What Is CUI? FCI vs CUI Explained for CMMC Contractors

By The Defense Compliance Report Editorial Team · Last verified June 17, 2026 · Corrections policy

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance — the independent CMMC decision layer for defense contractors. This article is educational, not legal or contractual advice.

Controlled Unclassified Information (CUI) is unclassified information the government — or a contractor acting on its behalf — creates or possesses that a law, regulation, or government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls. Federal Contract Information (FCI) is the broader category — non-public information provided by or generated for the government under a contract. That single distinction is the most expensive call you’ll make in CMMC, because it sets your level before you spend a dollar: handle only FCI, and you’re generally looking at CMMC Level 1; handle CUI, and you’re at Level 2 or higher, built on the 110 security requirements in NIST SP 800-171 Revision 2. So the real question hiding inside “what is CUI” and “FCI vs CUI” was never academic. It’s “Which bucket am I in — and what does that obligate me to do?”

Here’s the part most guides skip. Plenty of contractors get the definitions right and still get the decisionwrong, because of one myth about CUI markings that quietly walks small suppliers into failed prime reviews and lost awards. We’ll name it, and show you the regulation that kills it. First, the fast version you came for.

Last reviewed June 2026

In short: FCI and CUI are two different categories of government information, and which one you handle determines the CMMC level and safeguarding obligations that apply to your contract. That distinction comes from your contract clauses, not a self-assessment. Which path fits your situation varies — use Find My CMMC Path to map it before requesting quotes.

FCI vs CUI at a glance

If you read nothing else, read this: all CUI a contractor holds while performing a federal contract is also FCI, but not all FCI is CUI. That isn’t our opinion — it’s the published position of the government office that runs the CUI program (more on that below). It’s also the line that decides whether your next CMMC step costs a weekend of policy work or becomes a multi-month budget line.

Not sure which bucket your data falls into? Before you price a single tool or call a single vendor, walk your actual contract and data through the FCI/CUI Contract-Triage Matrix further down this page. And one standing rule, because this is a page about CUI: never paste CUI into any web form or tool, including ours.

What is CUI, in plain English?

CUI is unclassified information that still requires protection because a law, regulation, or government-wide policy says so. It is not classified information, and it is not “anything sensitive.” For a defense contractor, CUI is the specific category of information that usually turns a routine CMMC conversation into a Level 2 scoping conversation — the moment your obligations jump from 15 basic safeguards to 110 security requirements.

The federal definition is precise. The CMMC contract clause itself, DFARS 252.204-7021, borrows it word-for-word from the CUI program rule at 32 CFR 2002.4(h): CUI is information the government creates or possesses — or that an entity creates or possesses for or on behalf of the government — that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. We read that clause directly on Acquisition.gov to confirm the language still matches the underlying rule. It does.

Two things follow from that definition, and both save contractors money.

CUI is not “everything sensitive in the building”

Your pricing strategy, your internal HR files, your trade secrets, your CEO’s email — none of that is automatically CUI. CUI has to trace back to an authorized category with a legal basis. If you can’t point to the category and the authority, you’re probably not looking at CUI. It’s easy to over-scope by treating every confidential document as CUI, then paying to protect data the government never asked you to protect.

The NARA CUI Registry is the only list that counts

There is exactly one authoritative, government-wide list of what qualifies as CUI: the CUI Registry, maintained by the National Archives and Records Administration (NARA). It names the categories, subcategories, markings, and legal authorities. If a category isn’t in that Registry, it isn’t CUI. When a prime or a vendor tells you something “is CUI,” the right reflex is to ask which Registry category and which authority — and then check it yourself.

CUI Basic vs CUI Specified (the 30-second version)

CUI Basic is the default — the standard handling authorized holders apply unless the CUI Registry flags the information as CUI Specified, where the underlying law or regulation spells out stricter or more specific controls. You don’t need to master this distinction to figure out your CMMC level; you need to know it exists, so that when a marking reads “CUI//SP-” you don’t treat it like ordinary CUI. Your markings and the Registry tell you which is which.

Use this as your CUI gut-check before you scope anything:

What is FCI, in plain English?

FCI is non-public information provided by or generated for the government under a contract to develop or deliver a product or service. It’s broader than CUI, and it has two clean carve-outs: information the government already made public, and simple transactional information such as the data needed to process a payment.

That definition comes straight from FAR 52.204-21 (“Basic Safeguarding of Covered Contractor Information Systems”). We pulled the clause text on Acquisition.gov to confirm the carve-outs are still exactly those two. They are.

Here’s the practical reality almost every defense contractor misses: if your systems process, store, or transmit any non-public information generated for or provided by the government under the contract, you have FCI. The only carve-outs are information the government already made public and simple payment-processing data. For most contractors, that means FCI is the floor, not a special category.

FCI examples a real contractor recognizes

• Non-public contract documents and award paperwork
• Delivery and production schedules tied to a contract
• Internal emails coordinating contract performance
• Non-public statement-of-work or task-order details
• Prime/subcontractor coordination that isn’t public

What is not FCI

• Information the government posts publicly (a public solicitation on SAM.gov, content on a public website)
• Simple transactional data — the basics needed to process a payment, by themselves

One detail that trips people up: there is no “FCI Registry”

Unlike CUI, FCI has no government-wide list of categories or markings. You identify FCI by context— is this non-public information tied to a federal contract? — and by the presence of FAR 52.204-21 in your agreement. That absence of a marking scheme is exactly why the “if it’s not marked, it’s not regulated” instinct is so dangerous, and why we keep pointing you back to the contract instead of the file.

And FCI is not a free pass. Handling FCI on your systems can trigger CMMC Level 1, because CMMC applies to contractor systems that process, store, or transmit FCI or CUI.

What is the difference between FCI and CUI?

The difference is sensitivity and authority. FCI is the broad bucket of non-public contract information, defined by the FAR. CUI is the controlled subset that needs stronger protection, defined by Executive Order 13556, the CUI program rule at 32 CFR Part 2002, and the NARA Registry. For CMMC, that line is the difference between Level 1 (15 safeguards) and Level 2 (110 requirements in NIST SP 800-171 Rev. 2).

The mental model that keeps you out of trouble

Think of it as nested rings:

Public information → FCI → CUI → high-sensitivity CUI (Level 3 territory)

Example CUI data flow through contractor environments. Click to jump to the Contract-Triage Matrix ↓

The government’s own CUI authority states the relationship plainly. NARA’s Information Security Oversight Office (ISOO) — the office that administers the CUI program — has published that all CUI in a contractor’s possession is FCI, but not all FCI is CUI. We cite that not as trivia but because it resolves the single most common argument in a CMMC kickoff meeting: yes, your CUI is also FCI; no, your routine FCI is not automatically CUI.

Why the difference is a money decision, in both directions

This is where it stops being vocabulary and starts being budget. Get the call wrong one way — under-scoping— and you treat CUI like FCI, miss Level 2 obligations, and risk failing a prime’s review or a future assessment. Get it wrong the other way — over-scoping— and you treat ordinary FCI like CUI, then pay to migrate everything into a high-security environment you didn’t need. Both mistakes are expensive. Only one of them is loud enough to notice before the invoice arrives.

The FCI vs CUI Contract-Triage Matrix

Definitions don’t fail contractors. Applicationdoes. You’re not holding a definition — you’re holding a drawing, an invoice, a flow-down email, a shared drive full of mixed documents — and you need to know what it means for your CMMC level before you hire anyone.

So here’s the asset we built that you won’t find on a competitor’s page: a triage matrix that maps the real things you’re actually looking at to a likely bucket, the CMMC implication, where to verify it, and — just as important — what not to do yet. We built it by cross-checking each row against the controlling sources cited throughout this page — FAR 52.204-21, DFARS 252.204-7012, the NARA CUI Registry, and 32 CFR Part 170.

This is guidance to scope your thinking, not a determination. Your contract language, your CUI markings, and your contracting officer are the authorities.

How does FCI vs CUI determine your CMMC level?

Your CMMC level starts with the information you process, store, or transmit — not your size, your revenue, or your preference. FCI-only work generally points to CMMC Level 1. CUI points to Level 2 at minimum. Level 3 is reserved for the most sensitive CUI on the highest-priority programs, layering selected NIST SP 800-172 requirements on top of Level 2. The CMMC program rule, 32 CFR Part 170, became effective December 16, 2024, and ties the whole model to safeguarding FCI and CUI.

A few clarifications we make on every Level conversation, because blurring them is how people overpay or under-protect:

Level 1 is not “no compliance”

It’s 15 basic safeguarding requirements from FAR 52.204-21, an annual self-assessment, and an annual affirmation posted in the Supplier Performance Risk System (SPRS — the DoD database where assessment results and affirmations live). There’s no plan-of-action-and-milestones (POA&M) allowance at Level 1: you meet all 15, or you’re not compliant.

Level 2 is not automatically a C3PAO assessment

This is the single most common panic we see contractors arrive with. A C3PAO is a Certified Third-Party Assessment Organization — an independent assessment organization authorized or accredited by the Cyber AB to conduct CMMC Level 2 certification assessments. But Level 2 can be a self-assessment or a C3PAO assessmentdepending on what your contract requires. The assessment type changes your cost and timeline dramatically, so don’t assume the expensive path before you’ve read the clause that sets it.

Why NIST SP 800-171 Revision 2 — not Revision 3 — is the standard for CMMC

If you’ve seen headlines about NIST SP 800-171 Revision 3, set them aside for CMMC purposes. We confirmed this against the program rule itself: 32 CFR 170.5 states that CMMC verifies implementation of FAR 52.204-21, NIST SP 800-171 Revision 2, and NIST SP 800-172 (Feb 2021), as applicable. For CMMC Level 2 today, Rev. 2’s 110 requirements across 14 control families are the controlling set — unless and until DoD amends the rule. Don’t let a vendor scope you to Rev. 3 because it’s newer.

What phase of CMMC are we in right now?

As of June 17, 2026, CMMC Phase 1 is active — it runs November 10, 2025 through November 9, 2026 — and focuses primarily on CMMC Level 1 and Level 2 self-assessments. Per the DoD CIO and 32 CFR 170.3(e), Phase 2 begins November 10, 2026, when applicable solicitations will start requiring Level 2 (C3PAO) certifications.

The phased rollout matters for your timing. During Phase 1, where applicable, solicitations require a Level 1 or Level 2 self-assessment as a condition of award — though DoD may, at its discretion, require a Level 2 (C3PAO) assessment on a given contract even now. The contract requirement was made enforceable by the DFARS rule, which was published September 10, 2025 and took effect November 10, 2025. Translation: if you handle CUI and you’ll be bidding into Level 2 (C3PAO) contracts, the runway to get assessed is shrinking, and C3PAO capacity is finite. That’s not a scare tactic — it’s the schedule.

Which contract clauses tell you FCI or CUI is in scope?

The fastest way to stop guessing is to inspect the solicitation, contract, and flow-down package for specific clauses and markings. FAR 52.204-21 signals FCI. DFARS 252.204-7012 is a strong CUI signal. The 7019/7020 clauses concern your NIST SP 800-171 score in SPRS. And as of the DFARS rule effective November 10, 2025, DFARS 252.204-7021 (in contracts) and DFARS 252.204-7025 (a notice in solicitations) tie your required CMMC status to award eligibility. We pulled each from Acquisition.gov to confirm titles and effective dates. Here’s the map.

Ask, don’t assume: two clarification emails you can send today

When the contract is ambiguous, the professional move — and the one that protects you in a dispute — is to get the answer in writing. Copy, adapt, and send.

To your contracting officer or prime (data-type confirmation):

To a prime that asserted “Level 2” with no CUI package (flow-down traceability):

Real examples: when is something FCI vs CUI?

A file’s label alone often isn’t enough. The content, the contract, the marking, the Registry category, and the legal authority decide it together. The examples below show the patterns we see most, but your contract and your government or prime clarification always control the final call.

We’ll be straight with you: no web page — not ours, not anyone’s — can definitively classify your specific file from a one-line description. The same drawing can be public, FCI, or CUI depending on the contract behind it, the marking on it, the technical content inside it, and the legal authority that governs it. Anyone who promises a universal answer to “is a drawing CUI?” is selling certainty they don’t have.

What we can hand you is the same triage a good readiness team runs in its first week — the matrix above, plus the category patterns below — so you walk into any conversation scoped instead of guessing.

Engineering drawings and technical packages

Controlled Technical Information (CTI) is a category in the NARA CUI Registry, and DFARS 252.204-7012 ties it to technical data with military or space application that’s subject to controls on access, use, reproduction, release, disclosure, or dissemination — research and engineering data, drawings, specifications, manuals, technical reports, and source code among the examples. Not every drawing is automatically CTI. But because so many DoD and prime technical packages are, the safe operating assumption is to protect a drawing until a marking, distribution statement, or written answer confirms its status.

Export-controlled data

The CUI Registry includes an Export Controlled category for unclassified information governed by export-control laws (ITAR/EAR). Important nuance: export control is not a CMMC level. It adds foreign-person access restrictions on top of whatever CMMC level applies. Handle both, separately.

SBIR/STTR information

The Registry includes a Small Business Research and Technology category, which relates to certainSBIR/STTR information in a government database. Don’t assume every SBIR/STTR file is CUI under that category from the data-rights legend alone. Your SBIR/STTR technical deliverables may still be CUI under another category — Controlled Technical Information or Export Controlled — so check the content, not just the program.

Source-selection information

The Registry includes a Source Selection category, tied to information prepared for an agency’s evaluation of bids or proposals and not publicly released. Your own internal prime-to-subcontractor evaluation records are not automatically Source Selection CUI unless they’re tied to an applicable authority, contract requirement, or flow-down.

What if the file is unmarked, badly marked, or came from a prime?

Don’t assume a file is safe just because it’s unmarked — and don’t assume everything is CUI just because a prime is nervous. Marking matters, but the rules also recognize that a missing marking does not automatically release an authorized holder from safeguarding obligations. This is the myth we promised to kill.

The marking myth: “if it’s not marked CUI, it’s not CUI”

Here’s why that belief fails contractors. DFARS 252.204-7012 defines Covered Defense Information as unclassified Controlled Technical Information or other information described in the CUI Registry that requires safeguarding or dissemination controls — and that reaches you by one of two paths:

That second path is the one people forget. An unmarked technical file you generated under the contract can still require protection when it meets the CDI definition. We confirmed this against the clause text on Acquisition.gov.

The government is supposed to mark and identify CUI. In the real world, markings get missed, especially on legacy programs and in subcontractor packages. So the absenceof a CUI marking is not proof you’re FCI-only. When the contract, the technical content, or the flow-down suggests CUI, escalate and ask in writing before you assume Level 1.

Over-marking is a problem too

If you swing the other way and treat everythingas CUI, you inflate your Level 2 boundary, trigger an unnecessary migration to a high-security environment, and buy tooling you don’t need. It’s common for companies to fund a full secure-cloud migration to protect data the government never controlled. Precision saves money in both directions.

The rule that keeps you safe: get it in writing

When data is ambiguous, ask the prime or contracting officer for written clarification (the email scripts above do this in 30 seconds). Document the question and the answer. It’s the cheapest insurance in CMMC, and it’s the record you’ll want if a determination is ever challenged. None of this is legal advice — when the stakes are high, loop in counsel.

Is all CUI FCI? Is all FCI CUI?

For contractor decision-making: yes, the CUI you handle while performing a federal contract is also FCI — but no, your routine FCI is not automatically CUI. CUI is the controlled, higher-sensitivity subset inside the broader universe of non-public contract information. That’s the published position of NARA’s Information Security Oversight Office, the office that administers the CUI program.

The practical payoff is avoiding the two opposite mistakes one more time, because this is the question your whole budget hinges on:

• Under-scoping: treating CUI like FCI, missing Level 2, and failing a prime review or assessment.
• Over-scoping: treating ordinary FCI like CUI, and buying a bigger solution than your contract requires.

Hold the mental model — public → FCI → CUI → high-sensitivity CUI— and you’ll resist both.

Does CUI mean you need GCC High, GovCloud, or a CUI enclave?

No — CUI does not automatically require Microsoft GCC High, AWS GovCloud, or any single product. It requires that the systems which process, store, or transmit CUI meet the applicable NIST SP 800-171 Rev. 2 safeguards. The right architecture depends on your scope, your users, your cloud services, export-control issues, and what your contract actually requires. Product choice is the last decision, not the first.

We bring this up because “CUI means GCC High” is the most expensive assumption in the niche, and vendors have every incentive to let it ride. Here’s the order that protects your budget.

The four decisions, in order

1. Identify your CUI. What is it, and which Registry category and authority cover it?
2. Map your data flows. Where does that CUI actually live and travel — email, file shares, ERP, ticketing, endpoints, portals?
3. Draw your CMMC boundary. Which systems are in scope, and which can stay out?
4. Choose architecture. Now decide between an enclave, a managed compliance environment, or a broader Microsoft 365 / GCC High implementation.

Match the architecture to your CUI footprint

There’s a real cloud nuance to know, not fear: DFARS 252.204-7012 includes requirements for cloud service providers handling covered defense information, including FedRAMP Moderate (or equivalent) language. That can point toward a government-community cloud for some contractors — but it’s a consequence of your scope and contract, not an automatic mandate for everyone who touches any CUI.

Can you cut CMMC cost by separating FCI and CUI systems?

Often, yes — but only if the CUI boundary is real, documented, and actually enforced. CMMC Level 2 scoping (defined in 32 CFR 170.19) sorts your environment into asset categories tied to where CUI and its protections live. Careless data mixing pulls far more systems into scope than contractors expect, and that’s where Level 2 budgets balloon.

The cost mistake

Buying a broad Level 2 environment before confirming whether CUI is limited to one team, one project, or one data flow. Scope first, then spend.

The scope mistake

Letting CUI sprawl — into general email, open shared drives, helpdesk tickets, CRM, accounting attachments, and unmanaged laptops. Every place CUI lands becomes part of the boundary you have to assess and protect.

The operating rule

“Compliance follows the data” is a useful phrase, and the scoping rule at 32 CFR 170.19 is the reason it’s true: your boundary is defined by where CUI and its security protections actually are. Contain the data, and you contain the cost. (When you’re ready to put numbers to it, our CMMC Level 2 cost breakdown walks through what drives the range.)

What should subcontractors do when a prime flows down Level 2?

Don’t ignore a Level 2 flow-down — but don’t silently accept a vague one either. Under 32 CFR 170.23, a subcontractor’s requirement depends on whether it processes, stores, or transmits FCI or CUI and on the prime contract’s required status. A sub handling only FCI can be set at Level 1; a sub handling CUI must be at least Level 2. As of the November 10, 2025 DFARS rule, the 252.204-7021 clause flows down to subcontracts that will involve FCI or CUI, and subs post their own status in SPRS.

The most useful thing we can give a subcontractor is the set of questions that turn a vague demand into a scoped requirement.

What to do next if you think you have CUI

Don’t start by buying software or calling a C3PAO. Start by collecting evidence, so your next conversation is scoped instead of speculative. Here’s the order we recommend, and each step is small enough to do this week.

Step 1 — Save the contract evidence

Solicitation CMMC language · FAR/DFARS clauses · flow-down language · CUI-marked attachments · distribution statements · technical-data-package cover pages · written prime/CO clarifications.

Step 2 — Map where the data lives

Email · file shares and cloud storage · engineering tools · ERP/accounting (and their attachments) · ticketing/helpdesk · laptops and endpoints · contractor/sub portals.

Step 3 — Sort into three buckets

1. Confirmed CUI (marked, or clearly within a Registry category and authority)
2. Possible CUI (needs written clarification)
3. FCI-only / non-CUI contract data

Step 4 — Choose the right provider category (not yet a specific vendor)

One independence note that protects you: readiness and remediation help must stay appropriately separated from your formal C3PAO assessment. The team that fixes your gaps generally should not be the team that certifies them. And no software, by itself, makes you CMMC compliant — it supports the work; it doesn’t replace it.

What we verified for this guide

This guide is built from primary and authoritative sources, not paraphrase. On June 17, 2026, we read the controlling clause, rule, and Registry text directly and recorded what each one says. The triage matrix and the decision tables are our editorial synthesis — useful for scoping, not a legal determination or a government decision. (More on how we work: our editorial standards.)

What we checked, and where:

• FCI definition + 15 safeguards — FAR 52.204-21 (Acquisition.gov)
• CUI definition + program — Executive Order 13556; 32 CFR Part 2002; the NARA CUI Registry (32 CFR 2002.4(h), echoed in DFARS 252.204-7021)
• Covered Defense Information, two-path definition + 72-hour reporting — DFARS 252.204-7012 (Acquisition.gov)
• CMMC level/assessment mapping + Rev. 2 confirmation — 32 CFR Part 170; 32 CFR 170.5 (NIST SP 800-171 Rev. 2 and NIST SP 800-172, Feb 2021)
• CMMC contract + solicitation clauses, effective dates — DFARS 252.204-7019, 7020, 7021, 7025 (Acquisition.gov; effective November 10, 2025)
• Phase timing — DoD CIO CMMC page and 32 CFR 170.3(e): Phase 1, Nov 10, 2025 – Nov 9, 2026; Phase 2 begins Nov 10, 2026
• Scoping, flow-down, POA&M — 32 CFR 170.19, 170.23, 170.21
• Rule timeline — 32 CFR Part 170 effective December 16, 2024; the DFARS CMMC rule published September 10, 2025, effective November 10, 2025

Frequently asked questions: CUI vs FCI

Most FCI vs CUI confusion comes from trying to classify a single file without its contract context. The reliable approach is to combine the definition, the Registry category, the marking, the clause, the data flow, and a written clarification before you settle your CMMC level or pick a provider path.

Which provider category fits your situation

• If you handle only FCI,you’re generally at CMMC Level 1 and can often self-serve the 15 FAR 52.204-21 safeguards and the annual self-assessment — many small suppliers don’t need a paid provider to start.
• If you handle CUI,you’re at Level 2 or higher, and a Registered Provider Organization (RPO) / Registered Practitioner (RP) or an MSSP (Managed Security Service Provider) can help you scope CUI, map data flows, and implement the 110 NIST SP 800-171 Rev. 2 requirements.
• If your contract requires a Level 2 C3PAO assessment, a C3PAO (Certified Third-Party Assessment Organization) conducts the formal assessment — engage one once you’re assessment-ready.
• If CUI is scattered across email, file shares, and laptops, a CUI enclavecan shrink what’s in scope before you spend on broader remediation.
• You don’t need a C3PAO yet ifyou’re still unsure whether you hold FCI or CUI — clarify your data type, scope, and clauses first.