FCI vs CUI: Which Is Your Data?
Every CMMC journey starts with one question: do you handle CUI, or just FCI? Get this wrong and you either over-build (expensive) or under-build (dangerous). Here’s the plain-English version.
What counts as FCI?
Federal Contract Information is information from or for the government, under contract, not meant for public release. In practice for a shop:
- Purchase orders and contract documents for government work
- Delivery schedules, quantities, pricing on federal jobs
- Routine correspondence about the contract
If a document would exist for any commercial customer — just with the government (or a prime’s government contract) on the other end — it’s probably FCI. FCI alone = CMMC Level 1: 15 basic safeguarding requirements from FAR 52.204-21, annual self-assessment.
What counts as CUI?
Controlled Unclassified Information is where most shops actually live. The most common category on a shop floor is controlled technical information: part drawings, 3D models, specs, process sheets, and inspection data for defense articles. Look for:
- Distribution statements (e.g., “Distribution Statement D”)
- Export-control markings (ITAR/EAR)
- CUI banners or legacy markings like FOUO on drawings and specs
- NDAs and DD Form 2345 certification requirements around the data
If your primes send you drawings for defense parts, assume CUI until proven otherwise. CUI = CMMC Level 2: the 110 requirements of NIST SP 800-171, an SSP, and a SPRS score.
Why does the determination matter so much?
Because scope drives everything: which systems must comply, what your network needs to look like, whether you need an enclave, what M365 licensing you need, and what an assessment covers. A shop that handles CUI on three CAM workstations has a very different (and much cheaper) project than one where CUI touches every PC in the building — but only if the flow is documented and controlled.
Where do shops get it wrong?
- “We’re too small to have CUI.” Size is irrelevant. One controlled drawing is enough.
- “Nothing we get is marked.” Unmarked controlled technical data is still controlled. Confirm with your prime — in writing.
- “It’s ITAR, not CUI.” Usually it’s both. Export-controlled technical data is a CUI category.
- “CUI only touches the office.” Follow the drawing: email → quoting PC → CAM station → USB stick → CNC controller. That path is your scope.
How do you pin it down?
Ask your primes what they’re sending you and under which clauses; read your POs for DFARS 252.204-7012/7019/7020 and CMMC flow-downs; then trace how technical data actually moves through your shop. That trace — not a guess — is what your level, scope, and budget should be built on.
This determination is the first thing we nail down in onboarding. If you want it done right in a week instead of debated for a quarter, start here.
Quick answers
What is FCI?
Federal Contract Information: information provided by or generated for the government under contract that isn't intended for public release — think purchase orders, contract terms, delivery schedules. Handling FCI triggers CMMC Level 1.
What is CUI?
Controlled Unclassified Information: information the government requires safeguarding for — in machine shops, most commonly controlled technical data like part drawings, specs, and process documentation from your primes. Handling CUI triggers CMMC Level 2.
Are unmarked drawings still CUI?
They can be. Markings are supposed to travel with CUI, but primes make mistakes. If the data is controlled technical data by nature, treating it as CUI is the defensible position — and worth confirming with your prime in writing.