FCI vs CUI: How to Tell Which Federal Data You Actually Handle

Every small business in federal contracting eventually hits the same confusing moment: someone mentions “CUI” and you’re not sure if that applies to you, or if you’re just dealing with ordinary FCI. Getting this wrong isn’t a paperwork technicality — it determines whether you need basic safeguarding or a full NIST 800-171 implementation, and which CMMC level you’ll eventually need to certify against. Here’s how to actually tell the difference.

FCI: The Baseline That Applies to Almost Every Contract

Federal Contract Information (FCI) is defined by FAR 52.204-21 as information the government provides to you or generates for you under a contract, that isn’t intended for public release. In practice, this covers most of the ordinary substance of doing federal work: contract terms, delivery schedules, performance discussions, and administrative content tied to a specific award. It deliberately excludes information the government has already made public and simple transactional data (like invoice line items).

If you hold almost any federal contract, you’re handling FCI. That’s the baseline — and it triggers CMMC Level 1: an annual self-assessment against the fifteen basic safeguarding requirements in FAR 52.204-21 (things like limiting system access, sanitizing media before disposal, escorting visitors in controlled areas, and keeping systems patched). No POA&Ms (plans of action and milestones) are allowed at Level 1 — you either meet all fifteen requirements or you don’t.

CUI: A Higher Tier That the Government Designates, Not You

Controlled Unclassified Information (CUI) is a specific, higher-sensitivity category defined by 32 CFR 2002.4(h) as information a law, regulation, or government-wide policy requires an agency to protect with safeguarding or dissemination controls. Critically, the government designates what counts as CUI — you don’t get to decide. The official categories live in the NARA CUI Registry, and for defense contractors the most common categories are Controlled Technical Information (drawings, specifications, and technical data carrying a distribution statement) and export-controlled data under ITAR or EAR.

If your contract involves CUI, you’re looking at a materially heavier lift: all 110 security requirements from NIST SP 800-171, flowed down through DFARS 252.204-7012, and eventually CMMC Level 2 — either a self-assessment or a third-party certification, depending on what your specific contract requires. CUI also carries a rapid incident-reporting obligation: a suspected compromise has to be reported to DIBNet within 72 hours, a much tighter clock than most businesses are used to operating under.

How to Actually Tell Which One You’re Handling

A few practical signals help sort this out on a real contract:

• Check the SOW, CDRLs, and contract attachments first. CUI is typically identified upfront in the statement of work or the data item descriptions you’re delivering against — it doesn’t usually show up as a surprise mid-contract.
• Look for markings. Properly designated CUI generally arrives with banners, designation blocks, and distribution statements per DoDI 5200.48. If a document has a distribution statement B through F, that’s a strong CUI signal.
• Don’t assume unmarked data is safe. Export-controlled technical data can be CUI even without a visible marking — the legal obligation comes from the underlying regulation, not from whether someone remembered to stamp the document.
• When genuinely unclear, default to the higher standard and ask. If you can’t tell whether something is CUI, the defensible move is to safeguard it as if it were CUI and get written clarification from the prime or contracting officer, rather than guessing down and being wrong.

Why Getting This Wrong Is Expensive

Under-scoping your obligations — treating CUI like ordinary FCI — is the mistake that actually costs contractors money and eligibility down the line, since it typically surfaces during a CMMC assessment or, worse, after an incident, when self-assessed compliance claims get scrutinized against what you actually protected. Over-scoping (treating everything like CUI when it’s really just FCI) isn’t free either — it means implementing 110 NIST 800-171 controls for data that never actually required them, which is real, avoidable cost and complexity for a small contractor. Getting the classification right the first time, on a contract-by-contract basis, is worth the extra hour of review.

What Comes Next Once You Know Which One Applies

Classification is the first step, not the last one. If your contract involves CUI, you’re building toward the full NIST 800-171 picture — and the practical next steps are documenting your compliance posture in a System Security Plan and Plan of Action & Milestones (our SSP/POA&M template guide walks through both documents), and understanding how your self-assessment score gets calculated and reported (see our SPRS score guide). Either way, it’s worth understanding the broader CMMC certification landscape your contract sits inside, since the classification you land on here determines which CMMC level actually applies to you. And because the annual affirmation that comes with CMMC compliance carries real legal exposure of its own, it’s worth reading how that risk translates into what a cyber insurance policy should actually cover for a federal contractor before you assume a standard policy has you covered.

Key Takeaways

• FCI is the baseline that applies to nearly every federal contract and triggers CMMC Level 1’s fifteen basic safeguarding requirements.
• CUI is a narrower, higher-sensitivity category that the government designates (not the contractor), covering things like controlled technical data and export-controlled information — it triggers the full 110-control NIST 800-171 requirement and CMMC Level 2.
• Check your SOW, CDRLs, and document markings first to determine which category applies to a given contract; don’t assume unmarked technical data is automatically safe.
• CUI carries a 72-hour incident reporting requirement to DIBNet that FCI-only contracts don’t have.
• When it’s genuinely unclear which category applies, default to the higher CUI standard and get written clarification rather than guessing down.

FAQ

Can I decide for myself that information I’m handling counts as CUI?
No — CUI designation comes from the government (law, regulation, or government-wide policy), not from a contractor’s own judgment. Your job is to correctly identify and safeguard CUI that’s already been designated, using the markings and contract documents as your guide, not to designate it yourself.

Does every federal contract involve CUI?
No. Most federal contracts involve FCI (which triggers the lighter CMMC Level 1 requirements) without ever touching CUI. CUI is specific to contracts involving categories like controlled technical data, export-controlled information, or other NARA CUI Registry categories — it’s not automatic just because you’re a federal contractor.

What happens if I mishandle CUI without realizing it was CUI?
Ignorance of a marking doesn’t remove the underlying legal obligation, particularly for export-controlled data that can be CUI even unmarked. This is exactly why defaulting to the higher standard when genuinely unsure, and getting written clarification from the prime or contracting officer, is the safer path than assuming information is just ordinary FCI.