Is This CUI or FCI?
A Contractor's Guide to Classification Decisions and Scope Documentation
One of the highest-friction stages of CMMC preparation is figuring out what data you are actually trying to protect. Getting that wrong doesn't just affect your compliance program — it determines whether you're operating under 17 controls or 110, and whether a mislabeled document silently drags an entire system into assessment scope.
Federal Contract Information (FCI) is non-public information provided by or generated for the government under a contract, governed by FAR 52.204-21, requiring 17 basic safeguarding controls under CMMC Level 1. Controlled Unclassified Information (CUI) is information the government creates or possesses that requires safeguarding under specific laws, regulations, or government-wide policy — governed by Executive Order 13556, 32 CFR Part 2002, and enforced through DFARS 252.204-7021 and DFARS 252.204-7012 — requiring all 110 NIST SP 800-171 controls under CMMC Level 2. The distinction between these two data types under 32 CFR Part 170 determines every CMMC scoping decision your organization will make.
The critical relationship between the two: CUI is always FCI, but FCI is not always CUI. Every piece of CUI in your environment is simultaneously FCI — but FCI can be entirely routine data that never rises to the CUI threshold.
What is the difference between FCI and CUI?
Before establishing a compliance boundary, every contractor must be able to distinguish between the two data types on sight — and understand the legal framework that governs each.
Federal Contract Information
Controlled Unclassified Information
CUI is always FCI, but FCI is not always CUI. The scope and cost implications of misidentifying CUI as mere FCI — and building a Level 1 program to protect it — are severe. When in doubt, assume the higher classification and ask for written confirmation.
How do contractors misidentify CUI?
Contractors frequently assume CUI will arrive perfectly stamped and labeled. In practice, three patterns account for the majority of misidentification failures — and each one can silently expand your assessment scope before you realize it.
The most consequential misconception in the defense supply chain is the belief that only the government can create and mark CUI. If the government provides you with a CUI schematic and you use it to manufacture a component, write a technical manual, or produce an engineering analysis, the derivative work you created is also CUI. You are fully responsible for identifying it, marking it, and protecting it — regardless of whether the government handed it to you with a label or not.
Draft technical materials, specifications under development, and even marketing materials created under a DoD contract are typically considered sensitive until officially cleared for public release. The absence of a final CUI marking on a working document does not mean the document is not CUI — it means the marking process hasn't been completed yet. Drafts are not public-domain-by-default.
CUI is routinely sent via standard commercial email without the sender or recipient recognizing the consequence. If a prime contractor emails you technical specifications for a quote, that data is now actively touching your commercial email environment. If it is CUI, it has just dragged your commercial email tenant — and potentially your entire Microsoft 365 or Google Workspace instance — into CMMC Level 2 assessment scope. This is one of the fastest and most expensive unintentional scope expansions in the supply chain.
How do you confirm whether information is CUI?
The primary responsibility for designating and communicating CUI status lies with the DoD or the prime contractor. That designation should flow through the contracting vehicle — in the DFARS clause, the contract's DD Form 254 (Contract Security Classification Specification), or explicit data handling instructions in the statement of work.
In practice, that communication is often incomplete, delayed, or absent entirely. When you receive technical drawings, specifications, or task documents that seem sensitive but carry no official CUI marking, you cannot wait for clarity before taking action — but you also cannot assume either classification without documentation.
What documentation do assessors expect for CUI tracking?
Assessors expect organizations to maintain rigorous control over their information lifecycle. When an assessor evaluates your scoping decisions, they are not accepting your word that certain systems are out of scope — they are looking for a documented, auditable record of what CUI and FCI exists in your environment, where it came from, where it lives, and what you created from it.
The tool that makes this possible is a Data Catalog — typically a spreadsheet maintained from contract award through contract closeout. It is the foundational document from which your Data Flow Diagram is derived, and it is what an assessor will ask to see when they challenge a scoping boundary.
| Document / Artifact | Type | Received From | Date Received | Storage Location | Derivative? | Disposition |
|---|---|---|---|---|---|---|
| System Schematic Rev C | CUI | Contracting Officer | 2024-03-12 | Secure enclave /projects/contract-001/ | Yes → see Tech Manual v1 | Active |
| Delivery Schedule Q2 | FCI | Prime PM | 2024-03-14 | Compliant SharePoint site | No | Active |
| Technical Manual v1 (draft) | Derivative CUI | Internal — derived from Schematic Rev C | 2024-04-01 | Secure enclave /projects/contract-001/derivatives/ | Source: Schematic Rev C | Active |
| Unmarked Specification — Rev 2 | Pending | Subcontractor email | 2024-04-08 | Quarantined — secure enclave pending determination | Unknown | Awaiting written CO determination |
The catalog serves three functions simultaneously: it builds your Data Flow Diagram, it demonstrates to assessors that you know exactly what CUI you hold, and it documents the chain of custody and derivative relationships that assessors will probe when evaluating your scoping rationale.
How do you prevent unintentional CMMC scope expansion from unmarked documents?
While awaiting a written determination from a contracting officer or prime, your immediate priority is containment. The risk is not just misclassification — it is that moving an unmarked but potentially sensitive document through unsecured channels contaminates systems that were previously out of scope, potentially creating a Level 2 compliance obligation on infrastructure you never planned to certify.
Update catalog entry to CUI. Confirm storage location is within your Level 2 compliant enclave. Mark the document per CUI marking requirements. Update your Data Flow Diagram to reflect the artifact. Identify any derivative works already created and ensure they are also within scope.
Update catalog entry with the determination and attach the written confirmation. If it is FCI, confirm it remains within your Level 1 scope. If it is cleared as public, document that determination and move the artifact to standard storage. Retain the written confirmation permanently.
- Do not email it internally through standard commercial email. If it is CUI, doing so drags your entire commercial email tenant into Level 2 scope — and that contamination cannot be undone by relabeling the document later.
- Do not paste its contents into uncertified systems. Job costing in QuickBooks, project tracking in a standard SaaS tool, or notes in an unmanaged cloud app — any of these can silently expand your assessment boundary before anyone notices.
- Do not share it with subcontractors until you have confirmed its classification and confirmed that the recipient's environment meets the applicable CMMC requirements. Flowing CUI to a Level 1 subcontractor is a compliance violation regardless of intent.
- Treat ambiguous artifacts as CUI until proven otherwise. The cost of over-protecting a document is negligible. The cost of under-protecting one — and having that decision surface during a breach investigation or a DIBCAC spot check — is not.
The Bottom Line
Review every contract for the presence of DFARS 252.204-7021 and DFARS 252.204-7012 to identify CUI obligations. Build a Data Catalog from day one of every DoD contract that tracks every document by source, classification, storage location, and derivative relationships. Quarantine any ambiguous document in your compliant CUI enclave immediately upon receipt. Submit a written request to the contracting officer for every classification decision you did not make yourself — and do not act on verbal responses. Mark all derivative work products as CUI unless you have documented evidence confirming otherwise. Update your CMMC level determination whenever new data types enter your environment.
Your assessment scope is only as defensible as your documentation. An assessor who asks "how do you know that system is out of scope?" needs a written answer — a catalog entry, a contracting officer determination, a VLAN diagram, a signed AUP.
Your assessment scope is only as defensible as your documentation. An assessor who asks "how do you know that system is out of scope?" needs a written answer — a catalog entry, a contracting officer determination, a VLAN diagram, a signed AUP. If the answer is "we assumed it was fine," the scope boundary will not survive the challenge.