CUI or FCI: which CMMC level does your contract need?

If your systems hold only federal contract information (FCI), your contract calls for CMMC Level 1 (Self): the 15 safeguards of FAR 52.204-21, self-assessed every year. If they hold controlled unclassified information (CUI), it calls for CMMC Level 2: all 110 requirements of NIST SP 800-171 Revision 2, self-assessed every three years, with Level 2 (Self) the only Level 2 status being named in new requirements while CMMC Phase II is suspended. The clauses in the contract, the markings on what you receive, and what your prime flows down tell you which you have.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What is federal contract information (FCI)?

FAR 52.204-21(a) defines it: "Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public websites) or simple transactional information, such as necessary to process payments." DFARS 252.204-7021 defines it the same way in slightly different words.

Read it as a floor. A statement of work, a delivery schedule, an email from the contracting officer about performance: each is "provided by or generated for the Government under a contract" and not meant for the public. Almost any company performing a federal contract holds FCI, which is why 32 CFR 170.3(a)(1) applies CMMC to "All DoD contract and subcontract awardees that will process, store, or transmit information, in performance of the DoD contract, that meets the standards for FCI or CUI".

What is controlled unclassified information (CUI)?

32 CFR 2002.4(h), NARA's rule for the Government-wide CUI program, defines it: "Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls." The same paragraph says what it is not: "CUI does not include classified information" nor "information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency." Your own proprietary data is not CUI unless the Government created it, holds it, or had you create it for the Government.

What qualifies is listed, category by category, in the CUI Registry on archives.gov, which 32 CFR 2002.4(p) calls "the online repository for all information, guidance, policy, and requirements on handling CUI". The registry's Defense group holds five categories, among them Controlled Technical Information, whose banner marking is "CUI//SP-CTI" and whose listed authority is 48 CFR 252.204-7012. The registry defines it as "technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination", with examples such as "engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports" and "computer software executable code and source code".

The rule splits CUI into CUI Basic, where the authority "does not set out specific handling or dissemination controls", and CUI Specified, where it does (2002.4(j) and (r)). Controlled Technical Information is Specified, which is what the "SP-" in its marking means.

What is covered defense information?

DFARS 252.204-7012 uses its own term. "Covered defense information" means "unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry" that "requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies", and is either "Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract" or "Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract."

In practice it is DoD's CUI, and the clause protects it with the standard CMMC Level 2 uses: a covered contractor information system "shall be subject to the security requirements in" NIST SP 800-171. Clause 7012 applies on its own terms, whether or not a CMMC clause is in the contract; see DFARS and FAR cybersecurity clauses, as of 2026.

CMMC Level 1 vs Level 2: what is the difference?

Two more levels exist: Level 2 (C3PAO), a third-party certification assessment of the same 110 requirements (170.17), and Level 3 (DIBCAC), which adds selected requirements from NIST SP 800-172 (170.18). Since July 13, 2026 neither may be designated in new Department of War requirements; see CMMC Phase II is suspended: what still applies. A Level 2 (Self) status "also satisfies the requirements for a CMMC Status of Level 1 (Self)" for the same scope (170.16(a)), so a company handling both kinds of information needs one assessment, at Level 2.

Does my contract require CMMC Level 2?

Look in four places.

1. The CMMC clause. DFARS 252.204-7021 (NOV 2025), paragraph (d)(1)(i), requires the contractor to "Have and maintain for the duration of the contract a current CMMC status at the following CMMC level, or higher: ____________ [Contracting Officer insert: CMMC Level 1 (Self); CMMC Level 2 (Self); CMMC Level 2 (C3PAO); or CMMC Level 3 (DIBCAC)]". The level written into that blank is the answer. Under 32 CFR 170.3(d), program managers choose it "based upon the type of information, FCI or CUI, that will be processed on, stored on, or transmitted through a contractor information system."
2. DFARS 252.204-7012. If the contract involves covered defense information, NIST SP 800-171 applies to the systems that hold it whether or not 7021 names a level. The clause goes in every DoD contract except those solely for commercial off-the-shelf items, so its presence alone does not prove you hold CUI; what the contract identifies as covered defense information does.
3. What your prime flows down. 32 CFR 170.23(a) sets the subcontract level by the information: "If a subcontractor will only process, store, or transmit FCI (and not CUI) in performance of the subcontract, then a CMMC Status of Level 1 (Self) is required", and "If a subcontractor will process, store, or transmit CUI in performance of the subcontract, then a CMMC Status of Level 2 (Self) is the minimum requirement". Under 7021(d)(1)(ii) the prime must "flow down the correct CMMC level", and under 7012(m)(1) it must "determine if the information required for subcontractor performance retains its identity as covered defense information". Ask your prime which it decided; see How primes check their suppliers' cybersecurity.
4. The markings. Under 32 CFR 2002.20(b), "Designators of CUI must mark all CUI with a CUI banner marking"; its mandatory element is the CUI control marking, the word CONTROLLED or the acronym CUI, followed by category markings such as CTI where the category is Specified. A document marked CUI//SP-CTI is CUI, and a contract that will send you such documents is a Level 2 contract. Older labels do not count: under 2002.20(a)(2), "If legacy markings remain on information, the legacy markings are void and no longer indicate that the information is protected or that it is or qualifies as CUI."

One caution. Under 2002.20(a)(7), "The lack of a CUI marking on information that qualifies as CUI does not exempt the authorized holder from abiding by applicable handling requirements". If unmarked technical data reaches you under a DoD contract, ask the contracting officer or the prime before deciding it is only FCI.

What should a supplier do?

1. Read each contract and subcontract for 52.204-21 (or 52.240-93), 252.204-7012 and 252.204-7021, and note the level written into 7021.
2. List what the Government and your primes send you, and what you generate for them, and check it against the CUI Registry's categories and the markings on it.
3. Decide which systems hold FCI and which hold CUI; 32 CFR 170.19 sets the assessment scope from that.
4. If any system holds CUI, do the Level 2 self-assessment, which covers Level 1 for the same scope: see How to do a NIST SP 800-171 self-assessment for CMMC Level 2. Otherwise do the Level 1 self-assessment annually and keep the affirmation current.

If you are the supplier, the free tools and the guides for your side are gathered at For suppliers.

Where Tiermark fits

Tiermark is supplier-assurance software for defense contractors and their suppliers. A prime's attestation campaigns send each supplier a DFARS 252.204-7012 baseline questionnaire that asks, among other things, about the covered defense information it handles and its NIST SP 800-171 self-assessment; the signed answer becomes the prime's record. On the supplier side, the free SPRS score calculator scores the 110 Level 2 requirements, and Supplier Pro's self-assessment workspace keeps the assessment behind the score. Tiermark does not decide what information is CUI, and it never holds CUI: text that carries a CUI marking is refused.

Sources

• FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems
• 32 CFR 2002.4, Definitions and 32 CFR 2002.20, Marking
• NARA CUI Registry, categories and Controlled Technical Information
• DFARS 252.204-7012 and DFARS 252.204-7021 (NOV 2025)
• 32 CFR 170.3, 170.14, 170.15, 170.16, 170.17, 170.18, 170.19, 170.21, 170.22, 170.23 and 170.24