FCI or CUI? The one question that sets your CMMC level

What is Federal Contract Information?

FAR 52.204-21 defines it as information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It does not include information the Government provides to the public, such as on public websites, or simple transactional information, such as what is needed to process payments (FAR 52.204-21).

In plain words: if the Government gave you or asked you to create non-public information to do the work, that is probably FCI.

What is Controlled Unclassified Information?

The National Archives describes CUI as information that requires safeguarding or dissemination controls under applicable law, regulations and government-wide policies, but is not classified (National Archives: About CUI). The rule that governs it, 32 CFR Part 2002, applies to federal agencies and to organizations that handle, possess, use, share or receive CUI.

In plain words: if your contract or the document itself marks information as CUI, treat it as CUI.

How does that map to a CMMC level?

• Level 1: companies that handle FCI but not CUI. It asks for 15 basic safeguarding requirements from FAR 52.204-21, with an annual self-assessment.
• Level 2: companies that handle CUI. It asks for 110 practices aligned with NIST SP 800-171, met through a self-assessment or a third-party assessment, depending on the contract.
• Level 3: the most sensitive programs. It asks for more than 110 practices based on NIST SP 800-172, with a government-led assessment.

The program rule is 32 CFR Part 170 (eCFR). DoD suspended Phase II on July 13, 2026, so check what your contract asks for today.

How do I know which one I handle?

Look for three things: a CMMC or DFARS 252.204-7012 clause in the contract, CUI markings on documents you receive, and what your prime tells you in writing. If you cannot tell, ask. The answer decides your level, your cost and your timeline.

What should I do next?

Try the CMMC level finder, then apply for the in-kind gap assessment grant for the level it points to.