Home › CMMC FAQs › CMMC Model
CMMC Model — Official DoD FAQ

What Is the Difference Between Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)?

💼
Not sure if you handle CUI or just FCI? Jun Cyber can help you classify your data and determine your CMMC level.
Schedule Free Consultation
Official DoD Answer
Source Source: DoD CIO CMMC FAQs v5 (B-Q7)

FCI and CUI are information that is 'not intended for public release.' However, CUI requires additional safeguarding and may also be subject to dissemination controls. FCI is defined in FAR clause 52.204-21, and CUI is defined in 32 CFR Part 2002. The Department's CUI Quick Reference Guide at dodcui.mil includes additional information. CMMC makes no changes to CUI definitions or safeguarding requirements.

In-Depth Analysis

FCI vs CUI: A Critical Distinction

The difference between FCI and CUI determines your required CMMC level, so getting this right is essential.

Federal Contract Information (FCI)

FCI is information provided by or generated for the Government under a contract that is not intended for public release. Examples include:

  • Contract performance data and reports
  • Financial information related to contract execution
  • Technical drawings created for the contract
  • Internal communications about contract work

FCI requires basic safeguarding under FAR 52.204-21 (15 controls) → CMMC Level 1

Controlled Unclassified Information (CUI)

CUI is a broader category of sensitive government information that requires safeguarding per law, regulation, or government-wide policy. Examples include:

  • Technical data with export controls (ITAR/EAR)
  • Critical infrastructure information
  • Proprietary manufacturer data
  • Privacy-protected information (PII)
  • Law enforcement sensitive information

CUI requires enhanced safeguarding under NIST SP 800-171 (110 controls) → CMMC Level 2

The Practical Impact

All CUI is also considered at least FCI, but not all FCI is CUI. The marking and handling of CUI follows specific DoD guidelines at dodcui.mil. If you're unsure whether you handle CUI, review your contract's DD Form 254 or consult with your Contracting Officer.

Have More Questions?

ChatCMMC can answer detailed questions about CMMC compliance, NIST 800-171, assessment preparation, and more — with source citations when available from selected official DoD and NIST sources.

Ask ChatCMMC →

CMMC Readiness Assessment

Find out where your organization stands and what steps you need to take. Jun Cyber's CMMC experts can help you interpret the requirements.

By submitting, you agree to be contacted by Jun Cyber. No spam, ever.

Related Questions

You Might Also Want to Know

CMMC Model

How Will My Organization Know What CMMC Level Is Required for a Contract?

→ CMMC Model

Is Encrypted Controlled Unclassified Information (CUI) Still Considered CUI?

→ CMMC Model

Will CMMC Requirements Flow Down to Subcontractors?

→
Jun Cyber

Ready to Start Your CMMC Journey?

Jun Cyber helps defense contractors prepare for applicable CMMC requirements. From scoping and gap assessments to documentation, remediation, and C3PAO assessment readiness — Jun Cyber provides hands-on compliance support.

📅 Schedule a Consultation Learn About CMMC Select →