What Are FCI and CUI, and Which CMMC Level Do You Need?

Article Summary: Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) are not the same thing, and treating them as interchangeable can be an expensive mistake. FCI triggers Cybersecurity Maturity Model Certification (CMMC) Level 1: 15 basic safeguarding controls under Federal Acquisition Regulation (FAR) 52.204-21, self-assessed. CUI triggers CMMC Level 2: 110 controls under National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, a much bigger lift in time and cost. Get the classification wrong and you either underprotect information you’re required to protect or pay for compliance infrastructure you never needed.

The question usually comes up when a new contract arrives with a cybersecurity clause attached, and the answer can decide whether you keep your commercial Microsoft 365 tenant or move to Microsoft’s Government Community Cloud (GCC). Here’s what each term means and how to tell which one you handle.

What FCI is

FCI is information the government provides to you or generates for you under a contract to develop or deliver a product or service, and that isn’t meant for public release. The definition comes from FAR 52.204-21, the same clause that sets FCI’s 15 baseline safeguards.

In day-to-day terms, it’s the paperwork of government work: purchase orders, delivery schedules, and non-public specifications shared so you can fulfill the contract. Information the government has already made public doesn’t count. Neither does simple transactional data needed to process payments.

Any system that stores or handles FCI needs those 15 safeguards. Together they make up CMMC Level 1.

What CUI is

CUI is a narrower, higher tier. It’s unclassified government information that a specific law, regulation, or government-wide policy says must be safeguarded or have its distribution limited. The program is defined in Title 32 of the Code of Federal Regulations (CFR), Part 2002, and the categories are listed in the government’s CUI Registry.

In defense work, examples include export-controlled technical data and controlled technical information such as engineering drawings. Not every contract generates CUI, and a document isn’t CUI just because it isn’t public.

When a defense contract involves CUI, protecting it means implementing NIST SP 800-171. Under CMMC, that’s Level 2.

Why there are two tiers

The harm from exposure isn’t the same for all government data. FCI is mostly routine contract information. It’s sensitive, but a leak usually does limited damage. CUI can include technical data where exposure has national security consequences.

So instead of requiring every contractor to build the same expensive environment, the government scaled the requirement to the risk.

What each tier requires under CMMC

Level 1 covers FCI. It’s 15 controls from FAR 52.204-21, self-assessed every year. You enter the result in the Supplier Performance Risk System (SPRS), and a senior company official affirms compliance annually. There’s no outside audit.

Level 2 covers CUI: the 110 controls in NIST SP 800-171 Revision 2. Third-party audits for Level 2 were suspended on July 13, 2026. For now, Level 2 is self-assessed with an annual affirmation.

The controls are still required under Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, and the audit could return.

What happens if you classify it wrong

A wrong call costs money in either direction.

Underclassify, and you build Level 1 controls around data that’s really CUI. That puts you out of step with DFARS 252.204-7012, the clause that requires you to protect CUI. If you’ve already affirmed compliance you didn’t have, the problem gets bigger. Knowingly misrepresenting your cybersecurity compliance can create False Claims Act liability, and the Department of Justice (DOJ) has been pursuing these cases since 2021.

Overclassify, and you build a Level 2 environment and move to GCC for a contract that only ever involved FCI. That’s real money spent protecting information that didn’t need it.

The way to avoid both is to know which category your data falls into before you build.

How to tell which one applies to you

Classification doesn’t come down to how sensitive a document feels. It comes down to three things: what your contract requires, whether documents you’ve received are marked as CUI, and what information the government creates for you or hands you, as opposed to what you create on your own.

That review is the first step in every CMMC engagement we take on. Sometimes it shows a company needs less than it feared. Sometimes it shows more than it assumed.

If you’re not sure which category your company falls into, let’s talk it through on a free 30-minute call. You’ll come away with a straight read on where you stand.

Frequently asked questions (FAQ)

Is CUI just a stricter version of FCI?
They’re defined by different rules: FCI by FAR 52.204-21, and CUI by 32 CFR Part 2002, with NIST SP 800-171 as the protection standard on defense contracts. They do overlap. CUI you receive under a contract is usually FCI too, and Level 2’s 110 controls include Level 1’s 15. Plenty of companies handle FCI and never touch CUI.

Can a document contain both FCI and CUI?
Yes. When it does, the whole document is handled as CUI, since that’s the stricter category.

Does having CUI always mean I need GCC High?
No. GCC is the usual starting point once CUI is in scope. GCC High applies when your work includes export-controlled data under ITAR or EAR.

Is there an employee count below which none of this applies?
No. FCI and CUI rules have no size threshold. Company size affects how the work gets scoped, and the requirement applies either way.

What if we don’t know whether we handle CUI?
Find out before you build anything. A short review of your contracts and data usually settles it.