University employees, researchers, and other individuals with access to Federal Contract Information are responsible for protecting this information and following applicable University cybersecurity requirements.
The University of Arizona is committed to protecting federal research information and meeting applicable federal cybersecurity requirements.
The Cybersecurity Maturity Model Certification (CMMC) program establishes cybersecurity standards for organizations performing work under certain Department of Defense contracts. CMMC Level 1 focuses on safeguarding Federal Contract Information (FCI) through basic cybersecurity practices.
What is Federal Contract Information (FCI)?
FCI any non-public substantive information received from or specifically generated for the Federal Government in performing or administering a federal contract, excluding publicly available information and routine payment-processing information.
FCI IS “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government”
FCI IS NOT
- information provided by the Government to the public (such as that on public websites)
- simple transactional information, such as that necessary to process payments
Information means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual specifically provided by the government to the contractor as part of an official, binding agreement or generated by the contractor specifically for the government to execute the deliverables of an official, binding agreement.
FCI excludes general corporate records or proprietary data generated independently of any government agreement.
FCI requirements flow down to subcontracts who will handle the information.
Request Approval to Publicly Post Information
Federal cybersecurity requirements restrict the public disclosure of FCI. Information associated with federal contracts must be reviewed before it is posted publicly when there is a possibility that it contains FCI.
Publicly accessible platforms include University websites, social media, online repositories, and other platforms available to individuals outside the University.
Before publicly posting information that may contain FCI, submit a request for review and approval.
Examples of information that may warrant review include:
- Descriptions of work performed under federal contracts.
- Documents, reports, or materials developed for the federal government.
- Presentations, announcements, or website content containing nonpublic federal contract information.
Information that is confirmed to contain FCI must not be publicly posted unless its release has been appropriately authorized.
Submit a Public Posting Review Request
Requests will be reviewed by the Research Security Program in coordination with members of Research Cybersecurity Governance. Do not include FCI in the initial request unless the submission method has been approved for handling that information.