FCI vs CUI in CMMC: What Each Is and Why It Matters
By Shaheer Malik · Updated Oct 28, 2026
FCI is information not meant for public release that is provided by or generated for the government under a contract. CUI is information the government says must be safeguarded under a law, regulation or government-wide policy. In CMMC, FCI alone points to Level 1; CUI points to Level 2.[1][2][3]
The definitions
FCI is “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments.”[1]
CUI is defined in 32 CFR 2002.4(h), which the CMMC rule adopts: information the government creates or possesses, or that an entity creates or possesses for the government, that a law, regulation or government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls.[2][3] The National Archives keeps the official list of CUI categories.[4]
Side by side
| FCI | CUI | |
|---|---|---|
| Defined in | FAR 4.1901 | 32 CFR 2002.4(h) |
| Safeguarding | FAR 52.204-21 (15 requirements) | NIST SP 800-171 via DFARS 252.204-7012 (110 requirements) |
| CMMC level | Level 1 | Level 2 (or 3) |
| Typical sign | Contract documents not meant for the public | CUI markings, controlled technical information, export-controlled data |
What is a CUI enclave?
A separate environment where CUI is kept, so the rest of the company stays outside the assessment scope. See CMMC enclaves.
How to tell which you handle
- Read the contract: a CMMC level, DFARS 252.204-7012 and CUI markings are the clearest signals.
- Ask the prime or the contracting officer to confirm what will be shared and how it is marked.
- When in doubt, treat engineering drawings and technical data as likely CUI until confirmed.
Then decide your level with which CMMC level do I need.
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
What is FCI in CMMC?
Federal Contract Information: information not intended for public release that is provided by or generated for the government under a contract, excluding public information and simple transactional data such as payment details.
What is CUI in CMMC?
Controlled Unclassified Information, as defined in 32 CFR 2002.4(h): information that a law, regulation or government-wide policy requires or permits to be handled with safeguarding or dissemination controls.
Is CUI the same as classified information?
No. CUI is unclassified. Classified information is governed separately, and CMMC covers only unclassified contractor information systems.
Sources
- FAR 4.1901, Definitions (Federal contract information) (checked Oct 28, 2026)
- 32 CFR part 2002, Controlled Unclassified Information (checked Oct 28, 2026)
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- National Archives: CUI Registry, category list (checked Oct 28, 2026)
More on the rules behind cmmc
- CMMC vs NIST SP 800-171: The Difference, and Rev 3
- Which DFARS Clause Establishes CMMC? 7021, 7025 and 7012
- SPRS Score and CMMC: What It Is and How It’s Calculated
- CMMC and ITAR: Does One Satisfy the Other?
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.