It's been established that FCI includes quote, order, purchase and communication about a contract. In my scenario, we have a small amount of records in our system that require controls. The goal is to create protection processes around those records. For instance, control what data flows to hubspot and to our public website (customer portal). We have internal MSSQL databases (on one server) with data mixed in our internal ERP system. We cannot just put a new system in place due to cost. Can we create a managed process to control which records can be pushed into the non-fedramp systems? (hubspot specifically). Also, is it feasible to implement MFA for just Prime contractors in our public website or is it required that MFA be applied to ALL accounts? This would be prohibitive for our non-gov customers and we would probably lose a large percentage of leads... thoughs?