Every CMMC decision traces back to one question: what kind of information do you hold? If it is Federal Contract Information, you are at Level 1. If it is Controlled Unclassified Information, you are at Level 2 or above, with 110 requirements in place of 15 and possibly a third-party assessment.
The two terms sound similar and are often used loosely, including by people sending you contracts. This article sets out what each means as defined in regulation, how to recognize them in practice, and the mistakes that put organizations at the wrong level.
What counts as Federal Contract Information
FCI is defined in the Federal Acquisition Regulation, at FAR 4.1901 and in the clause FAR 52.204-21. In substance, it is information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service.
The definition has two explicit exclusions:
information the government provides to the public, such as content on public websites
simple transactional information, such as what is needed to process payments
That leaves a wide category. Statements of work, delivery schedules, internal correspondence about contract performance and pricing exchanged with the government can all be FCI. If you hold a federal contract and exchange anything beyond invoices, you almost certainly hold FCI.
FCI is protected by the 15 basic safeguarding requirements in FAR 52.204-21. They cover fundamentals: limiting access to authorized users, authenticating them, sanitizing media before disposal, controlling physical access, monitoring communications at system boundaries, patching flaws and running malware protection. CMMC Level 1 assesses exactly these.
What counts as Controlled Unclassified Information
CUI is a narrower, more formally defined category. Executive Order 13556 created the program, the National Archives and Records Administration administers it, and the implementing regulation is 32 CFR Part 2002.
Under that regulation, CUI is information the government creates or possesses, or that someone creates or possesses on its behalf, that a law, regulation or government-wide policy requires or permits to be handled with safeguarding or dissemination controls. Classified information is excluded; it has its own system.
What makes something CUI is not sensitivity in a general sense. It is that a specific authority covers it. The CUI Registry, maintained by NARA, lists the approved categories and the authority behind each. Categories relevant to defense work include controlled technical information, export-controlled information and certain critical infrastructure information, among many others.
CUI Basic and CUI Specified
Most CUI is CUI Basic: the governing authority requires protection but does not prescribe particular controls, so the uniform CUI handling rules apply.
CUI Specified is where the underlying law or regulation sets its own handling requirements, such as particular dissemination limits. Those requirements apply in addition to the baseline. The Registry indicates which categories are Specified.
CUI in DoD contracts
For defense contractors, DFARS 252.204-7012 uses the term covered defense information. It covers CUI described in the Registry that is either marked or otherwise identified in the contract and provided by DoD, or collected, developed, received, transmitted, used or stored by the contractor in support of performance. That second limb matters, and it is covered below.
How the two relate under CMMC
CUI held under a federal contract is generally also FCI, so the protections stack. The Level 1 requirements correspond to a subset of the NIST SP 800-171 requirements, which is why an organization at Level 2 has already covered Level 1.
| FCI | CUI | |
|---|---|---|
| Defined in | FAR 4.1901, FAR 52.204-21 | 32 CFR Part 2002 and the CUI Registry |
| Protection standard | 15 basic safeguarding requirements | 110 requirements of NIST SP 800-171 Rev. 2 (DoD contracts) |
| CMMC level | Level 1 | Level 2, or Level 3 for some programs |
| Assessment | Annual self-assessment | Self-assessment or C3PAO, as the contract specifies |
| Marked | Usually not | Should be, with CUI banner markings |
The table makes the cost of misclassification plain. Treating FCI as CUI commits you to far more work than you need. Treating CUI as FCI leaves you out of compliance with a contract clause you have already accepted. CMMC levels, explained covers what each level then requires.
Recognizing CUI: marking, and where it falls short
CUI is supposed to be marked. The CUI program calls for a banner marking ("CUI", or "CONTROLLED") on documents, with category markings where required and limited dissemination controls where they apply. DoD's implementing instruction, DoDI 5200.48, also expects a designation indicator identifying the office that designated the information.
Technical data under DoD contracts often carries a distribution statement as well. Distribution statements B through F indicate controlled technical information; statement A means approved for public release.
In practice, marking is inconsistent. You will see:
Unmarked CUI, for example technical drawings sent by email without a banner.
Legacy markings such as "For Official Use Only", which predate the CUI program and do not automatically mean the information is CUI today.
Overmarking, where entire document sets carry CUI banners regardless of content.
When marking and content disagree, ask the contracting officer or your prime. The CUI regulation, at 32 CFR 2002.50, provides a process for authorized holders to challenge a designation they believe is wrong. Until it is resolved, handle marked information as CUI.
Information you create can be CUI too
The definition of covered defense information includes information developed by the contractor in support of performance. If you take a government drawing and produce a derived model, a test report or a modified specification, the result can be CUI even though nobody at DoD marked it.
This is the part of the definition teams underestimate. It means CUI can appear in places you never sent it: engineering repositories, simulation outputs, shared drives used by a project team. When you scope your environment, follow the work products, not only the documents that arrived marked. The method is in scoping where CUI lives in your environment.
Mistakes that put you at the wrong level
These are the errors that recur:
Assuming no CUI because nothing is marked. Unmarked does not mean uncontrolled, especially for contractor-generated material.
Assuming CUI because the company works in defense. Plenty of defense suppliers handle only FCI. Check what actually flows to you.
Treating export-controlled data as a separate problem. ITAR and EAR data is a CUI category under the Registry, and it also carries its own legal obligations.
Letting CUI spread for convenience. Every system that touches CUI comes into scope. Decide where it may live and enforce that.
Not writing the determination down. Record what information you hold, which categories apply, and who confirmed it. An assessor will ask, and so will your next prime.
Classification questions can carry legal consequences, particularly for export control, so confirm interpretations of the regulations with counsel. The operational work of protecting CUI once you have it is in NIST 800-171: protecting CUI in practice.
How TrustLynce helps
TrustLynce maps FAR 52.204-21 and NIST SP 800-171 requirements to one set of controls through compliance automation, so moving from Level 1 to Level 2 builds on work already done. Evidence collection gathers records from the systems in your scope on a schedule, so the evidence follows the boundary you drew. See our CMMC page for coverage.