding requirements.
