Skip Navigation
Search
Office for Research and Innovation
Office of Research Security
HomeResearch Data Protections and SecurityFederal Contract Information

Federal Contract Information (FCI)

What is Federal Contract Information (FCI)?

Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments.

What are the federal regulations for FCI? 

The Federal Acquisition Regulations (FAR) provide the standards for security controls for FCI.  FAR clause 52.204-21 Basic Safeguarding of Covered Contractor Information Systems.There are fifteen (15) requirements included in this clause that provide for cyber and physical security for systems that store, use, or create FCI. 

How could a researcher receive and/or create FCI?

If your contract is with a federal sponsor or a subaward with a federal sponsor prime, your agreement may contain the following clause in the terms and conditions: 52.204-21 Basic Safeguarding of Covered Contractor Information Systems.

The presence of this clause signifies that FCI may be involved.  If this clause is in your agreement it is important to understand if you have any requirements to receive prior approval for publications and/or requirements to mark reports with distribution limitations.  This would include a requirement for a Distribution Statement other than A for DoD awards.  

Are SBU systems compliant with Basic Safeguarding requirements?

At this time, most research labs and researchers are not working in environments that are inherently compliant with the Basic Safeguarding requirements.

What does a researcher need to do if accepting an award with Basic Safeguarding requirements?

Compliance can be achieved at SBU - the Office of Research Security (ORS) will work with researchers to create a System Security Plan (SSP) - evaluating the fifteen requirements of Basic Safeguarding - and provide solutions to address gaps.   Note: this may entail costs for additional hardware and/or software or networking costs.