CUI vs. FCI in CMMC: Key Differences, Examples & Requirements
Businesses working with the U.S. Department of Defense (DoD) must protect sensitive government information. Two important categories are Federal Contract Information (FCI) and Controlled Unclassified Information (CUI).
Understanding CUI vs FCI is important because each category has different cybersecurity requirements under the Cybersecurity Maturity Model Certification (CMMC). Knowing what information your company handles helps determine which security practices you need.
What Is FCI?
Federal Contract Information (FCI) is non-public information provided by or generated for the government under a contract. It does not include publicly available information or basic payment-related details.
Examples include:
Non-public contract details
Internal project schedules
Government-provided business information
Delivery instructions
Contract-related documents not intended for public release
What Is FCI in CMMC?
In CMMC, FCI must be protected from unauthorized access or disclosure. Organizations that handle FCI generally fall under CMMC Level 1 requirements.
These requirements are based on the 15 basic safeguarding practices in FAR 52.204-21, including controlling system access and protecting information.
What Is CUI?
Controlled Unclassified Information (CUI) is sensitive government information that requires specific safeguarding or handling controls under federal laws, regulations, or government-wide policies.
Examples may include:
Controlled technical drawings
Engineering specifications
Sensitive government research
Export-controlled information
Certain protected personal information
Although CUI is not classified, it still requires stronger protection than ordinary business information.
CUI vs FCI: Key Differences
The main difference between CUI and FCI is the type of information and the security requirements that apply.
Comparison | FCI | CUI |
Full name | Federal Contract Information | Controlled Unclassified Information |
Sensitivity | Non-public contract information | Information requiring specific safeguards |
CMMC level | Generally Level 1 | Generally Level 2 or higher |
Main requirements | FAR 52.204-21 | NIST SP 800-171 |
Examples | Non-public contract schedules | Controlled technical drawings |
CMMC FCI vs. CUI Requirements
CMMC requirements depend on the type of government information a contractor handles.
FCI Requirements: CMMC Level 1
Companies handling FCI generally need to meet CMMC Level 1 requirements. These include 15 basic safeguarding practices, such as:
Limiting access to authorized users.
Protecting information stored or transmitted electronically.
Controlling connections to company systems.
Identifying and correcting security weaknesses.
Organizations must also complete the required self-assessment and annual affirmation under applicable CMMC rules.
CUI Requirements: CMMC Level 2
Companies handling CUI generally need to meet CMMC Level 2 requirements, which are based on NIST SP 800-171.
These requirements cover areas such as:
Access control
Security awareness and training
Incident response
Risk assessment
Configuration management
System and communications protection
Depending on contract requirements, organizations may need a self-assessment or an assessment by a certified third-party organization.
Understanding NIST SP 800-171
NIST SP 800-171 provides security requirements for protecting CUI in nonfederal systems and organizations.
It covers how companies should protect their networks, devices, applications, and information. While FCI generally follows the basic safeguards in FAR 52.204-21, CUI requires more extensive protections under NIST SP 800-171 when applicable.
How FAR 52.204-21 Relates to FCI
FAR 52.204-21 establishes basic safeguarding requirements for contractor systems that process, store, or transmit FCI.
It requires businesses to limit system access, protect information, and control connections to their systems. These practices form the foundation of FCI protection under CMMC Level 1.
How to Identify Whether Your Business Handles FCI or CUI
Start by reviewing your government contracts and information-handling instructions. You can then:
Identify the government information your company receives or creates.
Determine whether it is FCI, CUI, or both.
Identify the systems that store, process, or transmit that information.
Review the applicable FAR and CMMC requirements.
Implement the required security controls.
If your company handles both FCI and CUI, you must account for the stronger CUI requirements on systems that process, store, or transmit CUI.
Conclusion:
Understanding CUI vs FCI helps defense contractors identify the cybersecurity protections they need. FCI generally requires CMMC Level 1 safeguards based on FAR 52.204-21, while CUI generally requires Level 2 protections based on NIST SP 800-171.
Reviewing your contracts and identifying the information your business handles are important first steps toward compliance.
Frequently Asked Questions
What is the difference between CUI and FCI?
FCI is non-public information provided by or generated for the government under a contract. CUI requires specific safeguarding or handling controls under federal requirements.
What is FCI in CMMC?
FCI is Federal Contract Information that contractors must protect using basic cybersecurity safeguards under CMMC Level 1.
What does CUI mean in CMMC?
CUI stands for Controlled Unclassified Information. It generally requires stronger protections aligned with CMMC Level 2.
What is CMMC Level 1?
CMMC Level 1 applies to organizations handling FCI and requires 15 basic safeguarding practices.
Does FCI require NIST SP 800-171?
FCI alone generally requires the safeguards in FAR 52.204-21. NIST SP 800-171 applies to protecting CUI when required.
How many requirements are in NIST SP 800-171 Revision 2?
It contains 110 security requirements across 14 security families.
Can a company handle both FCI and CUI?
Yes. A contractor may handle both categories depending on its government contracts.
Is CUI classified information?
No. CUI is unclassified information that still requires protection under applicable federal requirements.
What is FAR 52.204-21?
It is a federal contract clause that establishes basic safeguarding requirements for contractor systems handling FCI.
How can a contractor prepare for CMMC compliance?
Identify the information your business handles, review contract requirements, assess your systems, and implement the necessary security controls.
