What is the difference between FCI and CUI?

FCI (Federal Contract Information) is non-public information provided by or generated for the Government under a contract, defined in FAR 52.204-21. CUI (Controlled Unclassified Information) is information that a law, regulation, or Government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls, defined in 32 CFR 2002.4. CUI carries far more safeguarding requirements.

Is public information FCI?

No. The FAR definition excludes information the Government provides to the public, such as on public websites, and simple transactional information such as what is needed to process payments.

How many requirements apply to each?

CMMC Level 1 consists of the 15 basic safeguarding requirements in FAR 52.204-21. CMMC Level 2 is identical to NIST SP 800-171 Rev 2, which has 110 requirements.

How do I know if I have CUI?

Ask your prime contractor or contracting officer in writing. CUI is defined by laws, regulations, and Government-wide policies outside your contract, so the reliable answer comes from the party that gave you the information. Your contract clauses, such as DFARS 252.204-7012, are also a signal.

Does the basic safeguarding clause apply to subcontractors?

Yes, where the subcontractor may have Federal Contract Information residing in or transiting through its information system. The clause does not flow down to subcontracts for commercially available off-the-shelf items.

Guide

FCI vs CUI: what's the difference?

Two abbreviations decide how much security work a defense contract brings with it. FCI is Federal Contract Information. CUI is Controlled Unclassified Information. They are defined in different rules, and the safeguards attached to them are very different in size: 15 basic requirements for one, 110 for the other.

Written by WorkuGRC. Last updated November 12, 2026.

Topic	FCI	CUI
Defined in	FAR 52.204-21	32 CFR 2002.4
In short	Non-public information provided by or generated for the Government under a contract	Information that a law, regulation, or Government-wide policy says must be safeguarded or have its sharing controlled
Baseline safeguards	15 basic requirements (FAR 52.204-21)	110 requirements (NIST SP 800-171 Rev 2)

What FCI is

The Federal Acquisition Regulation defines Federal Contract Information as information that is not intended for public release and that is provided by, or generated for, the Government under a contract to develop or deliver a product or service to the Government.

Two things are excluded:

information the Government has made public, such as on public websites;
simple transactional information, such as what is needed to process payments.

In everyday terms: if you have a federal contract, the non-public details of that work that sit on your computers generally fall under this definition. It is a broad category, which is why its safeguards are the basic ones.

What CUI is

The federal CUI rule defines Controlled Unclassified Information as information the Government creates or possesses, or that someone creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls.

The key idea is that something outside the contract (a law, a regulation, a Government-wide policy) is what makes the information controlled. It is not classified information, which is handled under separate rules.

Because the category depends on those outside authorities, the safest way to know whether something you received is CUI is to ask. Put the question to your prime contractor or contracting officer in writing and keep the answer.

Why the difference matters

The safeguards scale with the category:

CMMC Level 1 consists of the 15 basic safeguarding requirements in FAR 52.204-21, the clause that covers contractor systems holding FCI. No POA&M is allowed at this level, and the self-assessment is annual.
CMMC Level 2 is identical to the requirements in NIST SP 800-171 Rev 2, whose title is “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. That is 110 requirements, assessed through 320 objectives.

The jump from 15 to 110 is the reason to find out early which kind of information your contracts involve. It changes the cost, the time, and the documents you need.

Which level applies to you

The solicitation or contract states the CMMC level it requires. That, and what your prime flows down to you, is the authority. This page cannot tell you your level, and neither can any software: it depends on the specific information a specific contract involves.

What you can do today:

Look in your contracts and subcontracts for FAR 52.204-21 (basic safeguarding) and for DFARS 252.204-7012 and DFARS 252.204-7021 (the clauses tied to CUI and CMMC). Older contracts may also carry DFARS 252.204-7019 and -7020.
Ask your prime, in writing, whether the work involves CUI and which CMMC level applies.
If the answer is FCI only, start with the free Level 1 checker.
If CUI is involved, start with your estimated SPRS score and the Level 2 self-assessment checklist.

A note for subcontractors

The basic safeguarding clause flows down. A contractor must include it in subcontracts where the subcontractor may have Federal Contract Information residing in or passing through its systems. The exception is subcontracts for commercially available off-the-shelf items. So a small supplier can be covered without ever dealing with the Government directly.

Where WorkuGRC fits

WorkuGRC drafts the documents for a Level 2 self-assessment and offers a free Level 1 check. It is built so that it never asks for your CUI or contract documents: you answer multiple-choice questions about your environment, and there are no document uploads. See security and data handling.

Frequently asked questions

What is the difference between FCI and CUI?: FCI (Federal Contract Information) is non-public information provided by or generated for the Government under a contract, defined in FAR 52.204-21. CUI (Controlled Unclassified Information) is information that a law, regulation, or Government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls, defined in 32 CFR 2002.4. CUI carries far more safeguarding requirements.
Is public information FCI?: No. The FAR definition excludes information the Government provides to the public, such as on public websites, and simple transactional information such as what is needed to process payments.
How many requirements apply to each?: CMMC Level 1 consists of the 15 basic safeguarding requirements in FAR 52.204-21. CMMC Level 2 is identical to NIST SP 800-171 Rev 2, which has 110 requirements.
How do I know if I have CUI?: Ask your prime contractor or contracting officer in writing. CUI is defined by laws, regulations, and Government-wide policies outside your contract, so the reliable answer comes from the party that gave you the information. Your contract clauses, such as DFARS 252.204-7012, are also a signal.
Does the basic safeguarding clause apply to subcontractors?: Yes, where the subcontractor may have Federal Contract Information residing in or transiting through its information system. The clause does not flow down to subcontracts for commercially available off-the-shelf items.

Find out where you stand.

A two-minute Level 1 check if you hold only FCI, or an estimated SPRS score if CUI is involved. Both free, no signup.

Estimate my score →

Informational only — not a compliance determination, an assessment, or legal advice. Requirements are defined by NIST SP 800-171 Rev 2, NIST SP 800-171A, the DoD Assessment Methodology, and 32 CFR Part 170; always verify against the official publications.