Direct comparison
FCI vs CUI: Definitions, Rules, Safeguards
FCI vs CUI compared from the regulatory text: FAR 4.1901 and 32 CFR 2002.4(h) definitions, exclusions, the overlap rule and safeguarding baseline for each.
Written and maintained by CASRAI Editorial Board
Last updated
Ask CASRAI · free to try
Ask about FCI vs CUI: Definitions, Rules, Safeguards
Ask your first 2 questions free below. Subscribers get 150 a day for $29 a month.
An AI assistant specialized in research administration. It cites the sources behind every answer, labels web answers and says when it can't answer.
Answers draw on CASRAI's guides and dictionary plus the federal and funder documents we index: Federal Register, Grants.gov, Regulations.gov and UKRI.
Works on this site and inside Claude, Cursor and the AI tools you already use.
Everything CASRAI publishes — this page, the dictionary, the guides and the news — stays free to read, with no account and no card.
How do FCI (Federal Contract Information), CUI (Controlled Unclassified Information) compare side by side?
The table below compares FCI (Federal Contract Information), CUI (Controlled Unclassified Information) across 10 procurement-relevant dimensions, from where it is defined through source.
Side-by-side comparison
| Dimension | FCI (Federal Contract Information) | CUI (Controlled Unclassified Information) |
|---|---|---|
| Where it is defined | FAR 4.1901 and the clause at FAR 52.204-21. 32 CFR 170.4 (the CMMC program rule) points to FAR 4.1901 for the term. | 32 CFR 2002.4(h). 32 CFR 170.4 points to this paragraph for the term. |
| Defining test | Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. | Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. |
| What makes information fall in | It is non-public and tied to a Government contract. NARA: FCI is any information "not intended for public release." | A designating authority (law, regulation or Government-wide policy) calls for safeguarding or dissemination controls. NARA: CUI is information that requires safeguarding. |
| What is expressly excluded | Information the Government provides to the public (such as on public websites) and simple transactional information, such as what is necessary to process payments. | Classified information, and information a non-executive-branch entity possesses and maintains in its own systems that did not come from, and was not created or possessed by or for, an executive branch agency or an entity acting for an agency. |
| Governing program | FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems. | Executive Order 13556 and the CUI program run by NARA as Executive Agent (delegated to ISOO), implemented by 32 CFR Part 2002 and listed in the CUI Registry. |
| Safeguarding baseline for a contractor system | At minimum, the basic safeguarding requirements of FAR 52.204-21: paragraph (b)(1) lists 15 controls, items (i) to (xv). | Additional safeguarding identified in the contract. NARA describes NIST SP 800-171 as the minimum standard for CUI on non-federal systems. |
| Variants inside the category | None defined in the sources read. | CUI Basic (the authority does not set out specific handling or dissemination controls) and CUI Specified (the authority contains specific handling controls that differ from CUI Basic). |
| Overlap | Not all FCI is CUI. | All CUI in a Government contractor's possession is FCI. |
| When to pick each label | Use FCI when the information is non-public contract information and no law, regulation or Government-wide policy designates it for safeguarding or dissemination controls. The FAR 52.204-21 baseline applies. | Use CUI when a designating authority applies and the information came from, or was created for or on behalf of, an agency. Expect the contract to identify the additional safeguarding, with NIST SP 800-171 as the minimum standard on non-federal systems. |
| Source | FAR 52.204-21, acquisition.gov/far/52.204-21; 32 CFR 170.4, ecfr.gov; NARA ISOO blog, "FCI and CUI, what is the difference?" (19 June 2020). Read 2026-10-29. | 32 CFR 2002.4, ecfr.gov; NARA "About CUI", archives.gov/cui/about; NARA ISOO blog, 19 June 2020. Read 2026-10-29. |
Common questions
Common questions about FCI (Federal Contract Information) vs CUI (Controlled Unclassified Information)
Is all CUI also FCI?
+
For a Government contractor, yes. NARA's Information Security Oversight Office states that all CUI in the possession of a Government contractor is FCI, but not all FCI is CUI.
What does FCI exclude?
+
The FAR 52.204-21 definition excludes information the Government provides to the public (such as on public websites) and simple transactional information, such as what is necessary to process payments.
What safeguarding applies to FCI and to CUI on a contractor system?
+
FCI on a non-federal system needs at minimum the basic safeguarding requirements of FAR 52.204-21, which lists 15 controls. CUI on a non-federal system needs additional safeguarding identified in the contract, and NARA describes NIST SP 800-171 as the minimum standard.
Is information a company keeps in its own systems CUI?
+
Not if it did not come from, and was not created or possessed by or for, an executive branch agency or an entity acting for an agency. 32 CFR 2002.4(h) excludes it from CUI.
