FCI vs CUI: Which One Do You Actually Handle?

Most defense contractors handle Federal Contract Information. A much smaller number handle Controlled Unclassified Information. The difference decides how many security requirements you owe — 17 or 110 — so it is worth getting right before you spend anything.

Federal Contract Information is defined in FAR 52.204-21. It is information not intended for public release, provided by or generated for the government under a contract to develop or deliver a product or service. It does not include information the government makes public, and it does not include simple transactional data like payment details. In practice, if you hold a federal contract at all, you almost certainly hold FCI — a statement of work, a delivery schedule, correspondence about requirements.

Controlled Unclassified Information is narrower and more consequential. It is defined under 32 CFR Part 2002, it must map to a category in the National Archives CUI Registry, and in a defense context it typically arrives with DFARS 252.204-7012 attached. Technical drawings, specifications, and export-controlled data are the common examples.

The short test: FCI is about the contract. CUI is about the information itself.

Why the difference decides your level

The 17 requirements at Level 1 are the basic safeguarding controls in FAR 52.204-21 — limit system access, authenticate users, sanitise media before disposal, and so on. They are the sort of thing a competently run small business may already be doing.

The 110 requirements at Level 2 are a different order of effort. They come from NIST SP 800-171 Revision 2, and assessors test them against the 320 assessment objectives in NIST SP 800-171A rather than at the requirement level. “We use multi-factor authentication” is a requirement-level claim; it fails when the objectives underneath it are examined.

The 17 requirements FCI actually brings

Level 1 is not a vague obligation. FAR 52.204-21 lists fifteen basic safeguarding requirements, which CMMC Level 1 expresses as seventeen practices across six families. They are worth reading in full, because most competently run businesses already satisfy several without having framed them this way.

Compare that with Level 2’s 110 requirements across fourteen families, and the gap becomes concrete rather than rhetorical. Level 1 has no audit and accountability family at all, no configuration management, no incident response, no risk assessment, no personnel security, no maintenance family, and no security assessment. Those seven families appear only once CUI is in scope.

How the obligations differ in practice

Beyond the count, three operational differences matter more than most contractors expect.

Self-assessment cadence and record. Level 1 is an annual self-assessment with an affirmation. Level 2 requires assessment against all 110 requirements and a score posted to SPRS under DFARS 252.204-7019 and 7020 — a number the government reads, relies on, and can act against if it is wrong.

Documentation. Level 1 does not require a System Security Plan. Level 2 does, under requirement 3.12.4 — the only unscored requirement in the standard, and the one whose absence means an assessment cannot be completed at all. That asymmetry catches people out; see the SSP template.

Evidence. Level 1 is largely an attestation. Level 2 is assessed against the 320 objectives in NIST SP 800-171A, each of which expects an artefact. The practical difference is between saying you do something and being able to show it.

Worked examples

Two companies on the same industrial estate, both machine shops, both holding DoD subcontracts.

The first makes commercial fasteners to a published specification. Its contracts carry FAR 52.204-21 but no DFARS 252.204-7012. It receives purchase orders, delivery schedules and quality requirements — all FCI, none of it CUI. It is a Level 1 organisation, owes 17 practices, and should not be sold a Level 2 programme.

The second machines a part to a drawing supplied by a prime, marked with a distribution statement. That drawing is Controlled Technical Information. Its contract carries 252.204-7012. It is a Level 2 organisation, owes all 110 requirements, and its scope is set by wherever that drawing travels — the mailbox it arrived in, the file share it was saved to, the ERP record it was attached to, and the printout beside the machine.

The second company’s obligation is not driven by its size, its industry or its revenue. It is driven by one drawing.

Common mistakes

• Assuming industry decides. There is no list of industries that handle CUI. Two machine shops on the same street can have entirely different obligations depending on what is in their contracts.
• Treating “sensitive” as the test. Commercial confidentiality between private parties is not CUI. The information needs an underlying legal authority.
• Assuming a customer’s marking settles it. A prime can mark a document CUI incorrectly. The category has to exist in the Registry. That said, an incorrect marking may still create a contractual obligation, so raise it rather than ignoring it.
• Forgetting flow-down. Subcontractors are frequently in scope through clauses passed down from a prime, even when they have no direct DoD contract.

If you handle both

You almost certainly do, and that is normal. The practical consequence is that your Level 2 scope is set by where the CUI is, not by where the FCI is. Drawing that boundary well is the difference between hardening one enclave and hardening your whole network — see finding CUI in your environment.

If you want a scored picture of where you stand against all 110 requirements, that is what a readiness assessment produces.

If you hold only FCI, the obligation is the 17 CMMC Level 1 practices. If you hold CUI, it is the 110 CMMC Level 2 requirements.