CUI vs. FCI: Real Examples, Not Definitions

The difference between Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) decides your CMMC level. Handle only FCI and you're looking at Level 1 and its 15 requirements. Handle CUI and it's Level 2 and 110. The definitions are easy to find. What's harder is recognizing each one in the documents, drawings, and emails that actually move through a defense contractor's systems.

What's the actual difference?

FCI is defined by where information comes from: it's "information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government" (FAR 52.204-21). If it's tied to the contract and not public, it's FCI.

CUI is defined by what protects it: information created or possessed by or for the government "that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls" (32 CFR § 2002.4(h)). Every kind of CUI sits in a category of the CUI Registry, backed by a specific law or policy.

So the useful question isn't "is this sensitive?" It's "is this contract information, and does a rule require it to be safeguarded?"

What does FCI look like in practice?

Most of what moves between you and the government, or you and your prime, during a contract is FCI if it isn't public. Typical examples:

• A statement of work or performance work statement that hasn't been posted publicly
• Delivery schedules, shipping lists, and quantities for the contract
• Emails and meeting notes with the contracting officer or the prime about the work
• Contract-specific reports, test results, and status updates you send back
• Non-public technical requirements that don't carry a restrictive distribution statement

What isn't FCI, by the definition's own exclusions:

• Anything the government has made public, such as a solicitation posted on a public website
• Simple transactional information, like the details needed to invoice and get paid

What does CUI look like for a defense contractor?

The CUI Registry has categories across government, but for most defense suppliers two matter most.

Controlled technical information (CTI). DFARS 252.204-7012 defines it as "technical information with military or space application" that's subject to controls on access, use, or release, and ties it to distribution statements B through F under DoD Instruction 5230.24 (DFARS 252.204-7012). The clause's own list of technical information includes:

• Research and engineering data
• Engineering drawings and associated lists
• Specifications, standards, and process sheets
• Manuals, technical reports, and technical orders
• Data sets, studies, and analyses
• Computer software, both executable and source code

A drawing with Distribution Statement A, approved for public release, isn't CTI. The same drawing marked Distribution Statement C or D is.

Export-controlled information. Technical data controlled under export rules such as ITAR or the EAR is its own Registry category (Export Controlled).

Other DoD categories exist, such as DoD Critical Infrastructure Security Information and Naval Nuclear Propulsion Information, but they're far less common in a typical supplier's systems.

Sensitive isn't the test. Contract plus a safeguarding rule is.

How do you tell which one you have?

FCI OR CUI? · 5 CHECKS

1. 01Read the contractIs DFARS 252.204-7012 in it? Is CUI identified?
2. 02Check markingsA CUI banner, or distribution statement B–F
3. 03Look at what you createWork made for the contract can be CUI too
4. 04Rule out the exclusionsPublic and simple transactional info isn’t FCI
5. 05Confirm in writingAsk your prime or contracting officer

Points to Level 1Contract information, not public, no safeguarding rule

Points to Level 2CUI identified, marked, or created under a 7012 contract

Step three catches people out most. DFARS 252.204-7012 covers information "collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract," not only what DoD hands over. If you produce engineering drawings for a contract that involves CUI, your drawings can be CUI too, even before anyone marks them.

The gray areas

• Is CUI also FCI? CUI you handle under a DoD contract is contract information that isn't public, so in practice it's also FCI. That's why Level 2's 110 requirements cover the ground Level 1 does, and more.
• Is our own data CUI? Usually not. The CUI definition excludes information your company holds in its own systems that "did not come from, or was not created or possessed by or for" the government. Your internal designs and business records aren't CUI just because you're a defense supplier.
• The prime sent us drawings with no markings. Don't guess. Unmarked doesn't automatically mean uncontrolled, especially under a contract with DFARS 7012. Ask the prime in writing how the information should be treated, and keep the answer.
• We only quote and invoice. Simple transactional information is excluded from FCI. If that's genuinely all you handle, CMMC may not apply to that work at all.

Why it matters which one you have

Your level follows the information, not your company size or how important the program feels. And the answer also sets your assessment scope: every system, person, and location that handles CUI is in scope for Level 2. Keeping CUI in a smaller, well-defined part of your environment can make Level 2 far more manageable, while everything else stays at the Level 1 baseline.

Not sure what you're holding?

Start with our three-question CMMC level check. It takes a minute and tells you whether Level 1 or Level 2 likely applies. If the answer is "it depends," that's normal: a short scoping conversation with a CMMC Certified Assessor, with your contract and a few sample documents in hand, usually settles it. If it's Level 1, here's what the 15 requirements take.