CUI vs FCI: which safeguarding rules apply to your contract
Federal contract information (FCI) triggers the 15 safeguards in FAR 52.204-21, which map to CMMC Level 1. Controlled unclassified information (CUI) triggers the NIST SP 800-171 requirements, which map to CMMC Level 2 under the Revision 2 baseline in force today. The deciding question is not how large your company is or how sensitive the work feels. It is what information the contract actually involves and whether the Government has marked or identified it. Information that is not intended for public release and was provided by or generated for the Government under the contract is FCI, unless it is simple transactional data such as payment processing records. Information that a law, regulation or Governmentwide policy requires an agency to protect with safeguarding controls is CUI, and it is usually identified through markings, the contract's terms or the CUI Registry. Read the solicitation's clauses first, then the statement of work, and list every information type the contract produces or receives.
Your roles are clear before any assessment starts. Your organization owns its controls and the decisions about what information it handles. An implementation partner, such as DeployOpen, can prepare systems, configurations and evidence against the applicable requirements, but it does not decide whether a given contract involves CUI. Only an independent assessor or certification body issues reports or certificates. Ask the contracting officer or prime contractor in writing which information categories are CUI and which are FCI, and keep that answer in the contract file. For subcontractors, the same test applies: a flow-down that covers only FCI points to Level 1, while any CUI in scope points to at least Level 2 under 32 CFR 170.23(a). If the answer is unclear, treat the information as CUI until the Government or prime confirms otherwise, and confirm the flow-down terms with your contracts team before scoping your system.
FCI and CUI safeguarding side by side
This table compares the rule source, requirement count, CMMC level, assessment type and subcontractor obligation for federal contract information and controlled unclassified information. Read each row against your contract: the column that matches the information your team handles sets the safeguarding baseline and the subcontractor level you must flow down.
| Aspect | Federal contract information (FCI) | Controlled unclassified information (CUI) |
|---|---|---|
| Source of the rule | FAR 52.204-21 basic safeguarding clause | NIST SP 800-171, applied through the contract or agreement |
| Number of requirements | 15 basic safeguarding requirements | 110 requirements in Rev. 2, the version CMMC Level 2 uses |
| CMMC level | Level 1 (15 safeguarding requirements of FAR 52.204-21) | Level 2 (110 requirements of NIST SP 800-171 Rev. 2) |
| Assessment type for subcontractors | Level 1 (Self) | At least Level 2 (Self) |
| Information covered | Information not intended for public release that is provided by or generated for the Government under a contract | Information the Government or a contractor creates or holds for the Government that a law, regulation or policy requires to be safeguarded |
| Clause that also applies | FAR 52.204-21(b)(2) keeps other CUI safeguarding requirements in force | DFARS 252.204-7012 applies to DoD covered defense information |
| Questions to confirm with the prime | Does the contract involve FCI only, and which system stores it? | Is any information marked or identified as CUI, and which Rev. 2 or Rev. 3 version does the contract name? |
Which rules apply to your contract
Five decision points determine which safeguarding rules reach your systems: what the contract marks, what DFARS covers, what your work creates, whether you only hold FCI, and whether a civilian agency sets the terms. Run them in order, because the answer to one often changes the next.
Check the contract for CUI markings
Start with the contract's CUI markings or identifications. Look for a CUI designation indicator, a CUI categories list or a statement of work reference to CUI. If the contract marks or identifies CUI, the information falls under the CUI rules, and the safeguarding requirements of NIST SP 800-171 are the baseline your systems must meet. Ask the contracting officer to confirm any gap between the marking and the work you perform.
Test for covered defense information
Under DFARS 252.204-7012, covered defense information includes controlled technical information and other CUI that is marked or identified in the contract and provided by or for DoD, or that you collect, develop, receive, transmit, use or store in performing the contract. If your systems hold DoD CUI, the clause applies to them. Confirm the DFARS clause version in the contract and any class deviation that changes which NIST revision the contracting officer cites.
Map information created during performance
Information you generate while performing the contract can be CUI even when the Government never marked it. Engineering drawings, test results and technical reports produced for a DoD task may fall within the covered defense information definition. Inventory the data types your team creates under the contract and record which ones the contract's identification rules reach. Ask the prime or contracting officer to resolve any unclear items in writing.
Confirm when you only handle FCI
If the contract involves only federal contract information, meaning information not intended for public release and provided or generated under the contract, FAR 52.204-21 sets 15 basic safeguarding requirements for your systems. These map to CMMC Level 1. Simple transactional information, such as payment processing data, is excluded from the FCI definition. Document this determination so your system boundary and any CMMC self-assessment reflect a Level 1 scope rather than a Level 2 scope.
Check civilian agency CUI obligations
Under 32 CFR 2002.14(h)(2), federal agencies must use NIST SP 800-171 when setting requirements for CUI on nonfederal systems, unless the CUI category's authority prescribes other safeguards or an agreement sets protection above the moderate level. If your organization handles CUI for a civilian agency, the agency's contract or agreement, not CMMC, sets the rules. Ask the agency which revision applies, who assigns any organization-defined parameters, and who is responsible for compliance questions.
What the 15 FAR 52.204-21 safeguards ask for
The 15 basic safeguarding requirements in FAR 52.204-21(b)(1) set the floor for any contractor system that processes, stores or transmits Federal contract information. They cover the familiar basics: limiting system access to authorized users, authenticating those users before they get in, controlling who can reach the system and what they can do once inside, and escorting visitors through areas where systems are kept. The clause also expects contractors to sanitize media before it is reused or discarded, to control the boundary between the system and outside networks, to fix known flaws in a timely way, and to run malware protection. Read the clause itself on eCFR and map each item to a concrete setting, account list, firewall rule or patch record in your own environment.
For an implementation team, the practical work is to show that each of the 15 items is implemented and can be shown to someone else. Expect questions such as: which accounts can log on, how many of them are shared, whether multifactor authentication is enforced for remote sessions, which firewall rules allow inbound traffic, how a patch cycle is tracked, and who signs off on media destruction. Confirm with your contracting officer or prime whether the contract is FCI only. If it is, these 15 safeguards are the full baseline for that system. If the contract also involves CUI, the clause is not the end of the job, because 52.204-21(b)(2) states that it does not relieve contractors of other CUI safeguarding requirements. In that case, the NIST SP 800-171 requirements apply on top of these safeguards.
How FCI and CUI map to CMMC Level 1 and Level 2
Each CMMC level checks one set of safeguarding rules, and the level a contract requires follows from whether the contractor handles only FCI or also CUI. The cards below separate the two rule sets, explain what the CMMC final rule does and does not add, and flag the current status of the Rev. 2 and Rev. 3 transition.
Level 1 covers FCI safeguards
CMMC Level 1 checks the 15 basic safeguarding requirements of FAR 52.204-21 for systems that process, store or transmit Federal contract information. The level applies when a contract involves FCI but no CUI. Before accepting a Level 1 requirement, confirm with the contracting officer that no information in scope is marked or identified as CUI, because that would move the work to Level 2.
Level 2 covers CUI under Rev. 2
CMMC Level 2 checks the 110 requirements of NIST SP 800-171 Rev. 2 for systems that handle CUI under 32 CFR 170.14. A contractor that creates, receives or stores CUI in performance of a DoD contract needs a Level 2 assessment at the level the contract specifies. Map which systems touch CUI first, because the scope of Level 2 is set by where CUI goes, not by the contract's total value.
No new requirements in CMMC
The CMMC final rule states that Level 1 adds no security requirements beyond FAR 52.204-21, and Level 2 adds none beyond NIST SP 800-171 Rev. 2. CMMC verifies that requirements already in force are implemented. A gap found in an assessment is a gap in an obligation the contractor already had, so the readiness work is the same work whether a contract cites CMMC or the underlying clause.
Rev. 2 status in the DoD deviation
DoW Class Deviation 2026-O0025, Revision 3, signed 3 September 2026, has contracting officers use a revised DFARS 252.204-7012 that names SP 800-171 Revision 2. The same deviation cites a 13 July 2026 DoW CIO memorandum requiring baseline compliance with Rev. 2 while CMMC Phase 2 is suspended. Confirm the current Phase status and the clause version in each solicitation, because both change the obligations on the contract.
Proposed move to Rev. 3
A FAR overhaul proposed rule published 23 June 2026 would require contractors handling CUI to comply with SP 800-171 Rev. 3, using organization-defined parameter values published by the DoW CIO. Comments closed 23 July 2026, and the rule was not final as of October 2026. Plan for Rev. 3 terms, including the 97 requirements and ODP values, but treat the current contract clause as the controlling rule until the final rule issues.
Subcontractor level follows data
Under 32 CFR 170.23(a), a subcontractor handling only FCI needs Level 1 (Self), and one handling CUI needs at least Level 2 (Self). Prime contractors must decide which work touches CUI before flowing down requirements, and subcontractors should ask for the CUI status of each task in writing. A subcontractor that receives CUI without a Level 2 assessment puts the prime's compliance at risk as well.
What primes and subcontractors each need
A prime contractor decides which information and systems flow down to each subcontractor. Under the DFARS and CMMC rules, the prime cannot hand off a subcontract without deciding what the subcontractor will receive, and it must make that decision with the contract's marked or identified information in view. The prime remains accountable for the work it passes down, so a weak flow-down decision becomes the prime's problem during a review or assessment.
- Classify each subcontract: Decide whether the subcontractor will receive only FCI, CUI, or no federal information at all.
- Set the required level: Map FCI-only subcontracts to CMMC Level 1 (Self) and CUI subcontracts to at least Level 2 (Self), as 32 CFR 170.23(a) provides.
- Write the terms into the subcontract: Name the safeguards, reporting duties and affirmation expectations in the agreement rather than assuming the subcontractor knows them.
- Track affirmations and scores: Keep a current record of each subcontractor's assessment status and affirmation, and refresh it when scope changes.
Confirm the flow-down terms in writing with your contracting officer and with each subcontractor before work begins, and confirm which clauses your specific contract incorporates.
A subcontractor that handles only federal contract information needs to meet the 15 basic safeguarding requirements of FAR 52.204-21, which CMMC calls Level 1. Its systems process, store or transmit FCI, but it does not receive or generate CUI under the subcontract. The obligation is narrower than Level 2, but it still requires an affirmation and the subcontractor owns the controls that deliver it.
- Scope the systems: Identify the devices, accounts and cloud tenants that touch FCI, which is often a smaller set than the company's full environment.
- Meet the 15 safeguards: Cover access limits, user authentication, media sanitization, visitor escort, boundary protection, flaw remediation and malware protection.
- Complete the self-assessment: Level 1 is performed by the organization itself under 32 CFR 170.23(a), and the organization makes the required affirmation.
- Keep the evidence: Retain records that show each safeguard operates, such as account lists, patch records and sanitization logs.
The subcontractor owns these controls and its affirmation. An implementation partner can configure systems and prepare evidence, but only the organization can affirm compliance, and an independent assessor is not required for Level 1 self-assessment.
A subcontractor that handles CUI under the subcontract needs at least CMMC Level 2 (Self), which asks for the 110 requirements of NIST SP 800-171 Rev. 2 as the CMMC rule currently defines them. Because this is the higher floor, the subcontractor must set up a system security plan, assess its implementation and maintain an affirmation for its own environment. Whether the subcontractor needs a third-party assessment depends on the contract's requirements, so confirm that in the subcontract.
- Define the CUI boundary: Limit the systems that store, process or transmit CUI, often through a dedicated enclave, to reduce the assessed scope.
- Build the system security plan: Document how each requirement is implemented, who owns it and where the evidence sits.
- Track the POA&M and score: Record any unmet requirements, their remediation plans and the score that supports the subcontractor's submission.
- Plan for flow-down of incident reporting: Confirm the timelines and the path to notify the prime when a cyber incident affects CUI.
The subcontractor owns its controls and its affirmation. Implementation partners can design the enclave, harden systems and assemble evidence, while an independent assessor or the Government's process determines what higher-level assessment applies to the contract.
How to classify your contract information in four steps
This sequence sorts the information in a contract into FCI, CUI, or CTI and covered defense information, so you know which safeguarding rules apply before you choose controls. Each step ends with a written record that drives the scope of your systems.
Review the contract for markings and identifications
Read the contract, its statement of work, data deliverables and attachments, and look for any CUI marking, CUI category listing, or identification of controlled technical information or other CUI that the Government provided or intends to provide. Check for distribution statements and any clause that names DFARS 252.204-7012 or FAR 52.204-21. Ask the contracting officer to confirm in writing any item that is marked or identified but unclear. The output is a list of contract-level CUI indicators with their source clause or attachment, and a note of anything the contract leaves unaddressed.
Inventory information created or received in performance
Working with the engineering, program and records owners, list the information your team generates or receives while performing the contract, such as design files, test data, technical reports, source code and correspondence. For each item, record who created it, where it is stored, and whether it came from the Government. Separate simple transactional information, such as invoices and payment records, from information that is not intended for public release. The output is an information inventory with a source and storage location for each entry.
Test each item for CTI and covered defense information
For each inventory item, decide whether it is controlled technical information under DFARS 252.204-7012, or other CUI listed in the CUI Registry that is either marked or identified in the contract or was collected, developed, received, transmitted, used or stored in support of performing the contract. Use the distribution statements and the contract's identifications as evidence, and flag anything you cannot decide. Items that meet the covered defense information definition trigger the DFARS clause, while items that are only FCI fall under FAR 52.204-21. The output is a classification per item (FCI, CUI, CTI or covered defense information) with the reasoning written next to it.
Record the decision with the contracting officer or prime
Summarize the classification and the systems that will process, store or transmit each class of information in a short written record. Send it to the contracting officer if you are a prime, or to the prime contractor if you are a subcontractor, and ask for written confirmation or correction, including of any flow-down decisions. Keep the record with the contract file and update it when the scope changes. The output is a signed or emailed classification record that identifies which safeguarding requirements apply to which systems, and which questions remain open.
Mistakes that put the wrong rules on a contract
Most scoping errors come from one confusion: treating the contract's information as either FCI or CUI without checking which. Each mistake below changes which safeguards apply, which CMMC level a subcontractor needs, and what the prime and contracting officer must confirm before work starts.
Reading FCI as CUI, or the reverse
FCI is information not intended for public release that is provided by or generated for the Government under a contract, and it triggers the 15 safeguards in FAR 52.204-21. CUI is information a law, regulation or Governmentwide policy requires an agency to protect, and it triggers NIST SP 800-171. Both can sit in the same contract, so the label on the contract does not decide the rule by itself. Ask the contracting officer which information the contract marks or identifies as CUI.
Assuming Level 1 covers CUI
CMMC Level 1 covers FCI only, through the 15 requirements of FAR 52.204-21. Handling CUI requires at least Level 2 (Self) under 32 CFR 170.23(a), and Level 2 is built on the 110 Rev. 2 requirements of NIST SP 800-171. Passing a Level 1 self-assessment does not show that CUI protections are in place. Confirm with the prime which CMMC level the contract requires and whether any CUI flows to your environment.
Treating unmarked performance data as out of scope
Covered defense information includes CUI that is marked or identified in the contract, and also CUI your organization collects, develops, receives, transmits, uses or stores in support of performing the contract, even when nobody marked it. Engineering notes, test data and technical drawings created during performance can qualify. Build a list of the data types you create under the contract and ask the prime or contracting officer to confirm how each one is classified.
Assuming a small subcontractor is exempt
Company size does not decide whether NIST SP 800-171 applies. Under 32 CFR 170.23, the subcontractor's CMMC level depends on the information it handles: FCI-only work needs Level 1 (Self), and CUI work needs at least Level 2 (Self). NIST also states that implementation and compliance are the responsibility of the agency with the contract, regardless of organization size. Ask the prime in writing which level it expects from you before accepting the flow-down.
Accepting a flow-down without reading the scope
Primes often pass the same clauses to every subcontractor, which can require CUI safeguards for a task that only involves FCI, or leave CUI handling unstated for a task that does. Compare the flow-down language against the statement of work and the data you will actually receive. Request written confirmation of which information the subcontract covers, and record any task where the answer is unclear before you start work.
Who owns the classification, the controls and the assessment
The contractor is the only party that can decide what information it holds under a contract and which safeguards apply to its systems. That starts with reading the contract to find what is FCI, what is CUI, and what is covered defense information, then deciding which systems process, store or transmit it. The organization also owns the system security plan, its policies and procedures, and the affirmations it makes in the Supplier Performance Risk System under the CMMC rule. Those statements carry legal weight, so the senior official who signs them needs to understand what they cover.
- Classification: Deciding whether each data set is FCI, CUI or neither, and documenting the basis for that decision.
- Controls: Implementing the 15 FAR 52.204-21 safeguards for FCI or the NIST SP 800-171 requirements for CUI, and running them day to day.
- System security plan: Writing and maintaining the plan that describes the system boundary, the controls and how they are met.
- Affirmations: Signing the affirmations that the CMMC rule requires and keeping them accurate as systems change.
- Subcontract flow-down: Deciding which subcontractors receive FCI or CUI and confirming each one has the right CMMC level.
Before relying on any assessment, confirm with the contracting officer which level and which requirement revision applies to your contract.
An implementation partner helps the organization build the systems and evidence that the controls depend on. DeployOpen, for example, plans and deploys self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, and prepares configuration, logging and documentation for assessment. A partner can scope the enclave so that only systems that handle FCI or CUI fall inside the assessed boundary. The partner does not decide classification, does not sign affirmations and does not issue any report or certificate.
- Enclave scoping: Proposing a boundary that isolates CUI systems, with the organization confirming the decision.
- Control preparation: Configuring access control, logging, encryption and patching on the systems in scope.
- Evidence preparation: Organizing configuration baselines, scan results, logs and policy records that an assessor will examine.
- Documentation drafts: Preparing draft plans and procedures that the organization reviews, edits and adopts.
- Readiness testing: Running internal checks against the requirements before an external assessment.
Ask any partner to put the division of responsibility in the written scope, so that it is clear which deliverables are configuration work and which remain the organization's decisions.
Assessment is performed by a party independent of the organization and of any firm that helped build its systems. Depending on the requirement, that is a DoD assessor (such as DCMA DIBCAC for certain assessment levels), a C3PAO for Level 2 certification assessments, or the organization itself for self-assessments that it then affirms. The assessor examines evidence, interviews staff and tests controls against the assessment procedures in SP 800-171A. Only the assessor's output counts as the assessment result, and a consultant's readiness review does not substitute for it.
- Assessment scope: Confirming which level and which requirements apply, and reviewing the system boundary.
- Evidence review: Examining documents, configurations and logs against the requirements.
- Interviews and testing: Confirming that people follow the procedures and that controls work as described.
- Result issuance: Issuing the assessment result or certificate through the process the DoD defines.
- Independence: Keeping the assessor separate from the team that prepared the environment.
Before you engage an assessor, confirm which body is authorized for your level and check the current assessment process with the contracting officer.
Questions buyers ask about FCI and CUI safeguarding
Can a single contract involve both FCI and CUI?
Yes. A contract can produce both kinds of information at the same time, and the safeguards for each apply to the part of the system that handles it. Federal contract information covers information not intended for public release that is provided by or generated for the Government under a contract to develop or deliver a product or service. CUI is a narrower category defined by a law, regulation or Governmentwide policy that requires or permits safeguarding or dissemination controls. The contracting officer and the prime contractor decide which information is marked or identified as CUI, so the contract is the first document to read. The FAR 52.204-21 safeguards cover FCI, and the NIST SP 800-171 requirements apply where CUI is present. Ask the contracting officer to state in writing which information is CUI and which systems are in scope.
Does FCI-only work still require CMMC Level 2?
No. Under 32 CFR 170.14, a contractor that handles only federal contract information needs CMMC Level 1, which covers the 15 safeguarding requirements of FAR 52.204-21. Level 2 applies when the work involves CUI, because it draws on the 110 requirements of NIST SP 800-171 Rev. 2. The level is set by the information the contract handles, not by the size of the company or the dollar value of the award. Current DoD direction also affects which baseline a contracting officer applies while CMMC phase requirements are changing, so confirm the active clause and level with the contracting officer before scoping systems.
How does a subcontractor find out which CMMC level it needs?
The prime contractor and the contract flow the requirement down, and the subcontractor should not guess. Under 32 CFR 170.23, a subcontractor that handles only FCI needs Level 1 (Self), and a subcontractor that handles CUI needs at least Level 2 (Self). The prime must decide, based on the information it passes down, which level applies to each subcontract. A subcontractor should ask for the flow-down terms in writing, identify each piece of information it will receive, and confirm whether any of it is marked or identified as CUI. If the prime is unsure, the contracting officer is the escalation point for clarification.
Can our organization decide for itself whether information is CUI?
Not on its own authority for information the Government provides or identifies. Under 32 CFR Part 2002, CUI is defined by the category the law, regulation or Governmentwide policy assigns, and the agency that owns the information determines how it is marked and handled. A contractor can, however, determine whether information it creates is CUI under the contract terms, and the DFARS 252.204-7012 definition of covered defense information reaches information collected, developed or used in performing the contract. The practical rule is to ask the contracting officer or prime for written direction when a category is unclear, and to document the answer. Treating unmarked information as non-CUI without asking creates audit and reporting risk.
What drives the effort difference between Level 1 and Level 2?
The main driver is how many requirements apply and how much evidence each one needs. Level 1 has 15 safeguards, which are basic access, authentication, media sanitization, visitor escort, boundary protection, flaw remediation and malware protection. Level 2 has 110 requirements in 14 families, so it requires a written system security plan, documented policies, configuration management, audit logging, incident response, risk assessment and periodic assessment of controls. The scope of the environment matters as much as the count: a small enclave with few systems costs far less to document and test than a company-wide network where CUI moves through email, file shares and endpoints. Ask any provider to break the quote into the systems in scope, the policies to write, the technical controls to configure and the evidence to collect.
Can an implementation partner take this on for us?
An implementation partner can prepare the systems, controls and evidence that your organization needs, but it cannot decide what your contract requires or certify your compliance. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms in your own infrastructure, and it can work through a fixed scope agreed in writing before work starts. Your organization still owns its controls, decides which information is CUI with the contracting officer, and signs the affirmation. Only an independent assessor or the DoD assessment process issues results that count for contracting. Ask a prospective partner which parts of the work it will perform, which decisions stay with you, and what it will hand over as documentation.
How DeployOpen scopes CUI and FCI safeguarding work
DeployOpen starts by working out which safeguarding rules your contract actually triggers, FAR 52.204-21 for federal contract information or NIST SP 800-171 for CUI, before any platform work begins. We then implement, document and hand over the self-hosted open-source systems and evidence that fit that scope, inside your own infrastructure.
How we scope
- Review the contract clauses and marking to identify which information is FCI and which is CUI.
- Map the systems that will process, store or transmit that information in a written scope.
- Agree deliverables, exclusions and timelines in writing before any work starts, as all engagements are fixed-scope.
- Confirm with you which requirements your organization owns and which an independent assessor will test.
How we build
- Implement self-hosted open-source platforms inside your cloud accounts, data centers or air-gapped networks.
- Configure access control, logging, encryption and boundary protection to match the agreed requirement set.
- Test the configured systems through our security testing services before the assessment begins.
- Confirm that subcontractor flow-down needs are addressed in the design of the environment.
How we hand over
- Document configurations, control implementations and evidence sources so your team can reproduce them.
- Deliver written artifacts that match the agreed scope, such as system documentation and evidence collection procedures.
- Run a handover session so your staff can operate and maintain the systems after the engagement closes.
- Clarify that DeployOpen prepares evidence but does not issue audit reports, attestations or certifications.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope work ends.
- Re-check safeguarding scope when contract terms, marking practices or the applicable CMMC level change.
- Ask your contracting officer or prime contractor to confirm which revision of the requirements applies to your contract.
