FCI vs CUI explained for small suppliers

The short version

Think of it as two circles, one inside the other.

• FCI is the big circle: most non-public information that comes with a government contract.
• CUI is the smaller circle inside it: information that specifically requires safeguarding under law, regulation or government-wide policy.
• FCI only: FAR 52.204-21, 15 basic safeguarding requirements, CMMC Level 1 with an annual self-assessment.
• CUI: DFARS 252.204-7012, NIST SP 800-171 Rev. 2 with 110 requirements, CMMC Level 2.

Getting this right sets your whole budget. Treating FCI as CUI wastes money. Treating CUI as FCI leaves you exposed and can make your SPRS affirmations inaccurate.

What FCI is

FAR 52.204-21 defines FCI as information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government makes public and simple transactional information, such as what is needed to process payments.

Typical FCI for a small supplier:

• A statement of work or contract terms not posted publicly
• Production schedules and delivery dates for a government order
• Emails with a prime about how a part will be made or tested
• Proposals and quotes prepared for a specific government requirement
• Inspection reports you create for the contract

Usually not FCI:

• Invoices and payment details
• Anything published on a public government website
• Your general product catalog and marketing material

What CUI is

CUI is information the government creates or possesses, or that a contractor creates or possesses for the government, that a law, regulation or government-wide policy requires or permits agencies to protect with safeguarding or dissemination controls. The program is set out in 32 CFR Part 2002, and the National Archives keeps the CUI Registry, which lists the official categories.

Categories small defense suppliers run into most:

• Controlled Technical Information: engineering drawings, specifications, models, test data and process sheets for military items.
• Export controlled: technical data covered by export rules, which add their own obligations on top of CUI handling.
• Privacy: personal information the government shares or you collect for it.
• Critical infrastructure and operations security information in some contracts.

Information you create from CUI, such as a modified drawing or a machining program built from a controlled model, is generally CUI too. That is the part small shops most often miss.

How CUI is marked

Properly marked CUI is easy to spot:

• A banner at the top of each page, often also at the bottom, reading "CUI" or "CONTROLLED"
• On DoD documents, a designation block naming who controls it, the category and a point of contact
• Portion markings such as "(CUI)" before paragraphs in some documents
• On technical documents, a distribution statement. Statement A means public release. Statements B through F restrict distribution and are a strong signal the data is controlled
• Export control warnings on drawings or data packages

You may also see older markings such as "FOUO" on legacy documents. Treat them as a cue to ask how they should be handled now.

When something is not marked but looks controlled, do not guess. Protect it as CUI for now and ask your prime or contracting officer in writing. Keep their answer.

Who tells you, and how flow-down works

The government is responsible for identifying CUI in the contract. DFARS 252.204-7012 covers information that is marked or otherwise identified in the contract and provided to you, or that you collect or develop in performing it.

As a subcontractor, you usually learn about obligations through flow-down clauses:

1. FAR 52.204-21 flows down to subcontracts where the subcontractor may have FCI, except for commercially available off-the-shelf items.
2. DFARS 252.204-7012 flows down when your work involves covered defense information, which includes CUI.
3. DFARS 252.204-7021, the CMMC clause, flows down with the CMMC level that applies to your part of the work.

Check the terms and conditions on your purchase orders. Clauses are often included by reference, meaning a short line of clause numbers rather than full text. If you see 7012 or 7021 there, assume it matters and confirm with your prime. DFARS clause text is published through the Office of the Under Secretary of Defense for Acquisition.

FAR 52.204-21's 15 requirements vs NIST SP 800-171

The 15 FAR requirements are basic hygiene:

1. Limit system access to authorized users.
2. Limit users to the transactions and functions they are allowed to perform.
3. Verify and control connections to outside systems.
4. Control information posted on publicly accessible systems.
5. Identify users, processes and devices.
6. Authenticate them before allowing access.
7. Sanitize or destroy media before disposal or reuse.
8. Limit physical access to systems and equipment.
9. Escort visitors, keep physical access logs and control keys and badges.
10. Watch, control and protect communications at system boundaries.
11. Put publicly accessible systems on separate subnetworks.
12. Find, report and fix flaws promptly.
13. Protect against malicious code.
14. Keep that protection updated.
15. Run periodic scans and real-time scans of files from outside sources.

NIST SP 800-171 Rev. 2 covers these and goes much further: multifactor authentication, audit logging and review, configuration baselines, incident response planning and reporting, security training, encryption, risk assessments and a written System Security Plan. That jump from 15 to 110 is why the FCI or CUI question deserves a careful answer. The full NIST text is at csrc.nist.gov.

What to ask your prime

Send these questions in writing and file the answers:

• Will we receive CUI under this subcontract? If so, which categories?
• Which documents or data sets are CUI, and how will they be marked?
• Which clauses apply to us: 52.204-21, 252.204-7012, 252.204-7021?
• What CMMC level will you require of us, and by when?
• How should we receive and return CUI? Do you provide a secure portal?
• Will anything we create from your data be treated as CUI?
• Who do we contact if we receive something unmarked or by mistake?

CMMC status is changing, so also check the DoD CIO CMMC site. When you know you handle CUI, read CMMC Level 2 readiness for small defense suppliers. Keith Systems offers readiness help only; we are not a C3PAO and do not certify anyone. Book a free security consult or call (805) 800-8163.