You secure other people. Now you have to show your own file.

What counts as Federal Contract Information here

FCI is the ordinary, non-public material the government or a prime hands you so you can perform the contract. It is not classified and it is not exotic. For IT and systems-integration firms, it usually looks like this:

• Client network diagrams, asset inventories and configuration data for federal work
• Task orders, labor categories and pricing from a government vehicle
• Credentials and access provisioned to you to perform the contract

You are bidding a federal task order and the solicitation asks for your safeguarding posture as a submission requirement. That is the moment this stops being theoretical.

Where IT and systems-integration firms usually slip

Three requirements this trade tends to miss — not because the work is hard, but because nobody was ever asked to write it down.

• AC.L1-3.1.1 · Authorized access controlTechnician access to client environments is broad by convenience and rarely reviewed after the project ends.
• IA.L1-3.5.2 · AuthenticationShared administrative and break-glass accounts persist in the password vault long after the reason for them is gone.
• SC.L1-3.13.5 · Public-access system separationThe demo environment, the public website and internal systems share infrastructure because it was cheaper to build that way.

The assessment scores all 17 assessable practices, not just these three. These are simply the ones that come up most often.

Start with the list nobody handed you.

All 15 requirements in plain English, with a column for what counts as evidence for each one. Most people fill it out in about twenty minutes and know exactly where they stand. No call, no obligation — it is a one-page PDF.

Want your actual score?

The checklist tells you what the requirements are. This tells you which onesyou miss. Twelve questions, written for a business owner rather than an auditor, and a gap report that puts the fixes in order — quick wins first. Nothing is stored until you ask for the report.

Other trades

Same assessment, written for a different shop floor.