CUI vs FCI: Telling Them Apart in Your Own Contracts

The definitions are not hard. FCI is non-public information provided by or generated for the Government under a contract. CUI is information that a law, regulation or government-wide policy requires be safeguarded. Anyone can recite that.

The hard part is Tuesday afternoon, with a purchase order from a prime, a folder of drawings, no banner markings anywhere, and a decision to make about whether the next twelve months cost you five thousand dollars or fifty. This post is about that afternoon.

The test is the authority, not the sensitivity

The most common mistake is reasoning from how sensitive something feels. That instinct produces both errors at once — people wave through a mundane-looking parts list that is genuinely controlled, and they lock down a proposal that is merely commercially confidential.

CUI is a legal category. Something is CUI because a specific law, regulation or government-wide policy says it gets safeguarding or dissemination controls, and that authority appears in the CUI Registry at the National Archives. Export-controlled technical data. Controlled technical information. Critical infrastructure security information. Procurement and acquisition information. A few dozen more.

FCI has no such authority behind it. It is the residual category: under a contract, not public, not an invoice. Which is why almost every federal contractor has FCI and only some have CUI.

Two consequences worth stating plainly. All CUI in a contract context is also FCI — CUI is the subset carrying an additional authority, not a parallel category. And designation is the Government’s job. An authorised holder at the designating agency decides something falls in a CUI category and marks it. You do not have that authority, in either direction.

So why is nothing marked?

Because in practice the marking discipline is inconsistent, and the gap between the rule and the reality is where small contractors get hurt.

A properly handled contract carries CUI identification and marking guidance telling you what will be provided as CUI, what categories apply, and how to mark what you generate. A great many contracts and subcontracts arrive without it. When they do, the deficiency is on the Government’s side of the line — and the consequence still lands on yours, because if controlled information ends up on an unprotected system, “nobody marked it” is an explanation rather than a defence.

There is also the sentence in DFARS 252.204-7012 that people read past. Covered defense information includes information you collect, develop, receive, transmit, use or store in performance of the contract. Your process sheets, your inspection data, your CAD models derived from the Government’s drawing — those can be covered even though nobody handed them to you with a marking on them, because you created them. Nobody was ever going to mark those for you.

The four situations you will actually encounter

1. It is marked

A banner marking at the top of the page reading CONTROLLED or CUI, usually with a category, sometimes with a limited dissemination control, and a designation indicator naming the agency that designated it. This is the easy case. Treat it as CUI, and note the category — CUI Specified categories carry handling rules of their own beyond the baseline.

2. Nothing is marked, but 7012 is in the contract

The presence of DFARS 252.204-7012 is the Government telling you it anticipates covered defense information under this contract. That clause is not decoration; a contracting officer put it in for a reason.

The right move is a short written question — to the contracting officer, or to the prime’s contracts point of contact — asking whether CUI is anticipated under the contract and requesting the CUI identification and marking guidance. Keep the answer. It is the strongest documentation you can hold about what you reasonably believed, and it costs one email.

Until it comes back, protect the material. It is far cheaper to over-protect for six weeks than to move controlled data out of an unprotected environment after the fact.

3. Nothing is marked, no 7012, but the material looks controlled

This is the genuinely ambiguous case, and there are secondary signals that resolve most of it. Look at the documents themselves, not the contract.

• Distribution statements. Technical documents carry them. Distribution Statement A means approved for public release — that is a strong indication the document is not controlled. Statements B through F all restrict distribution, and a restricted distribution statement on a technical document is a serious flag.
• Export control notices. A warning notice referencing the export administration regulations or the arms export control act means the technical data is export-controlled, which is its own authority and its own CUI category, entirely independent of whether anyone remembered a banner marking.
• Legacy markings. “For Official Use Only,” “Sensitive But Unclassified,” “Proprietary — Government Purpose Rights.” These predate the CUI programme and were largely absorbed into it. An FOUO stamp on a document is a signal that somebody, at some point, decided this was not for general release.
• The nature of the drawing package. Detailed design, manufacturing and process data for a military system is close to the definition of controlled technical information whether or not the transmittal was marked.

4. Everything from a prime is stamped CUI

The opposite failure, and increasingly common. Some primes mark their entire supplier package as CUI because it is cheaper for them to over-mark than to make determinations, and the cost of that decision lands on you as an expanded boundary.

You are allowed to ask. A polite note asking which CUI category applies and what the underlying authority is will, reasonably often, produce either a real answer you can work with or a revised package. Over-marking is a recognised problem in the CUI programme, not a bureaucratic inevitability, and a prime’s supplier quality organisation generally does not want to be paying for your enclave either.

The working decision table

What you have	Treat as	And also
CUI banner marking present	CUI	Record the category; check whether it is CUI Specified
7012 in the contract, nothing marked	CUI, provisionally	Ask in writing; protect meanwhile
Export control notice or restricted distribution statement	CUI	Export authority applies regardless of markings
FOUO or other legacy marking	CUI, provisionally	Ask what the current designation is
Only FAR 52.204-21, no technical data, nothing marked	FCI	15 requirements; document the determination
Distribution Statement A, publicly released	Neither	Public release means public
Your own pricing, your own proprietary process	Neither — it is yours	Protect it because it is valuable, not because a clause says to

That last row matters more than it looks. Your proprietary information is not CUI. Mixing the two in the same mental bucket is how companies end up building a compliance programme around protecting things no regulation requires them to protect, and it inflates every subsequent estimate.

Why “just treat everything as CUI” is a bad answer

It sounds conservative. It is the most expensive mistake available to a small contractor, and it has two distinct costs.

The obvious one is scope. Every system that touches CUI is in scope for 110 requirements. Deciding that everything is CUI means deciding that everything is in scope, and I have watched that single afternoon’s decision turn a manageable enclave into a company-wide programme. That is the argument in CUI Scoping: The Decision That Determines Your Entire CMMC Budget, and it is the reason this determination deserves care rather than reflex.

The less obvious one is that over-marking degrades the system. When everything carries a marking, the marking stops carrying information, and people stop reading it. Over-designation is treated as a real defect in the CUI programme precisely because it destroys the signal that makes the programme work. If the answer to “is this CUI?” is always yes, nobody is asking the question any more.

Provisional protection while you get an answer is prudent. Permanent blanket designation because getting an answer is annoying is not the same thing.

Write the determination down

Whatever you decide, the decision is an artifact. One short record per contract, and it should survive the departure of whoever made it:

• Contract or purchase order number, and the customer
• Which cybersecurity clauses are present
• What information you receive and what you generate under it
• Markings, distribution statements and export notices observed — including their absence
• The determination: FCI, CUI, or neither, and the reasoning in two sentences
• Any question you asked and the answer you got, with dates
• Which of your systems the material is authorised to touch

That file is what makes your System Security Plan boundary defensible, and it is what an assessor, a prime’s auditor or a lawyer will ask for when the question is why you treated something the way you did. It takes about fifteen minutes per contract and it is the highest-value fifteen minutes in the whole programme.

One thing on the horizon

The FAR Council published a proposed CUI rule in June 2026 as part of the wider FAR overhaul. It would standardise how CUI requirements are communicated across all federal agencies rather than just the Department, introduce a standard form for identifying CUI on a contract, and set a 72-hour incident reporting window government-wide.

It is a proposed rule. It is not final, the comment period closed in July 2026, and the version that eventually lands may differ. Do not restructure anything around it yet. But the direction of travel is toward the Government being clearer about what is CUI on a given contract — which is the right direction, and which will not help you at all with the contracts already in your file.

Those you still have to work out yourself, one folder at a time, and write down why.

---

Where to go next

• Not sure what your contracts actually put you on the hook for? The CMMC readiness quiz takes about five minutes.
• Our CMMC guide for small contractors walks CUI identification, scoping and the 110 requirements in order.
• Want the contract determination record and the marking checklist already built? Start with our CMMC packets.