CUI vs FCI: Which Data Triggers Which CMMC Level

Almost every expensive CMMC mistake I've seen traces back to the same first step done wrong: not being clear about what data you actually hold. Contractors either panic and treat everything as CUI — and buy a Level 2 effort they never needed — or they wave off real CUI as "just contract paperwork" and end up non-compliant on a contract they can't legally keep. Both are costly. Both come from skipping five minutes of clear thinking about FCI versus CUI.

So let's make it clear. This is the decision that sits upstream of everything else in CMMC — your level, your control count, your documentation load, and ultimately your bill. Nail it and the rest of the path is just execution.

What FCI actually is

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that isn't intended for public release. It's the everyday, non-public working data of doing federal business — the emails, the delivery schedules, the internal project details, the stuff that isn't marketing material but also isn't especially sensitive. If you have a government contract at all, you almost certainly handle FCI.

FCI still has to be protected, but the bar is basic. Think of it as the government saying: "don't leave our non-public business lying around in public." The safeguarding expected is a short list of fundamental hygiene — the kind of practices any competent small business should already have.

What CUI actually is

Controlled Unclassified Information (CUI) is a narrower, more sensitive category that the government specifically identifies and requires to be safeguarded and, in many cases, marked. It's not classified — but it's information whose loss genuinely matters. In the defense world, that's things like technical drawings, engineering specifications, controlled technical data, and other program information the government has decided needs real protection.

The key relationship to hold onto: all CUI is sensitive federal information, but not all federal information rises to CUI. CUI is a subset — the sensitive slice that carries heavier obligations. When CUI is in play, the government isn't asking for basic hygiene anymore. It's asking for the full NIST 800-171 control set, documented and provable.

How to tell which one you handle

Don't guess, and don't assume. Work through it in order — the answer is almost always sitting in your contract if you read it properly.

1. Read the contract clauses.Look for the clauses that flow safeguarding requirements down to you. Basic safeguarding language points to FCI. Clauses that invoke protection of covered defense information and NIST 800-171 point to CUI. This is the strongest single signal.
2. Check for markings.Documents that carry CUI markings are telling you directly. If the government or your prime is handing you marked material, you handle CUI — full stop. Absence of markings isn't proof of absence, though, so keep going.
3. Look at the nature of the data.Technical drawings, specifications, controlled technical data, and detailed program information lean CUI. Schedules, non-public correspondence, and ordinary contract administration lean FCI. Ask what the data would do in the wrong hands.
4. Ask the contracting officer — in writing.When it's genuinely unclear, don't self-diagnose. Ask the contracting officer or your prime to confirm, and get it in writing. A five-minute email beats a five-figure wrong assumption in either direction.

How it decides Level 1 vs Level 2

Here's where the data type becomes a dollar figure. The category you handle maps directly onto your CMMC level, and the levels are worlds apart in effort.

If your work only touches FCI, you're generally in Level 1: a smaller set of fundamental safeguards, met through self-assessment. It's real work, but it's manageable for a small shop without turning the business upside down.

The moment CUI enters, you're in Level 2: all 110 controls, a full System Security Plan, roughly 20 documented policies, and — for prioritized programs — a certified third-party assessment. That's the jump. It's not a small step up; it's a different tier of obligation. Which is exactly why you don't want to land there by accident, and don't want to escape it by wishful thinking.

Why scoping this drives your entire cost

This is the part that separates the shops that stay in federal work from the ones that walk away from a scary quote. Identifying CUI correctly is step one. Containing it is what makes Level 2 affordable.

Remember: CMMC only assesses the systems that store, process, or transmit CUI. So if CUI touches your whole network — every laptop, every server, every user — then your entire company is in your Level 2 assessment boundary, and you're implementing 110 controls everywhere and paying to have all of it assessed. That's the number that makes small contractors flinch.

But you control that boundary. If you scope CUI into a small, segmented enclave — a handful of workstations, one encrypted storage location, a controlled connection — then only the enclave falls into scope. The rest of your network stays out. Same 110 controls, applied to six machines instead of forty. That's the whole game, and it's why identifying CUI accurately matters so much: you can't contain data you haven't correctly identified.

The full mechanics of that containment strategy — how to build the enclave, what hardware enforces the boundary, and where the 40–60% savings actually come from — live in the CUI enclave method. It's the natural next read once you've confirmed you handle CUI. And if you want the line-item dollar picture, the honest breakdown of CMMC cost for a small business shows where every cost sits and how scoping cuts each one.

Not sure where you stand yet? The free SPRS score estimator gives you a baseline against the 110 controls in about two minutes — a fast way to see the size of a Level 2 effort before you commit to anything.