Learn the Difference Between CUI & FCI

Federal contracting began during the Revolutionary War, when private U.S. businesses supplied the Continental Army with essentials like muskets and food, laying the foundation for modern federal procurement. Over time it expanded to major infrastructure projects such as the transcontinental railroad in the 1860s and grew further during world wars to support military production and innovation.

Federal agencies handle many kinds of “sensitive unclassified” information that aren’t classified as national security or atomic energy material but still require protection from unauthorized access and release for reasons like privacy and law enforcement. Because each agency historically developed its own rules, the U.S. government ended up with a patchwork of definitions and markings across the executive branch, where similar information could be labeled differently, or dissimilar information could share labels, depending on its originating agency.

The Controlled Unclassified Information (CUI) program was created to standardize how sensitive unclassified information is generated, handled, and shared across more than 100 federal agencies, as well as with state, local, tribal, private sector, academia, and industry partners. Building on recommendations for broader intelligence sharing (including the 9/11 Commission and later presidential efforts), Executive Order 13556 established the CUI Program in 2010. The EO designated the National Archives and Records Administration (NARA) as the Executive Agent, with leadership through the CUI Office and ISOO.

The program’s rules were developed through an iterative federal regulatory process, culminating in final rules at 32 CFR Part 2002 (Code of Federal Regulations) that took effect in November 2016, and it continues to evolve through ongoing training, oversight, reporting, and gradual transition into routine agency maintenance.

Conversely, Federal Contract Information (FCI) is a contractual category defined broadly under the Federal Acquisition Regulation (FAR 52.204-21) rather than a government-wide, information-type classification managed by a specific oversight office. Instead of a dedicated FCI Program Office, FCI safeguarding requirements, which form the basis of CMMC Level 1, are enforced by individual contracting agencies and overseen via standard federal procurement, contracting officer oversight, and defense industrial base (DIB) security frameworks.

• FCI (Federal Contract Information)
• CUI (Controlled Unclassified Information)

A quick note on naming. The Department of Defense was renamed the Department of War earlier this year. That rename has not been made permanent, so this piece refers to the agency as the Department or the Pentagon throughout rather than committing to either name.

They both fall under “unclassified” information, but they’re not the same thing. And in the CMMC world, the difference matters. Whether you work with FCI or CUI affects your required security expectations to do business with the military, and it informs your compliance workload, including how you scope systems and users.

Classification Myths

• We're just a small sub, CUI doesn't apply to us.
• If it's not marked, it's not CUI.
• We only do admin work, so we're definitely FCI-only.

What is FCI?

FCI is information provided by or generated for the government under a federal contract, and it's not intended for public release.

Think of FCI as contract-related information that should stay internal.

It still requires protection, but it doesn't carry the same formal handling rules tied to the CUI Program.

FCI is essentially “not public,” but it’s not the same type of data that triggers the heavier safeguarding requirements tied to CUI.

What is CUI?

CUI is unclassified information that still requires safeguarding or dissemination controls due to law, regulation, or government-wide policy.

It’s not classified, but it still comes with rules.

CUI is the type of information that most often drives higher cybersecurity expectations in defense contracting because it requires controlled handling.

Sometimes CUI is clearly marked. Sometimes it shows up inside email threads or attachments and isn’t obvious until you review the context.

The biggest difference: CUI has formal protection rules

• FCI = Not public, handle responsibly
• CUI = Not public, handle with defined controls

FCI is protected under baseline federal expectations.

CUI is protected under the CUI Program. Mishandling it can create contract and compliance risk.

What CUI vs FCI means for your CMMC requirements

This part is the big one.

If you handle only FCI

You’re typically in a lower safeguarding expectation set compared to environments that handle CUI. Exact requirements depend on how your contract applies CMMC expectations and what your scope includes.

If you handle CUI

You’re in the environment that most often drives defense-contract security expectations aligned to NIST SP 800-171 (and the safeguarding focus that supports those controls).

That usually means stronger requirements such as:

• tighter access control
• audit logging and monitoring
• incident response processes
• configuration and change management
• secure system boundaries and documentation
• continuous policy enforcement

The type of information you handle determines the security maturity you’re expected to prove.

How to Determine FCI vs CUI

You’re more likely handling CUI if…

• your contract includes DFARS requirements associated with CUI handling
• your contract references NIST SP 800-171
• you receive files marked CUI
• you touch engineering, technical, or manufacturing deliverables
• you support systems used to build or store sensitive military deliverables

You’re more likely handling only FCI if…

• your data is mostly scheduling, coordination, or contract admin
• your work is contract support without technical deliverable content
• you don't receive controlled technical packages or specs
• your contract activity is internal but low sensitivity

And yes, plenty of government suppliers handle both. That’s normal. The real risk: CUI creep happens fast.

A lot of businesses think they're FCI-only… until one errant attachment changes everything.

Here’s how CUI commonly sneaks into general workflows:

• a subcontractor forwards technical drawings
• a customer sends controlled requirements in an email thread
• a proposal response includes detailed system specs
• IT is asked to store or troubleshoot controlled information
• a team member saves a file into a general SharePoint location

Once CUI touches your environment, your obligations change. That’s why scoping is one of the most important parts of CMMC planning.

CUI Has Categories (and 2 'Types')

Something most people miss: CUI isn’t one single label. It has Categories and Subcategories, which are essentially the different “flavors” of CUI.

The CUI Program is founded on a key requirement: only information requiring protection based on law, federal regulation, or government-wide policy can qualify as CUI. This distinction matters because different categories exist for different reasons, and some categories can include extra handling rules.

CUI Basic vs. CUI Specified

There are two common ways CUI category rules can be applied in practice, commonly referred to as CUI Basic and CUI Specified. The CUI Registry is the authoritative reference for determining which categories apply and their marking requirements.

CUI Basic

This is the standard “flavor” of CUI. All standard CUI rules apply, and it’s generally the simplest to mark and handle.

CUI Specified

CUI Specified is different because certain laws or regulations have specific handling requirements for that type of information.

CUI Specified isn't a higher level of CUI. It’s simply different, and those requirements are tied to legal authorities that can't be ignored. This also matters for marking. Documents containing multiple CUI Specified Categories/Subcategories must include all applicable categories in the CUI banner marking.

Adjacent Terms: DFARS, ITAR, and More

When you start untangling CUI vs FCI, you’ll hear related terms that often indicate which direction your contract requirements are heading.

FAR (Federal Acquisition Regulation)

FAR is the baseline rulebook for federal contracting.

For FCI-related expectations, minimum cybersecurity often traces back to FAR clauses such as FAR 52.204-21.

DFARS (Defense Federal Acquisition Regulation Supplement)

DFARS is the Pentagon's additional rule layer on top of FAR. The clause you’ll hear most in cybersecurity conversations is 252.204-7012. If it appears in your contracts, it’s a strong signal you may be dealing with covered defense information and requirements tied to NIST SP 800-171 safeguarding expectations.

CDI (Covered Defense Information)

CDI is a DFARS term that generally includes CUI and other protected contract information.

In practice, many people treat CDI as “handle this like CUI” for safeguarding decisions.

CTI (Controlled Technical Information)

CTI is a common CUI category with military or space application that typically includes:

• technical specs
• drawings and schematics
• engineering requirements
• manufacturing processes

CTI is one of the most common types of CUI contractors run into.

ITAR (International Traffic in Arms Regulations)

ITAR isn’t a CMMC level, but it can create strict access restrictions related to export-controlled technical data. If ITAR applies, it may limit who can access certain data and can heavily influence scoping, policies, and vendor decisions.

EAR (Export Administration Regulations)

EAR is another export-control framework, often applied to dual-use technologies. Like ITAR, EAR can impact how you store, share, and grant access to technical information.

FOUO (For Official Use Only)

FOUO is an older label that still shows up sometimes. It isn’t the official modern designation like CUI, but it usually indicates information not intended for public release.

When you see it, treat it cautiously and confirm the true data type and handling expectations.

Why This Matters Beyond Compliance

Knowing whether you handle FCI or CUI impacts real operational decisions like:

• which systems can store contract data
• whether personal devices can be used for contract work
• how files can be shared and retained
• which employees and vendors are in scope
• how strict access control and logging need to be

When Pentagon suppliers struggle, it’s often because the environment wasn’t scoped correctly from the start. Program timelines can change while scope and data handling don't.

What You Should Do Next

If you’re not sure whether you handle CUI or FCI, don’t guess. Start with a clean scoping process:

1. Identify which contracts are in scope
2. Map where contract information lives (email, endpoints, SharePoint, ticketing, backups)
3. Confirm whether any information qualifies as CUI
4. Define boundaries to prevent CUI from spreading into general systems
5. Align your plan to the highest data type you actually handle

Not sure if you're scoped correctly? That uncertainty is the risk. Let’s fix it. We're a Registered Practitioner Organization (RPO) for CMMC, designated by the CyberAB. Contact Us

Frequently Asked Questions (FAQs)

Are FCI and CUI both considered “unclassified”?

Yes, both are unclassified. The difference is that CUI requires formal safeguarding and dissemination controls under the CUI Program, while FCI is non-public contract information with less formalized handling requirements.

If a file isn’t marked, is it automatically not CUI?

No. Marking can be incomplete. Whether something is CUI depends on what the information is and whether it falls into a governed CUI category/subcategory and your contract requirements, not just the label on the document.

How does CUI creep happen in real workflows?

Usually through emails with attachments, proposal responses, subcontractor forwarding, saving files into general collaboration locations, or IT troubleshooting without realizing the content is controlled.

What’s the first step if we’re unsure whether we handle CUI or only FCI?

Start with scoping: identify in-scope contracts, map where information lives (email, endpoints, SharePoint, ticketing, backups), classify what’s present, then set boundaries so CUI doesn’t spread into general systems.

Does CMMC program status change your need to handle CUI correctly?

Program schedules can change, but contract scope and data handling obligations don’t. If you receive or handle CUI under contract requirements, you must scope and safeguard it accordingly.