--- title: What’s Considered “Federal Contract Information” (FCI) and “Controlled Unclassified Information” (CUI)? description: CMMC 2.0 is still in a developmental phase, there is a chance your business hasn’t had to meet any of the requirements set by the Department of Defense. image: https://www.omnistech.com/hubfs/CMMC%202.0%20Framework.jpg --- [![Omnis-logo](https://www.omnistech.com/hubfs/Omnis-logo.png)](https://www.omnistech.com) - [MANAGED IT](https://www.omnistech.com/managed-it-support) - [CYBERSECURITY](https://www.omnistech.com/cybersecurity-consulting) - RESOURCES - [BLOG](https://www.omnistech.com/blog) - [SMALL BUSINESS CYBERSECURITY PLAN](https://www.omnistech.com/small-business-cybersecurity-plan) - [VIDEOS](https://www.omnistech.com/videos) - COMPANY - [ABOUT US](https://www.omnistech.com/about-us) - [TESTIMONIALS](https://www.omnistech.com/testimonials) - [CAREERS](https://www.omnistech.com/careers) [I Need IT Support](https://www.omnistech.com/contact-us) [Submit a Ticket](http://portal.omnistech.com/WCC2/Home/Login?ReturnUrl=%2fWCC2%2f) # What’s Considered “Federal Contract Information” (FCI) and “Controlled Unclassified Information” (CUI)? CMMC 2.0 is still in a developmental phase, there is a chance your business hasn’t had to meet any of the requirements set by the Department of Defense. [Nate Rodgers](https://www.omnistech.com/blog/author/nate-rodgers) May 13, 2025 --- If your niche market is government contract work, you’ve probably heard the terms “FCI” and “CUI.” Both terms only add to the alphabet soup of acronyms. Chances are, you know what they are. But do you really know what they mean?  The TLDR: FCI data requires a level 1 CMMC, where CUI starts at level 2 CMMC and eventually climbs into level 3. But let’s dig in a little deeper. ## What is Federal Contract Information (FCI)? When handling government paperwork, the first thing that comes to mind is national security. FCI is non-public information that is required to be handled in accordance with federal regulations. FCI can be data that is collected for the federal government or obtained by the contractor during the active contract work.   ### FCI Protection  The protection of federal contract information is a mutual effort between the government and the contractors. The government is responsible for developing agencies whose job it is to ensure there are proper guidelines in place to keep FCI secure during its entire lifecycle. On the other side, contractors are responsible for implementing the security measures created by the federal agencies to protect all FCI while it’s in their possession.  The guidelines created by federal agencies is what we now know as CMMC 2.0 Framework. The CMMC 2.0 Framework is made up of 3 levels. Depending on what kind of contract work your business is conducting, will determine your level of CMMC compliance.  Further reading: [Understanding the CMMC 2.0 Framework](https://www.omnistech.com/blog/understanding-the-cmmc-2.0-framework).  ## Types of FCI Information There are several types of documentation that are considered FCI. Some of the most common  are: - Financial reports - Technical reports/data - Any non-public information  - Government provided data - Information created by the contractor during contract FCI information is found in various locations. However, you can find it mostly in databases that are managed by the government. The database in which this information is stored is only accessible by government employees, the contractors and any authorized personnel. Another stipulation to gaining access to this information is having a government issued “need-to-know” basis for completing your contracts.  [![CMMC Compliance Strategy Discussion](https://no-cache.hubspot.com/cta/default/2094676/interactive-132089957495.png)](https://www.omnistech.com/hs/cta/wi/redirect?encryptedPayload=AVxigLL9l8sS9nyI4OEPpzh0Sis%2BXycmSDZNZm1YmZJHa3lmZ7Uw1DE9IWC%2BCilEIk1tWJ4nI%2BBGkNd%2BL%2Fj73khbYjHlWDa74yT7N%2BqtqQLFPVPlNE8B76Fa%2FKkyshtAgEvvs1qMuKFQKL5alKhUzpIC3sMsUkVQ%2B4USLWT3K6H1DowMKL8EdjgpJA%3D%3D&webInteractiveContentId=132089957495&portalId=2094676) ## What is Controlled Unclassified Information (CUI)? [CUI](https://www.ftc.gov/policy-notices/controlled-unclassified-information) is what the federal government uses to identify information that is not classified but still requires strict guidelines to ensure its safety. The idea behind classifying information as CUI is to create a safety standard used among all government contracts.  ### Does My Business Have CUI? Because CUI covers a broad range of data, it’s found in a variety of different businesses. Some of the more common entities that handle CUI information include: - State and local governments - Defense contractors  - Federal agencies  - Research organizations  Regardless of how much CUI information your business generates, you can expect to have to meet CMMC compliance level 2.  | Resource: For additional information on FCI and CUI, explore an in-depth breakdown of [CMMC 2.0 level 2 compliance requirements.](https://dodcio.defense.gov/CMMC/Assessments/)  | | --- |   ## Staying Compliant With New CMMC 2.0 Policies While CMMC 2.0 is still in a developmental phase, there is a chance your business hasn’t had to meet any of the requirements set by the Department of Defense (DoD), yet. If that sounds like you, you're already in the right place. It’s never too early to consult a CMMC expert to start shaping your business into a CMMC compliance machine!  [![Consult the IT Experts With over 20+ years of IT and Cybersecurity experience, Omnis Tech is the perfect solution for your business.   ](https://no-cache.hubspot.com/cta/default/2094676/interactive-128146693448.png)](https://www.omnistech.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLfbci7zKFFEksyS75vpPYXJcpq9XbUfQXuSZAd7aa0FybpFlkq2qxWXG5Xts0cP5DGHhPRxBEzmh%2FgDxFZZ6KizIwUgfzLXmh3G2tBJe3HEttOmAqXHQJZz0IZy95mtB%2Ftv6Qw%2FXYJu0BPLzG0HLxSOqiXk%2B42WQUv3%2Bm4ZPzArfUmyvz9Ow%3D%3D&webInteractiveContentId=128146693448&portalId=2094676) ## Similar posts Education ### [Email Phishing: 5+ Ways to Protect Your Personal Information](https://www.omnistech.com/blog/email-phishing-5-ways-to-protect-your-personal-information) Phishing is the practice of tricking someone to get their sensitive information. The “bait” is often an email created to look like a message from... protocol80 Mar 2, 2020 ### [Monitoring & Controlling Remote Access Sessions – Complying with CMMC AC.2.013](https://www.omnistech.com/blog/monitor-and-control-remote-access-sessions) Unfortunately, with the rise of remote work, cybercriminals have a heightened interest in remote access-based data breaches. Enter CMMC AC.2.013 –... Nate Rodgers Jan 31, 2024 Business advice ### [Own a Business in NY? Time to Step Up Your Information Security Game](https://www.omnistech.com/blog/business-information-security-ny) Insurance companies in New York want businesses to tighten up their information security by following these 12 guidelines. Donald Kemick Jul 14, 2017 [![OMNIS Technologies](https://www.omnistech.com/hubfs/Asset%201WHITE.png)](https://www.omnistech.com) OMNIS Technologies PO Box 334 32 Lafayette Ave. Lewis Run, PA 16738 ### Services - [Managed IT](https://www.omnistech.com/managed-it-support) - [Cybersecurity](https://www.omnistech.com/cybersecurity-consulting) ### Resources - [Blog](https://www.omnistech.com/blog) - [Small Business Cybersecurity Plan](https://www.omnistech.com/small-business-cybersecurity-plan) - [Videos](https://www.omnistech.com/videos) ### Company - [About Us](https://www.omnistech.com/about-us) - [Careers](https://www.omnistech.com/careers) - [Testimonials](https://www.omnistech.com/testimonials) - [Contact Us](https://www.omnistech.com/contact-us) © 2022 protocol 80, Inc All rights reserved [Privacy Policy](https://www.omnistech.com/privacy-policy)