FCI or CUI: Which One Does Your Contract Bring?

Your CMMC level comes from your contract, and the type of information the contract brings decides which level fits. Here is how to tell FCI from CUI, and what each one requires.

FCI: federal contract information

FAR 52.204-21 defines FCI as information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service. It does not include information the government provides to the public or simple transactional information, such as what is needed to process payments.
FAR 52.204-21 lists 15 basic safeguarding requirements for systems that process, store or transmit FCI, such as limiting access to authorized users, sanitizing media before disposal, and scanning for malicious code.

CUI: controlled unclassified information

CUI comes through the contract. Under DFARS 252.204-7012, the information you must protect is:

• Marked or otherwise identified in the contract and provided to you by or on behalf of DoD, or- Collected, developed, received, transmitted, used or stored by you in support of performing the contractExamples of technical information include engineering drawings, specifications, process sheets and technical reports. Systems that handle CUI fall under NIST SP 800-171. ## What each level requires Under 32 CFR Part 170:
• Level 1 security requirements are the 15 in FAR 52.204-21. You self-assess and submit an affirmation every year, and no POA&M is allowed. Every requirement must be met.- Level 2 security requirements are identical to NIST SP 800-171 Rev. 2 (110 requirements). You assess every 3 years and affirm every year. A limited POA&M is allowed, and it must be closed out within 180 days or the conditional status expires.- A Level 2 (Self) status also satisfies Level 1 (Self) for the same assessment scope.While CMMC Phase 2 is suspended, contracts can require only Level 1 (Self) or Level 2 (Self). ## How to tell which one you have
• Read the clauses and the CMMC level in your solicitation or contract.- Look for CUI markings on what your customer sends you.- List what you will create to perform the contract, such as drawings or process sheets built from controlled data.## Start here Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance firm in Orlando, Florida. We help you confirm your level and see where you stand: https://cyberneza.com/cmmc Sources: FAR 52.204-21, DFARS 252.204-7012, 32 CFR 170.14, 32 CFR 170.15, 32 CFR 170.16