Not all defense contract information is treated equally under CMMC. Learn what separates FCI from CUI, and why it matters for compliance scope.
-------------------------------------------------------------------------------------------------------------------
TL;DR: Not every piece of government-related information at a defense supplier carries the same weight. Federal Contract Information and Controlled Unclassified Information sit at opposite ends of CMMC's requirements, and mixing them up leads to either an overbuilt security program or a real gap in coverage. A straightforward self-audit, checking actual contract clauses and document markings, settles the question without guesswork.
-------------------------------------------------------------------------------------------------------------------
Not every piece of mail that shows up needs a signature. A postcard gets tossed in the box with everything else. A certified letter needs someone to sign for it, and the chain of custody matters the whole way through. The content inside decides which kind of handling it gets, not how thick the envelope is or who sent it.
Federal Contract Information and Controlled Unclassified Information work the same way. Both show up because of the same general source, a government contract, but they don't carry the same weight once they land on a desk. One might be a purchase order with specs that were never meant for a public bid board. The other might be technical drawings detailed enough that losing control of them actually matters well beyond one company's four walls. CMMC doesn't ask a shop to guess which is which. It draws a hard line between the two, and that line decides almost everything about what happens next.
This question is showing up more often because customers are getting more specific about what's flowing down through their contracts, and "we're small, this probably doesn't apply to us" isn't holding up the way it used to. Getting the answer wrong in either direction costs something. Treating everything like it needs a signature burns time and money on controls that were never necessary. Treating a signed, certified piece of information like an ordinary postcard leaves a real gap and makes any assessment or affirmation inaccurate.
Sorting this out isn't about company size or how nervous a new clause makes someone feel. It comes down to what's actually sitting inside the envelope, and there's a straightforward way to check.
Federal Contract Information traces back to a single federal rule: Federal Acquisition Regulation (FAR) clause 52.204-21, which has been on the books since 2016. Strip away the legal language and the definition comes down to three questions worth asking about anything crossing a desk. Did the government hand it over, or did it get created while working the contract? Is it tied to actually building or delivering what's under contract? And does it avoid the two carve-outs, information already released to the public, or plain transactional details like an invoice number?
Check all three boxes and it's FCI. Miss one, and it's just paperwork.
For a manufacturer, that usually shows up in places nobody would peg as "government data" at a glance. A purchase order with specs that were never meant for a public bid board. A delivery schedule tied to a program that the general public has no reason to know about. Even a routine email about how a contract's going can qualify, if it's meant for the government's eyes and nobody else's.
None of that sounds like classified material, and it isn't. FCI sits at the lower end of what CMMC protects, which is exactly why Level 1 only asks for 15 straightforward practices instead of a heavier framework. The information matters. It just doesn't carry the weight of what's coming next.
FCI is the baseline. Controlled Unclassified Information is the step up, and it's the reason CMMC Level 2 exists at all.
The government doesn't leave CUI up to guesswork. Information gets marked as CUI, or it's covered by a law, regulation, or government-wide policy that says it needs safeguarding, even though it isn't classified. For a defense supplier, that usually means technical drawings, engineering specs, unclassified export-controlled data, or anything tied to a program the Department of Defense has flagged for protection. There's a registry behind all of it too. The National Archives keeps a public list of CUI categories, so a shop that's unsure whether something qualifies has a place to check rather than guessing.
That marking is the tell. FCI rarely announces itself. CUI usually does, whether it's a banner on a document, a note in a contract clause, or language buried in a technical data package. The habit worth building is simple: when a document says CUI anywhere on it, or a contract references NIST SP 800-171, treat everything connected to that work as if it's covered, not just the one file with the label on it.
The practices don't scale gently between the two either. Level 1 covers FCI with 15 practices. Level 2 covers CUI with 110, pulled straight from NIST SP 800-171. That's not a rounding error. It's a different category of protection for a different category of risk, and it's worth understanding before a shop assumes its existing setup is close enough.
Knowing the definitions is one thing. Figuring out where FCI and CUI actually live inside a shop's own paperwork is another, and that's where most manufacturers get stuck.
Start with the contracts themselves, not the file cabinet. Every contract naming DFARS 252.204-7012 is a flag that CUI is somewhere in the relationship, even if the current job only involves FCI. That clause carries its own set of incident-reporting and safeguarding obligations, and reading it straight through beats skimming, because it tells a shop what it agreed to before the first part ever got quoted.
From there, walk the actual workflow. A quote request, a purchase order, a technical drawing, a shipping document, a quality report headed back to the customer. At each stop, ask what the document contains and who it came from. Information that arrived from the government or the prime, feeding into work under contract, and never meant for public release, counts. A drawing stamped with a distribution statement or CUI banner counts on sight. Internal notes about pricing or scheduling that never touch the government side of the fence usually don't.
Two mistakes cancel each other out here. Treating everything as CUI buries a shop in Level 2 requirements it may not need, at a cost that doesn't match the actual risk. Treating nothing as CUI because "we're just a small shop" ignores what's already sitting in the inbox. Neither one holds up under an assessment, and neither one is a shortcut.
CUI showing up doesn't just add more items to a checklist. It changes the whole shape of the job.
Level 1's 15 practices are mostly the stuff a shop's already doing, or close to it: solid password habits, keeping the shop floor secure, not leaving sensitive paperwork lying around. None of it requires touching how the network's built. Level 2 is a different animal. It's 110 practices, borrowed from NIST SP 800-171, get into access control, incident response, monitoring, the kind of things that only make sense once there's real network architecture to hang them on. That's a bigger conversation than one section can hold, and this series covers it in full elsewhere.
Here's the good news, though. A shop handling CUI doesn't have to lock down every machine on the floor to get compliant. Plenty of manufacturers build what's called a CMMC enclave instead, a separate, tightly controlled slice of the network, sometimes just a handful of computers, built specifically to handle CUI while the rest of the shop keeps running the way it always has. Get that boundary right and the compliance burden stays proportional to the actual risk instead of swallowing the whole operation. Getting it wrong is its own headache, and it gets its own post later in this series.
One thing stays constant through all of it. Every shop starts at FCI and Level 1, no exceptions. CUI is what raises the ceiling. It was never a replacement for the floor.
Most shops don't get CMMC scope wrong because they're careless. They get it wrong because nobody's ever asked them to draw a clean line around where FCI and CUI actually live in the business, so they guess.
The over-scoping mistake looks responsible from a distance. Lock down everything, every workstation, every server, every laptop somebody occasionally checks email on, and call it a day. It feels safe. It's also expensive, and it usually means treating the accounting department's invoices the same way as a technical drawing marked for CUI. That's not caution. That's just a bigger bill for the same amount of actual protection.
The under-scoping mistake is quieter and more common. A shop assumes CMMC only touches "the government stuff," meaning whatever folder the contracts sit in, and leaves the rest of the network alone. Then it turns out CUI got emailed to three people, saved on a shared drive nobody locked down, and printed for a meeting that happened six months ago. Scope isn't about which folder something's in. It's about where the information actually travels once it enters the building.
This is usually where an outside set of eyes earns its keep. An MSP that's handled this scoping conversation before can walk a shop's actual data flow and flag both mistakes before an assessor does it for them, and that's a meaningfully different position to be in. Whether that MSP can also carry pieces of the compliance work itself, and how far that goes, is something we explore in companion blogs.
The shops that stay in the game have all picked up the same habit, judging a document by what's inside it rather than where it sits. FCI shows up in ordinary places, purchase orders, delivery schedules, routine correspondence, and it earns Level 1's 15 practices the moment it's tied to government work not meant for public eyes. CUI raises the stakes further. It's marked, it's registered, and it pulls in NIST SP 800-171's 110 practices the moment it enters the building. Run the three-question test, walk the actual paperwork, check the document instead of the folder, and it all comes back to the same skill...reading what's inside the envelope instead of assuming based on the label.
Getting that skill right matters more than it might seem from the outside. A shop that over-scopes burns money protecting invoices like they're technical drawings. A shop that under-scopes finds out the hard way, usually from an assessor, that CUI's been circulating unprotected for months. Either mistake costs more than the work of sorting it out up front would have.
That sorting work is exactly where CNWR spends its time with Toledo-area defense contractors. Walking a shop's actual data flow, spotting where FCI and CUI really live, and building a scope that matches the real risk instead of a guess, that's not a generic compliance exercise. It's the kind of groundwork that keeps a Level 1 or Level 2 assessment from turning into a surprise.
If sorting out what's actually in the envelope feels like more than one shop wants to take on alone, reach out to CNWR. Compliance gets a lot simpler once the guesswork is gone.
1. Does every defense contractor need to worry about CUI?
No. A shop that only handles FCI, information tied to a contract but never marked or regulated as CUI, only needs to meet Level 1's 15 practices. CUI only enters the picture when a contract or document actually calls for it.
2. How can a shop tell if something is CUI?
Look for a marking or banner on the document itself, or a reference to a specific law, regulation, or government-wide policy requiring its protection. The National Archives keeps a public registry of CUI categories for anything that isn't clearly labeled.
3. What happens if a shop misjudges its own scope?
Over-scoping means spending money protecting information that never needed Level 2 controls. Under-scoping means CUI circulates unprotected until an assessor catches it, which usually costs far more to fix after the fact than it would have to scope correctly from the start.