Technical Guide #3: How to Determine Whether You Handle FCI or CUI

By Josh Hammer

Get the answer wrong and you may build an unnecessarily expensive environment. Get it wrong in the other direction and you may fail to protect information that your contract requires you to safeguard.

Many small contractors make the same assumption: “We probably do not handle CUI.” That conclusion is often based on the fact that they do not operate a classified network or receive documents visibly labeled “CUI.” Neither fact is enough.

This guide gives you a practical way to determine what information your organization handles and what that means for CMMC scope.

Start with the definitions

What is Federal Contract Information?

Federal Contract Information, or FCI, is information that is provided by or generated for the government under a contract to develop or deliver a product or service to the government and is not intended for public release.

FCI can exist in any medium. It may be in an email, drawing, spreadsheet, project-management system, file share, paper document, or cloud application.

The definition excludes information that the government has provided to the public, such as information on a public website. It also excludes simple transactional information necessary to process payments. For example, an invoice number by itself may not be FCI. An invoice containing detailed contract performance information may require a closer review.

The exact scope depends on the contract, the information involved, and whether the government has lawfully made the information public. The governing definition appears in FAR 52.204-21 and the CMMC scoping rules in 32 CFR § 170.19.

What is Controlled Unclassified Information?

Controlled Unclassified Information, or CUI, is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that requires safeguarding or dissemination controls under law, regulation, or government-wide policy.

The word “unclassified” matters. CUI is not classified national security information. It is information that must receive special protection even though it is not classified.

Examples can include controlled technical information, export-controlled information, privacy information, sensitive acquisition information, and other categories listed in the government’s CUI program.

The relationship between FCI and CUI

The most important sentence in this guide is:

All CUI is FCI, but not all FCI is CUI.

Read that carefully.

FCI is the broader category. It covers non-public information provided by or generated for the government under a contract.

CUI is a narrower category within that broader group. It is FCI that also requires safeguarding or dissemination controls under a law, regulation, or government-wide policy.

A non-public project schedule may be FCI without being CUI. A technical drawing containing controlled technical information may be both FCI and CUI.

For CMMC purposes:

• FCI only generally points to CMMC Level 1.
• CUI points to at least CMMC Level 2.
• A contract involving especially sensitive information may require Level 3.

Do not make the level decision based on the name of your industry. Make it based on the information you receive, create, store, transmit, or use while performing the contract.

The five-step FCI and CUI decision walkthrough

Step 1: Inventory what the government gives you and what you create for it

Begin with the information itself.

Do not start by choosing a compliance platform. Do not start by asking whether your Microsoft 365 tenant is secure. First, determine what information exists and where it moves.

Create a spreadsheet with columns for:

• Contract or subcontract
• Information type
• Source
• System or location
• Marking
• Preliminary classification
• Questions or assumptions
• Person responsible for confirmation

List the artifacts you receive from the government or prime contractor, as well as the artifacts your organization generates during performance.

Include items such as:

• Architectural or engineering drawings
• Technical specifications
• Statements of work
• Contract data requirements
• Delivery schedules
• Testing data
• Maintenance records
• Program timelines
• Performance data
• Invoices with line-item detail
• Correspondence about requirements
• Change orders
• Inspection results
• Equipment configuration information
• Work orders and service reports

You may find that your organization handles more government information than expected. A construction company may not think of itself as a “data handler,” but if it receives a government drawing, stores it in a project folder, sends it to a subcontractor, and uses it to perform the work, it is handling that information.

Step 2: Ask three questions about every artifact

For each item in your inventory, ask these questions in order.

Question 1: Where did it come from?

Ask:

Did this information come from the government, or did we create it for a government contract?

If the answer is yes, continue the review.

Information does not stop being relevant because it was created internally. A report your team prepares for the government may be FCI even though the government never sent you the original file.

Question 2: Is it marked?

Open the document, email, drawing, or system record. Check the first page, header, footer, file name, cover sheet, and document properties.

Look for:

• A CUI banner
• A CUI designation indicator
• A CUI category
• Distribution instructions
• Export-control markings
• Contract-specific handling instructions
• A DD Form 254 or similar security direction
• Language in the statement of work identifying protected information

If the information is marked CUI, treat that marking seriously. Do not remove it when copying, converting, or sending the information.

Question 3: If it is marked, how is it marked?

The marking may identify the category or a specified program. A CUI marking may include a banner and a category marking such as:

CUI//SP-PROCURE

or another category appropriate to the information.

Do not assume every CUI document will use the same category. The marking depends on the information and the applicable safeguarding or dissemination authority.

Also record documents that are not marked. An unmarked document is not automatically non-CUI. That brings us to the next step.

Step 3: Review the contract clauses

Open the solicitation, prime contract, subcontract, task order, and relevant flow-down documents.

If the documents are PDFs, use Ctrl+F or Command+F and search for these clause numbers:

• FAR 52.204-21
• DFARS 252.204-7012
• DFARS 252.204-7019
• DFARS 252.204-7020

FAR 52.204-21 contains the basic safeguarding requirements for systems that process, store, or transmit FCI. Its presence is a strong signal that FCI is part of the contract environment.

DFARS 252.204-7012, titled “Safeguarding Covered Defense Information and Cyber Incident Reporting,” is a strong signal that you may handle CUI or covered defense information. Review the full clause and its definitions rather than relying only on the clause title.

DFARS 252.204-7019 and 252.204-7020 address NIST SP 800-171 assessment and the associated assessment score requirements. Their presence is another important signal that the contract expects protection of information covered by the NIST SP 800-171 framework.

Do not use a clause search as your only analysis. A clause is an indicator. Your inventory and the contract’s data-handling instructions still matter.

Step 4: Ask the prime contractor or contracting officer

This is the step many contractors skip because they worry that asking will make them appear unprepared.

Ask anyway.

Use a short, specific written request. For example:

Please confirm which categories of CUI are involved in this subcontract, how the information will be marked, which systems or portals will be used to transmit it, and whether our company will create CUI during performance.

Also ask:

• Will we receive CUI directly from the government or only from the prime?
• Are drawings, specifications, test data, or maintenance records CUI?
• Are we required to apply CUI markings to information we create?
• Are there contract-specific dissemination restrictions?
• Are subcontractors allowed to receive the information?
• Which systems are authorized for storage and transmission?

You are not being difficult by asking these questions. The Department of Defense has acknowledged that inconsistent CUI designation and marking practices create operational friction across the defense supply chain. DoD CIO feedback summarized in a September 2026 DefenseScoop report identified government CUI designation and marking practices as a primary operational challenge. Industry recommendations included more disciplined CUI and portion marking and clearer guidance for common data types.

That means ambiguity is a known problem. Documenting your questions is part of responsible scoping.

Step 5: Document your conclusion

Write down your conclusion for each contract and information type.

Your record should state:

• What information you reviewed
• Where it came from
• Whether it was marked
• Which contract clauses apply
• What the prime or contracting officer confirmed
• Whether you create new information during performance
• Which systems handle the information
• What assumptions remain unresolved
• Who approved the conclusion
• The date of the decision

An undocumented scoping decision is indistinguishable from a guess six months later.

Revisit the decision when a new task order arrives, the prime changes the data portal, you add a subcontractor, or your team starts creating new technical or performance information.

Three common misjudgments

“We only build things. We do not handle data.”

False.

If the government sends you a drawing, you handle at least FCI if the drawing is not intended for public release. If the drawing contains controlled technical information or another protected category, it may be CUI.

The physical work and the information work are connected. A field technician viewing a controlled work package is handling information even if the technician never edits the file.

“Nothing we receive is marked, so it cannot be CUI.”

False.

Marking practices are inconsistent. DoD has identified inconsistent designation and marking as a known supply-chain problem. The absence of a CUI marking is not proof that the information is outside CUI scope.

That does not mean you should label everything CUI without analysis. It means you should review the contract, the information’s content, the applicable category, and the government or prime’s instructions.

“Our IT provider handles all that.”

Your IT provider may operate systems, collect logs, manage endpoints, or support security controls.

That does not transfer your contractual responsibility.

Outsourcing a function is not the same as outsourcing accountability. You still need to know what data your provider can access, where it is stored, what services are in scope, and how the provider supports your evidence and incident-response obligations.

The reverse error: “We handle everything, so we need Level 2 everywhere.”

Over-scoping is also expensive.

Some organizations place every employee, device, application, facility, and business process into the highest-security environment “just to be safe.” That can increase cost and make the compliance program harder to operate.

A properly designed enclave can separate the systems, people, and workflows that handle CUI from the rest of the business. The goal is not to avoid requirements. The goal is to identify the correct scope and apply the correct requirements to it.

The enclave approach is covered in Technical Guide #4.

What changes based on your answer?

If you handle FCI only

FCI-only systems generally fall under CMMC Level 1. For a practical walkthrough, see how to get CMMC Level 1.

Level 1 includes the 15 basic safeguarding requirements in FAR 52.204-21. The organization completes an annual self-assessment, enters the result in SPRS as part of getting access to SPRS, and obtains the required senior-official affirmation.

Level 1 does not permit a POA&M for unmet requirements. The 15 requirements must be met when you make the assessment. Assessment evidence must be retained for six years.

Level 1 is not a third-party certification assessment. It is a self-assessment and affirmation process.

If you handle CUI

Systems that handle CUI generally fall under CMMC Level 2, unless the contract specifies a higher level.

Level 2 is aligned with NIST SP 800-171 Rev. 2, which contains 110 requirements across 14 families. The assessment process involves documenting implementation, evaluating the requirements, maintaining the associated assessment record and SPRS score, and writing your System Security Plan.

Depending on the contract and the CMMC phase, Level 2 may involve a self-assessment or a third-party assessment. As of September 2026, the Department of Defense has paused the Phase II third-party assessment requirements while it reviews and reforms the program. That pause does not eliminate the underlying obligations in DFARS 252.204-7012 or the requirement to implement NIST SP 800-171 where the contract requires it.

In practical terms, “the third-party assessment is paused” does not mean “CUI protection is optional.”

If you handle both

If your environment handles FCI and CUI, the CUI scope generally drives the more demanding requirements for the systems and assets involved.

That does not mean every company system automatically needs to be a Level 2 system. It means you must define the environment accurately, document the relationships between systems, and determine which assets process, store, transmit, or protect CUI.

That is where an enclave strategy can reduce unnecessary scope.

Printable “Decide Your Level” checklist

Work through these questions for each federal contract or subcontract:

1. We listed every federal contract, subcontract, task order, and relevant flow-down clause.
2. We searched the contract documents for FAR 52.204-21.
3. We searched for DFARS 252.204-7012, 252.204-7019, and 252.204-7020.
4. We inventoried the government information we receive.
5. We inventoried the information we create for or on behalf of the government.
6. We checked each artifact for CUI banners, category markings, and dissemination instructions.
7. We identified where each artifact is stored, processed, and transmitted.
8. We asked the prime or contracting officer which CUI categories are involved and whether we will create CUI.
9. We documented our conclusion, assumptions, unresolved questions, and approval date.
10. We scheduled a review of the decision when the contract, data flow, system, or subcontractor changes.

The tool comes after the audit and the plan

The hard part of this question is not memorizing the definitions. It is building the inventory behind them and keeping that inventory accurate as contracts, systems, and data flows change.

Sources

• FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information Systems
• 32 CFR § 170.19 - CMMC scoping requirements
• DefenseScoop - DoD CIO says CMMC reform will ease burden as officials grapple with CUI marking friction
• DoD Level 1 Scoping Guide

Read next in this series: Technical Guide #4: How to Map Your CUI Boundary, Technical Guide #1: How to Get CMMC Level 1, and the free readiness check.

Complynt is an enterprise compliance automation platform for control mapping, evidence collection, continuous monitoring, pre-built content packs, and policy-as-code. It supports mapping across more than 150 frameworks, including CMMC, NIST SP 800-171, NIST SP 800-53, RMF, SOC 2, HIPAA, and ISO 27001. Complynt runs on Palantir’s federal cloud environment with FedRAMP High and DoD IL5 authorizations. H&V is EDWOSB certified.

H&V does not issue certification and cannot guarantee any assessment outcome. The correct sequence is audit first, plan second, tools third. If you want a starting point, use the free compliance readiness check or visit hvfsusa.com.