Every federal contractor handles Federal Contract Information. Only some handle Controlled Unclassified Information. The difference is not company size or contract value; it is what kind of information the work involves, and it sets everything downstream: FAR 52.204-21 and CMMC Level 1 on one side, DFARS 252.204-7012, NIST SP 800-171, a SPRS score, and CMMC Level 2 on the other. A company new to defense work should be able to answer "will we handle CUI" in writing before the first solicitation, because the answer determines the budget.
Defined in FAR 4.1901: information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service, excluding information the government has made public and simple transactional information such as what is needed to process payments.
Defined in 32 CFR Part 2002: information the government creates or possesses, or that an entity creates or possesses for the government, that a law, regulation, or government-wide policy requires or permits to be safeguarded or controlled in dissemination. The categories are listed in the National Archives' CUI Registry.
Properly marked CUI carries "CUI" at the top of every page, often with a category marker such as CUI//SP-CTI for Controlled Technical Information, and a designation block naming the controlling office. DoD documents frequently also carry a distribution statement (B through F) that limits who may receive them.
DFARS 252.204-7012 appears in most DoD solicitations whether or not CUI will actually flow, so its presence alone does not settle the question; it means you must be ready to protect CUI if it arrives. The stronger signals are the information the contract identifies, DFARS 252.204-7019 and 7020 (a NIST SP 800-171 score is required), and the CMMC level named under 252.204-7021. A contract with only FAR 52.204-21 is telling you FCI.
Information that meets a CUI category is CUI whether or not the sender marked it, and a prime's engineering team does not always mark what it forwards. When a document looks like technical data for a defense article, treat it as CUI and ask the sender to confirm in writing.
CUI includes what the contractor generates for the government: your own drawings, analyses, and test results produced under a contract that involves CUI. The boundary has to hold what you make as well as what you receive.
Under CMMC Level 2, every system that stores, processes, or transmits CUI, and every system that protects those systems, is inside the assessment boundary. A company that lets its first CUI drawing land in the general email system and the shared file server has just put the general email system and the shared file server in scope, along with every laptop that syncs them.
The alternative is a decision made in advance: CUI is received, stored, and worked on in a defined set of systems used by a defined set of people, and nowhere else. That can be a hardened segment of the existing environment or a separate secure enclave beside it. Either way the boundary is a few systems rather than the company, and the cost of Level 2 follows the boundary.
FCI needs the same thought at a smaller scale: the 15 Level 1 requirements apply to the systems that handle it, so knowing which systems those are is the first step of the self-assessment.
FCI is any non-public information provided by or generated for the government under a contract; nearly every contractor has it, and it triggers FAR 52.204-21 and CMMC Level 1. CUI is information a law, regulation, or government-wide policy requires to be safeguarded, such as controlled technical information and export-controlled data; it triggers DFARS 252.204-7012, NIST SP 800-171, a SPRS score, and CMMC Level 2.
In practice, CUI handled under a contract is also FCI, since it is non-public information provided by or generated for the government. The requirements stack: a contractor handling CUI must meet the 15 basic safeguarding requirements and the 110 NIST SP 800-171 requirements, and Level 2 includes everything in Level 1.
Read the information the contract identifies and the deliverables it asks for. DFARS 252.204-7012 appears in most DoD contracts whether or not CUI will flow, so it is a readiness obligation rather than proof; DFARS 252.204-7019 and 7020, and a CMMC Level 2 requirement under 252.204-7021, are the clauses that mean the government expects CUI in the work. If the documents are ambiguous, ask the contracting officer or the prime in writing and keep the answer with the contract file.
Sometimes. A company whose services never require government technical data can bid FCI-only work deliberately and remain a Level 1 organization. Many defense manufacturing and engineering contracts cannot be performed without CUI, and for those the choice is how small to keep the boundary, not whether to have one.
Contain it: stop forwarding it, move it to the systems you intend to keep in scope, and record where it went. Then treat the boundary as it now exists. Every system it touched is in scope until CUI is removed from it, which is why deciding the boundary before the first document arrives is worth more than any control bought afterwards.
Send Cyberneza the solicitation number or a description of the flow-down, the kind of deliverables involved, and the systems you use today. Do not paste contract attachments or anything marked CUI into the contact form; documents are exchanged over an agreed channel once the engagement is scoped. Cyberneza will tell you which category the information falls in, which clauses and CMMC level follow, and where the boundary should sit so the requirement stays proportionate to the contract.
