FCI and CUI handling differ on three practical points: how the data must be marked, how it must be encrypted in transit, and how it must be destroyed at end of life. Federal Contract Information (FCI) is contract data not meant for public release, and it takes the baseline safeguards in FAR clause 52.204-21. Controlled Unclassified Information (CUI) is government data that law or policy requires you to protect, and it takes the fuller set of NIST SP 800-171 controls. Every piece of CUI a contractor holds is also FCI, but most FCI never rises to CUI. That one-way relationship, not a feeling about how secret a file seems, decides which rules apply and how far your compliance scope has to reach.
The Five Points SMB Contractors Get Wrong About FCI and CUI
Most SMB defense suppliers we work with treat “sensitive” as a single bucket, and that instinct costs them on both ends. Here are the five points that reset how a smaller firm should think about this before an assessment lands.
- The line is procedural, not emotional. FCI and CUI are separated by marking, encryption, and destruction standards, not by how confidential a document feels to the person holding it.
- All CUI is FCI, but not all FCI is CUI. This is the single relationship that governs scope. Miss it and you either over-protect harmless data or under-protect regulated data.
- CUI carries government markings; FCI usually does not. If a file arrives with a CUI banner or portion marking, the source agency already told you which rulebook applies.
- Transmission and destruction are where audits actually fail. Standard email may move FCI, but CUI needs FIPS-validated encryption in transit and NIST SP 800-88 destruction at disposal.
- Data type drives CMMC level. FCI-only work maps to CMMC Level 1. The moment CUI enters your environment, you are in Level 2 territory and NIST SP 800-171 applies in full.
Contractors who internalize these five points spend their budget where the risk actually sits. Contractors who don’t tend to spread thin controls across everything and still fail on the two flows that matter most.
What Federal Contract Information Actually Covers
Federal Contract Information is any information provided by or generated for the government under a contract that is not intended for public release. That definition is broader than most owners expect. It sweeps in things like process documents, internal contract correspondence, and delivery details, as long as they relate to developing or delivering a product or service to a federal customer. It does not include information the government has already published, and it does not include the two-line transactional data on a purchase order.
The safeguarding bar for FCI comes from FAR clause 52.204-21, which lists fifteen basic requirements. Those requirements read like ordinary hygiene: limit access to authorized users, authenticate identities before granting access, sanitize media before disposal, and control who can connect to your systems. If your general business security is already competent, FCI safeguarding is mostly a documentation exercise rather than a rebuild. The failure mode here is the opposite of under-protection. Firms lock FCI as if it were classified material, which adds cost and slows delivery without adding any compliance value.
How to identify FCI in your environment
FCI shows up wherever contract work lives, which is usually far more places than a data map suggests. Start by tracing a single contract from award to delivery and note every system the data touches: the shared drive, the project email threads, the estimating spreadsheet, the subcontractor portal. Each stop is in scope for FCI safeguarding. The case for treating this narrowly is real, because a tight boundary keeps the control set small. The case against drawing it too tightly is equally real, because an ignored system that quietly holds contract data becomes the gap an assessor finds first. We hold both by mapping generously, then reducing scope deliberately through segmentation rather than by hoping a system stays out of reach.
Where FCI safeguarding usually breaks
FCI safeguarding tends to break at the human edges rather than the technical core. The fifteen FAR requirements are not hard to meet, yet firms lose points on access reviews that never happen, on shared logins that survive employee turnover, and on media that leaves the building without sanitization. A control you cannot evidence is a control you do not have.
Why Controlled Unclassified Information Raises the Bar
Controlled Unclassified Information raises the handling bar because a specific law, regulation, or government-wide policy demands it, not because your firm decided the data was important. CUI is information the government created or possesses, or that you created on the government’s behalf, that carries a safeguarding or dissemination requirement. The category comes with a formal registry of types, from export-controlled technical data to certain privacy and procurement information. When a contract flows CUI to you, the requiring agency is supposed to mark it and tell you the handling category, which takes much of the judgment off your shoulders.
The protection standard for CUI is NIST SP 800-171, a set of 110 security requirements across fourteen families. If you need the fuller picture of how that boundary gets drawn in practice, our guide to CUI protection for defense suppliers walks through scoping, enclaves, and cost.
The Marking Difference That Settles Most Disputes
Marking is the fastest way to tell FCI and CUI apart, because CUI is supposed to carry a visible designation and FCI is not. A properly handled CUI document shows a banner marking at the top, often something like CUI, and may include portion markings inside the file. FCI arrives with no such marking. The clean read is that if it is marked CUI, you apply NIST SP 800-171; if it is unmarked contract data, you apply FAR baseline safeguards.
The complication worth holding is that agencies sometimes fail to mark CUI correctly, and unmarked data can still be CUI by its nature. So marking answers most disputes, but it is not a permission slip to under-protect data that is obviously regulated. When the marking and the data type disagree, raise it with the contracting officer rather than guess, and get the answer in writing so it becomes part of your compliance evidence.
Does FCI Always Become CUI Eventually?
FCI does not automatically become CUI, and assuming it does is where over-spending starts. FCI stays FCI unless a specific law, regulation, or contract clause elevates a piece of it into a defined CUI category. Some argue you should protect all contract data at the CUI level for safety, and that instinct is understandable given the penalties. The opposing view is that scoping every byte to NIST SP 800-171 wastes resources a small firm rarely has to spare. We hold both sides here: the safe move is not maximum control everywhere, it is accurate classification everywhere, so each data type gets exactly the protection its rule demands.
How Transmission and Destruction Rules Split
Transmission and destruction are where the two categories separate in daily practice. FCI can generally move over standard business email as long as access is controlled, and it can be disposed of through ordinary media sanitization. CUI cannot. Moving CUI requires FIPS-validated encryption in transit, which in practice means TLS 1.2 or higher, SFTP, or encrypted email, unless an approved alternative exists. Destroying CUI means following NIST SP 800-88 media sanitization, with defined overwrite passes or degaussing for magnetic media, so a deleted file is genuinely unrecoverable.
Some owners argue this is overkill for a small shop. The opposing reality is that these two flows, email and disposal, are exactly where assessors and attackers both look first, and they are cheap to get right once the process is set.
When the Same File Holds Both FCI and CUI
The same file often holds both FCI and CUI, and this mixing is one of the biggest sources of handling mistakes. A statement of work might contain routine schedule data (FCI) alongside a controlled technical drawing (CUI) in the same PDF. One camp says split every mixed file into clean single-type documents; another says that is impractical at volume for a small team. The workable middle is to treat any file that contains even one piece of CUI as CUI in full, protect it at the higher tier, and reserve document-splitting for the high-traffic files where the effort clearly pays back.
Derived Data Inherits Its Source Classification, But Not Automatically
Derived data inherits the classification of its source, so a report or summary built from CUI is itself CUI, even when your team wrote it internally. This catches careful firms off guard. Someone pulls figures from a controlled drawing into a status deck, saves it to a general share, and now CUI lives outside the boundary.
The opposing view is that heavy-handed inheritance rules make ordinary work impossible, and there is a grain of truth in it. Not every mention of a controlled project turns a file into CUI. The line is whether the derived work actually contains or reveals the controlled content. Teach people the trigger, not the paranoia: if the output reproduces controlled specifications, test results, or technical data, it inherits the marking and the safeguarding. If it only references that a project exists, it usually does not.
This same logic applies to email threads. A conversation can start as routine contract coordination, then a reply drops in a test result or a controlled parameter, and the whole thread, along with every mailbox holding it, now carries CUI. You cannot ask people to stop and reclassify every email mid-conversation. The realistic control is at the channel level: route controlled discussions into a system already inside your safeguarded boundary, and give staff a fast, obvious way to move a thread there the instant it turns technical.
How Data Type Sets Your CMMC Scope, Cost, and Governance
Data type, not company size, sets your CMMC level and therefore your cost. A firm that only ever touches FCI maps to CMMC Level 1, a self-assessed baseline built on the fifteen FAR requirements. A firm that stores, processes, or transmits CUI maps to CMMC Level 2, which requires full NIST SP 800-171 implementation and, for many contracts, a third-party assessment. The jump between those two levels is the single largest driver of compliance spend for an SMB supplier.
This is where scoping discipline pays off. If you can keep CUI inside a segmented enclave rather than letting it spread across the whole network, only that enclave carries the 110 requirements, and the rest of the business stays at the lighter bar. A zero-trust design makes that separation enforceable rather than aspirational.
It’s worth treating this as a governance decision first and an IT task second. Classification, access decisions, and marking are calls a compliance owner makes, which the technical team then enforces. When engineers alone are left to guess at what counts as CUI, the boundary drifts and evidence gets thin. Pairing a governance owner who decides classification with the technical team who implements controls is what keeps the boundary defensible in an assessment.
Flow-Down: Your Obligation Travels to Subcontractors and Vendors
Your safeguarding and marking obligations travel to any subcontractor or vendor that touches the same controlled data. Firms often lock down their own environment and forget the fractional bookkeeper, the CAD contractor, or the cloud tool that also holds the file.
Flow-down can feel like overreach onto small partners who never signed up for a control set, and that friction is real. Avoiding the conversation does not remove the obligation, though. Map where controlled data actually goes downstream, put the safeguarding requirement in the subcontract, and confirm the partner can meet it before data moves.
Where Compliant Firms Still Leak Data: The Edges
Controls tend to hold in the middle and fail at the edges. A file is marked correctly and protected in the main system, then printed for a meeting, backed up to an unmanaged drive, or deleted in a way that leaves it recoverable. Physical copies, shadow backups, and improper disposal show up repeatedly in exposure reviews. Mark CUI at creation with the correct banners, keep it in defined and safeguarded locations, restrict printing and portable media, and dispose of both digital and physical copies so they cannot be reconstructed.
Frequently Asked Questions
Is all FCI also CUI?
No. All CUI held by a contractor is also FCI, but most FCI never becomes CUI. FCI is the broad category of non-public contract data, while CUI is the narrower subset that a law, regulation, or government policy specifically requires you to safeguard. The one-way relationship is what decides how far your controls have to reach.
Does FCI require encryption the way CUI does?
Not to the same standard. FCI can generally move over standard business email with access controls in place, while CUI requires FIPS-validated encryption in transit such as TLS 1.2 or higher, SFTP, or encrypted email.
How do I know if a file is CUI or just FCI?
Check the marking first. CUI is supposed to carry a visible banner marking and often portion markings, while FCI carries none. If the marking and the obvious nature of the data disagree, treat the file as regulated and confirm the category with your contracting officer rather than guessing.
Does a summary or report built from CUI count as CUI?
Yes, when the summary actually contains or reveals the controlled content. Derived data inherits the classification of its source, so a report, deck, or export that reproduces controlled specifications or test results is CUI even if your team wrote it internally. A file that only mentions a project exists usually is not.
Is a subcontractor responsible for CUI a prime labeled incorrectly?
Yes. A subcontractor must recognize and safeguard CUI whenever it receives or generates that data, regardless of whether the prime marked it correctly. Relying on a missing or wrong label does not remove the obligation.
What CMMC level does handling CUI require?
Storing, processing, or transmitting CUI places you at CMMC Level 2, which requires full implementation of the 110 NIST SP 800-171 requirements. Work that touches only FCI maps to CMMC Level 1, a lighter self-assessed baseline. The data type, not the size of your firm, drives which level applies.
Can I keep costs down by isolating CUI?
Yes. Segmenting CUI into a defined enclave keeps the 110 NIST SP 800-171 requirements scoped to that boundary instead of the whole network, which lowers both effort and cost. A zero-trust design makes the separation enforceable, so the rest of your business stays at the lighter FCI bar.
What happens if we misclassify CUI as ordinary FCI?
The data sits without required safeguarding, which can trigger a breach obligation if it’s exposed and, under the False Claims Act, a claim that you misrepresented your compliance. This under-scoping direction is the one most likely to cost a contract, so the fix is to map your data flow and re-scope before an assessor or incident finds the gap.
Talk to a Compliance Partner Before Your Next Assessment
The practical takeaway is that FCI and CUI handling comes down to a handful of questions you can answer today: is the data marked, how must it move, how must it be destroyed, does it inherit classification from a source, and does the obligation extend to a subcontractor. Answer those correctly and you protect regulated data without over-spending on data that never needed the heavier controls. Get them wrong and you either inflate your CMMC scope or hand an assessor an easy finding on the flows that fail most: email, disposal, and the edges nobody was watching.
We have walked SMB defense suppliers through this exact split many times, and the firms that draw the line deliberately, document their decisions, and build the classification workflow into daily habits spend less and pass cleaner. If you want a second set of eyes on where FCI ends and CUI begins in your environment, book a free strategy call with our team and we will map your data, your scope, and your realistic path to CMMC readiness before your assessment window opens.
