Definition
FCI: Information provided by or generated for the government under contract, not intended for public release
CUI: Sensitive information that requires safeguarding under laws, regulations, or policies
Examples
FCI: Contract numbers, delivery schedules, internal communications
CUI: Technical drawings, DoD schematics, ITAR data, proprietary research
Marking
FCI: Not typically marked
CUI: Often marked as “CUI” or with category indicators
CMMC Level Required
FCI: Level 1 (Foundational – 17 practices)
CUI: Level 2 (Advanced – 110 practices from NIST SP 800-171)
Safeguards Needed
FCI: Basic cyber hygiene (e.g., access control, antivirus, training)
CUI: Full suite of security controls (e.g., audit logs, incident response, encryption)
Who Handles It
FCI: Most DoD contractors and subcontractors
CUI: Contractors working with sensitive defense-related data
🧠 Why This Matters
Knowing whether you handle FCI or CUI determines your required CMMC level, the controls you must implement, and the support you need from an RP or RPA.
🛡️ How EmTech CyberShield™ Helps
Identify and classify your data (FCI vs CUI)
* Map your environment to the right CMMC level
* Provide RP-led guidance, SAT alignment, and technical safeguards
* Prepare your SSP, POA&M, and audit evidence
