Covered Contractor Information System
Also known as: CCIS
A Covered Contractor Information System is an unclassified information system owned, or operated by or for, a contractor that processes, stores, or transmits Federal Contract Information. FAR 52.204-21's 15 safeguarding requirements apply to every Covered Contractor Information System.
Related terms
- Federal Contract Information
Federal Contract Information (FCI) is non-public information provided by or generated for the federal government under a contract to develop or deliver a product or service. It is the information type protected under FAR 52.204-21 and is the trigger for CMMC Level 1.
- FAR 52.204-21
FAR 52.204-21 is the Federal Acquisition Regulation clause that requires federal contractors to apply 15 basic safeguarding requirements to systems that process, store, or transmit Federal Contract Information (FCI). It is the regulatory basis for CMMC Level 1, the 15 Level 1 practices are drawn directly from paragraph (b)(1) of this clause.
- Assessment Scope
The assessment scope (also called the boundary) is the set of assets, people, technology, facilities, external service providers, that process, store, or transmit FCI or CUI and therefore must meet the applicable CMMC requirements. Drawing the smallest defensible scope is the highest-leverage decision in a CMMC project.