FCI vs CUI for Federal Contractors

FCI vs CUI is a consequential legal distinction, not interchangeable compliance shorthand, and getting it wrong costs contractors real money and real risk. Federal contract information is defined by its non-public connection to government contract performance. Controlled unclassified information, by contrast, is defined by an applicable law, regulation, or government-wide policy that requires or permits safeguarding or dissemination controls. Those are different tests, and a contractor can fail both, either, or neither depending on what it actually handles.

This article is written for federal contractors, with particular attention to Department of Defense procurements where CMMC clauses may apply. The practical outcome of working through it: you can identify whether your organization handles FCI, CUI, or both; determine which systems are in scope; and avoid picking a CMMC level based on assumptions rather than contract terms.

The first step in an FCI vs CUI analysis is separating the two legal definitions. Informal labels like “sensitive,” “confidential,” or “government data” do not establish which rules apply. Both categories can require protection, but their definitions, sources of authority, marking expectations, and control requirements differ in ways that matter operationally.

Information can originate from the government, arrive from a prime contractor, or be generated by a subcontractor during performance. Status still must be evaluated against the applicable definition and the contract’s instructions. The origin alone does not settle the question.

What is Federal Contract Information

Federal contract information is defined under FAR 52.204-21 as information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service. Two categories are explicitly excluded: information the government provides to the public and simple transactional information used only to process payments.

The practical meaning is precise. FCI is tied to federal contract performance, not to any document a contractor treats as internal or non-public for its own business reasons. A non-public statement of work, a government-provided project schedule, non-public contract requirements, and deliverables created specifically for an agency can be FCI when they meet the FAR definition and contract terms. They are not automatically FCI in every context; the specific circumstances matter.

FAR 52.204-21 requires contractors to apply basic safeguarding to covered contractor information systems that process, store, or transmit FCI. Those baseline practices include limiting system access to authorized users and roles, authenticating users, controlling external connections, protecting communications, and scanning for malicious code. The safeguarding obligation attaches to the system boundary, so knowing which systems handle FCI is not optional.

One thing I see contractors miss: they treat every non-public contract document as automatically in scope without checking whether the system actually processes, stores, or transmits information that meets the FAR definition. That determination shapes the scope of the required safeguards.

What is Controlled Unclassified Information

Controlled unclassified information is information the government creates or possesses, or that an organization creates or possesses for or on behalf of the government, where an applicable law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. CUI is unclassified. It is not automatically classified merely because it carries handling restrictions.

The National Archives and Records Administration serves as CUI Executive Agent and administers the CUI Program. The CUI Registry identifies authorized categories and subcategories. The program distinguishes CUI Basic, where the governing authority does not prescribe particular handling controls beyond the program’s baseline, from CUI Specified, where the authority does prescribe specific controls. The distinction matters because CUI Specified categories can carry requirements beyond the CUI Basic baseline.

Examples that can be CUI include controlled technical information, export-controlled information, privacy-related records, critical infrastructure information, and certain acquisition or defense-related data. The word “can” is doing real work in that sentence. Those topics do not establish CUI status on their own; the applicable authority and circumstances must support that designation.

A contractor should not create a CUI designation based on guesswork. At the same time, absence of a CUI marking should trigger verification, not an assumption that the information is unrestricted. The contract, applicable authority, and agency instructions are the authoritative sources. When those leave ambiguity, the contracting officer or prime contractor is the right contact.

All non-public contract information is not automatically CUI. Using the terms as synonyms is one of the most common scoping errors we see federal contractors make, and it produces compliance obligations that are either over-stated or missed entirely.

FCI is determined by its non-public connection to government contract performance and the FAR’s exclusions. CUI is determined by the presence of an applicable authority requiring or permitting controls. Those are independent tests. Information can satisfy both when it is non-public contract information and also falls within an authorized CUI category with applicable handling requirements. Confirming that overlap requires checking the governing contract, applicable authority, CUI category, and handling instructions.

A contract document, technical drawing, project schedule, database record, email attachment, or deliverable cannot be categorized solely by file type, sensitivity perception, or the fact that it arrived from a government email address. The contractor must evaluate the governing contract, flow-down clauses, data markings, distribution statements, and applicable authority.

CUI generally carries more extensive safeguarding expectations than the basic FCI baseline, but the exact obligations depend on the governing authority and contract.

CMMC is a DoD program. An organization should not assume every federal contract, every subcontract, or every category of government information triggers the same CMMC requirement. The solicitation and contract determine the required CMMC status, assessment route, and applicable level. CMMC requirements are also distinct from the broader question of whether a contractor must protect FCI or CUI under other clauses, laws, regulations, or agency instructions.

That readiness range reflects implementation preparation, not a government certification timeline or a guaranteed outcome. The key variable is accurately defining the systems and information in scope before any technical work begins. Contractors who start with that scoping question move faster than those who start by buying security tools.

How Level 1 and Level 2 apply to FCI and CUI

For applicable DoD procurements, CMMC Level 1 aligns with the basic safeguarding requirements in FAR 52.204-21, which are associated with protecting FCI. Level 1 involves 15 practices drawn from that FAR clause. Level 2, by contrast, aligns with the 110 security requirements in NIST SP 800-171 Revision 2 and is associated with protecting CUI for applicable DoD work.

The decision rule in plain terms: handling FCI does not automatically mean Level 2 is required, and handling information you believe to be CUI does not establish the required CMMC level without contract confirmation. The solicitation specifies what is required, and that document is the authoritative source.

DFARS 252.204-7012 addresses covered defense information, including qualifying CUI handled in support of DoD contract performance. It also requires cyber-incident reporting within 72 hours of discovery for covered incidents. That 72-hour window is a hard operational requirement, not a target.

As of October 27, 2026, DoD resources report that Phase II was suspended on July 13, 2026, while Phase I self-assessment requirements remained in place. Verify the current solicitation, contract, and DoD CMMC guidance before acting on earlier rollout dates or Phase II timelines. Current program materials describe Level 2 self-assessments every three years with annual affirmation for self-assessment status, but the specific route remains contract-dependent.

There is no government-set CMMC implementation price or universal assessment fee. Costs depend on scope, current readiness, systems in the assessment boundary, and whether the contract calls for self-assessment or an independent assessment. At On-Site Technology, CMMC compliance readiness services add $20 to $35 per user per month to managed IT pricing. That is an OST service-pricing figure, not a government-set fee or a universal industry rate.

Before scoping security controls, signing a subcontract certification, or answering a prime contractor’s compliance questionnaire, work through an information and system review. The objective is to identify the information, the authority governing it, every person who handles it, and every system through which it flows. The federal contract information vs controlled unclassified information distinction cannot be resolved by intuition about what “feels sensitive.”

Review contracts, data flows, and handling instructions

Start with the contract documents. Review active and prospective solicitations, contracts, statements of work, attachments, exhibits, data-item descriptions, and any agency-specific instructions included in or referenced by the contract.

Next, identify the relevant clauses. FAR 52.204-21, DFARS 252.204-7012, and any CMMC clauses or flow-down language establish obligations, but those clauses must be read alongside the actual information handled and the full contract context. A clause in the contract does not automatically resolve whether specific data meets the FCI or CUI definition; it establishes what protections apply when the definition is met.

Build an information inventory covering data received, created, stored, processed, or transmitted to perform the work. Include paper records, email, endpoints, cloud storage, collaboration platforms, backups, mobile devices, and any systems operated by subcontractors. Gaps in this inventory become gaps in the system boundary, which becomes a problem during any assessment.

Look for CUI banners, category markings, distribution statements, legends, export-control references, and agency-specific handling instructions. Markings are useful evidence. Absence of a marking should trigger verification rather than an assumption that the information is unrestricted. The question to ask is whether the applicable authority exists, not whether the document has a stamp.

Map the data flow from receipt or creation through storage, access, collaboration, backup, transmission, retention, and disposal. Identify users, administrators, managed service providers, cloud providers, subcontractors, and external connections that can touch the data. This map establishes which systems are in scope for safeguards and, for DoD work, which systems fall within the assessment boundary.

When the status of information remains unclear after reviewing the contract documents and markings, escalate to the contracting officer or prime contractor. Contractors should request clarification rather than self-designating information as CUI or disregarding potentially applicable controls. A documented system boundary and data-flow map support this process and help demonstrate a repeatable approach to identifying FCI systems and CMMC scope.

Safeguards must be proportionate to the actual information type and contractual requirement. That said, baseline security discipline benefits both FCI and CUI environments. Role-based access and need-to-know decisions should govern who can reach contract data. Strong authentication, prompt account changes when roles shift, and current endpoint protection reduce exposure across both categories.

Secure email, approved file-sharing platforms, endpoint protection, and governed cloud collaboration environments are operational requirements, not optional enhancements. Approved external connections, malware protection, employee training on CUI markings and reporting, incident-response procedures, and current documentation round out the baseline. Organizations handling CUI should maintain a current data inventory and system security plan because technical controls alone do not demonstrate a complete, repeatable compliance posture.

My contrarian position on this: most CMMC-related security spending goes to technology before the information and system boundary is clearly defined. That order is backwards. A contractor that knows precisely what it handles, where it lives, and who touches it will spend less, scope more accurately, and move faster through any assessment than one that bought tools first and mapped data second.

Common mistakes worth naming directly:

• Treating every non-public contract document as CUI without locating the applicable authority.
• Assuming an unmarked document can never be CUI.
• Ignoring prime contractor flow-down clauses or subcontractor access to contract data.
• Sending contract information through personal email, consumer file-sharing tools, or unapproved collaboration platforms.
• Treating MFA, endpoint protection, or encryption as a substitute for policies, training, documentation, and data-flow analysis.
• Waiting for an assessment request before identifying sensitive information and system boundaries.

Most On-Site Technology managed IT clients run MFA and EDR. Some co-managed clients manage their own security tools. In a co-managed environment, technical-control ownership must be clearly documented to determine responsibility during a CMMC scoping or assessment exercise. A shared responsibility that nobody has written down is, in practice, an unmet requirement.