FCI vs CUI: which one does your shop hold?
Published 2026-10-22
FCI is any contract information the Government has not made public, minus payment paperwork FAR 52.204-21(a). CUI is the part of it that a law, regulation or Government-wide policy says must be controlled 32 CFR 2002.4(h). The difference decides your CMMC level: a subcontractor that only holds FCI needs Level 1 (Self), one that holds CUI needs Level 2 (Self) at minimum 32 CFR 170.23(a).
A DoD purchase order is usually FCI the day it arrives. The real question is whether a marked drawing came with it. If you already know your answer and want the level, the CMMC level finder takes it from here.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Not public, provided by or generated for the Government under the contract.
The FCI a law, regulation or Government-wide policy says to control, in a CUI Registry category.
CUI whose authority sets its own handling. A drawing with Distribution Statement B to F lands here.
Crosses the line. Received under the contract, it is CUI too. Your own commercial export data is not CUI, and ITAR still binds it.
The two definitions, word by word
CMMC does not define either term itself. Part 170 points to the FAR for FCI and to the CUI rule, 32 CFR Part 2002, for CUI. Here are both, in their own words.
Put side by side, FCI has three tests and CUI adds one. Run them in this order on any document in the shop:
- 01
Has the Government made it public?
Then it is neither. The FCI definition leaves out information the Government gives the public, such as a solicitation on a public website.
FAR 52.204-21(a)
- 02
Did it come from the Government, or was it made for it, under a contract?
If not, it is neither: CUI excludes what you keep in your own systems that never came from or was made for an agency. If so, it is FCI at least.
FAR 52.204-21(a); 32 CFR 2002.4(h)
- 03
Is it only there so you get paid?
Simple transactional information, such as what is needed to process payments, is not FCI. Your invoice is not what Level 1 protects.
FAR 52.204-21(a)
- 04
Does a law, regulation or Government-wide policy say to control it?
Then it is CUI, and the CUI Registry names its category. If the authority spells out its own handling, it is CUI Specified; if not, CUI Basic.
32 CFR 2002.4(h), (j), (r)
Two things follow. Under a contract, every piece of CUI also meets the FCI definition, so a CUI shop holds both. And CUI is not whatever feels sensitive: the CUI Registry's categories are the only designations allowed. The full picture of CUI, with more shop examples, is in what is CUI.
Sort a shop's paperwork
Eight things that sit in a small shop's inbox on a typical DoD subcontract. Make your call on each, then read what the rule says and why.
Make your call on each item first. The rule's answer opens under it once you choose. Example only
0 of 8 sorted, 0 match the rule
FCI, CUI Basic, CUI Specified and ITAR technical data
Four kinds of data against the same six rows. Note where the drawings land: Controlled Technical Information, which the CUI Registry lists as Specified under DFARS 252.204-7012, not as Basic.
| The question | FCIFederal contract information | CUI BasicControlled unclassified | CUI SpecifiedControlled, with its own rules | ITAR technical dataExport-controlled |
|---|---|---|---|---|
| Definition sourcethe rule that defines it | FAR 52.204-21(a) and FAR 4.1901 | 32 CFR 2002.4(h) and (j) | 32 CFR 2002.4(r) | 22 CFR 120.33 |
| What it is, in one linethe definitions | Not meant for the public, and provided by or generated for the Government under a contract | Government information a law, regulation or Government-wide policy says to control, with no controls of its own | CUI whose law, regulation or policy spells out its own handling controls | Information required to design, build, operate, repair or modify a defense article |
| Example in a machine shopour reading of the rules | The prime's purchase order: part numbers, quantities, delivery dates | Operations security details a program shares with its suppliers: the Registry lists OPSEC as Basic | A drawing from the prime with Distribution Statement C or D: Controlled Technical Information | The drawing package for a part on the US Munitions List, and the process sheets you write from it |
| What the paper shows32 CFR 2002.20(b) | Nothing. The clause sets no marking; the contract tells you | A banner reading CUI or CONTROLLED; a category marking is optional | The banner must carry its category, for example CUI//SP-CTI | No CUI banner of its own; CUI//SP-EXPT when it is also CUI |
| Rule that protects itFAR 52.204-21; DFARS 7012; ITAR | FAR 52.204-21: 15 basic safeguards | DFARS 252.204-7012: NIST SP 800-171 on your systems | DFARS 252.204-7012, plus the handling rules its own authority sets | ITAR, 22 CFR 120 to 130, whether or not it is CUI; 7012 as well when it is |
| CMMC level it triggers32 CFR 170.23(a) | Level 1 (Self) | Level 2 (Self) at minimum | Level 2, the same as Basic | None of its own; Level 2 when it is also CUI |
Read down a column to see one kind of data whole. The last row is the one a contract turns into work.
Which CMMC level each one triggers
Part 170 settles it for subcontractors in two sentences:
Level 1 is the 15 basic safeguarding requirements of FAR 52.204-21(b)(1)(i)–(xv), MET or NOT MET in its entirety, with no POA&M, and a self-assessment repeated every year with results and an affirmation in SPRS. Level 2 is the 110 security requirements of NIST SP 800-171 Rev 2. The gap between them is the whole cost of this question, which is why the Level 1 requirements and the Level 2 requirements read so differently. How Level 2 relates to the 800-171 score you may already post is in CMMC vs NIST SP 800-171, and what DoD estimates each assessment path costs is in the CMMC cost estimator.
You do not pick the level alone. Part 170 has the DoD program office choose the CMMC status for a contract by the type of information it expects you to handle, FCI or CUI, and the prime flows it down. When the level in your subcontract does not match what actually arrives in your inbox, raise it with the prime before you build. What a contract can require while Phase 2 is suspended is in the status box at the top of this page.
The risky mistake
You build to 15 safeguards when the data needs 110. The affirmation your senior official enters in SPRS covers the wrong level, and a cloud holding the drawings may fall short of the FedRAMP Moderate bar DFARS 252.204-7012 sets.
The expensive mistake
You pay for a Level 2 environment, a GCC High tenant or an enclave, to protect data that only needs the 15 basic safeguards. Safe, and a waste of money.
Holding FCI only and being quoted for GCC High? Read GCC vs GCC High before you sign a licence.
What the paper tells you, and what it does not
CUI is meant to announce itself. FCI never does. Read a document from the prime in this order:
| Look at | What it tells you |
|---|---|
| The banner | Every CUI document carries a banner: 'CUI' or 'CONTROLLED' (mandatory), plus the category or subcategory markings, which are mandatory for CUI Specified.32 CFR 2002.20(b) |
| The distribution statement | On a drawing or spec for a military or space use, Statement B, C, D, E or F marks Controlled Technical Information. It sits in its own block, not in the banner, so read both.DFARS 252.204-7012(a); 32 CFR 2002.20(b)(2)(iii) |
| The designation line | Every CUI document must say who designated it, at least the agency, for example as a 'Controlled by' line on the first page.32 CFR 2002.20(d)(1) |
| The contract | FCI carries no marking at all. FAR 52.204-21 sets none, so you know FCI by where it came from: the contract and what it asks you to deliver.FAR 52.204-21 |
Banner layout, portion marks and what to do with a marked file you have to forward are in CUI marking requirements. For a single document you are unsure about, the is it CUI tool walks it through the Registry categories. If your drawings live in the shop's ERP, travelers and quotes carry the marking too: read which job-shop ERPs can hold CUI.
ITAR technical data: a rulebook of its own
ITAR technical data is the fourth column because it does not sit inside the other three. It is information required to design, develop, produce, manufacture, assemble, operate, repair, test, maintain or modify a defense article, in the form of blueprints, drawings, photographs, plans, instructions or documentation, plus software directly related to one. Public-domain information and basic marketing descriptions are not technical data.
When that data reaches you under a DoD contract, it is CUI as well: the Registry's Export Controlled category names the ITAR and the munitions list, with the banner CUI//SP-EXPT for its ITAR authority. But ITAR does not wait for a contract. A drawing package for a munitions-list part that reaches you on a purely commercial order, with no government contract behind it, is not CUI, and every ITAR rule still applies to it.
| The question | As CUI (DFARS 7012, CMMC) | As ITAR technical data (22 CFR 120 to 130) |
|---|---|---|
| What makes it so | It came from, or was made for, DoD under the contract, in a Registry category | What it is: data required to build or repair a defense article, whoever wrote it |
| Who may see it | People with a lawful government purpose; Part 170 never asks about citizenship | Releasing it to a foreign person, even in your own shop, is an export |
| Where it may be stored | A cloud at FedRAMP Moderate or equivalent | No cloud authorization; storing it is not an export if end-to-end encrypted with FIPS 140-2 (or successor) modules or at least AES-128 strength, and not in a proscribed country |
| Registration | None; your score and affirmation go in SPRS | DDTC registration for any manufacturer of defense articles, exporting or not; new registrants pay $3,000 a year |
The row that catches small shops is the second one. A CMMC Level 2 environment can be perfect and still let a foreign person on your staff open the CAD file, which ITAR treats as a deemed export. No product is ITAR certified; in Microsoft's own words, “there's no compliance certification for the ITAR”. What ITAR asks of a manufacturer is in what ITAR compliance means, and where the drawings can live is in ITAR-compliant file sharing. The screening, licence and record-keeping side is in ITAR compliance software compared.
How we read the rules
Questions small shops ask
What is FCI, in one sentence?
Federal contract information is anything you receive or produce under a government contract that the Government has not made public, apart from simple transactional information such as what is needed to process payments. FAR 52.204-21 protects it with 15 basic safeguards, which is all CMMC Level 1 asks.
Is all CUI also FCI?
For a contractor, in practice yes: CUI you receive or create under a contract is not public and was provided by or generated for the Government, which is the FCI test. Part 170 accounts for it: a Level 2 (Self) status also satisfies the requirements for Level 1 (Self).
Does CUI Specified need a higher CMMC level than CUI Basic?
No. Part 170 sets the level by FCI or CUI, not by category. On your own systems, the CUI rule points to NIST SP 800-171 for CUI Basic and lets a Specified authority add its own rules; what changes is usually who may receive the data and how it is marked, not the 110 requirements.
Who decides whether we hold CUI?
The agency that designates it. DFARS 252.204-7012 expects CUI DoD sends you to be marked or otherwise identified in the contract, and the DoD program office picks the CMMC level by whether FCI or CUI is involved. Your part is to notice when what arrives does not match what the contract says, and ask. The scoping worksheet then maps where that data lives.
We are a second-tier supplier. Does any of this reach us?
Yes. FAR 52.204-21 requires its substance in subcontracts where FCI may reside in or transit the subcontractor's systems, and DFARS 7012 flows down to any subcontract whose performance involves covered defense information. Part 170 applies CMMC at every tier that handles FCI or CUI.
Can we keep CUI in one place so the rest of the shop stays at Level 1?
That is what an enclave is for: the Level 2 boundary is drawn around the systems that touch CUI, and assets physically or logically separated from them stay out of that scope. See CMMC enclaves for small shops.