Official definition: “Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.”

Contractors that have FCI on their systems are expected to protect them at either CMMC level one or two. Always check your contract to confirm your own CMMC requirements. CMMC level one matches up to the security controls required by FAR 52.204-21. If your company has already implemented those controls then you are well positioned for CMMC.