What is the difference between FCI and CUI?

Short Answer

Federal Contract Information (FCI) is non-public information provided by or generated for the Government under a contract. Controlled Unclassified Information (CUI) is a higher-sensitivity category with far more requirements. FCI is protected at CMMC Level 1; CUI is protected at Level 2. Neither is classified.

FCI

FCI is information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It excludes information the Government makes public and simple transactional information such as payment data. Purchase orders, drawings, and contract correspondence are typically FCI.

CUI

CUI is a higher-sensitivity category. It is information that the Government, or a contractor acting for or on behalf of the Government, creates or possesses and that a law, regulation, or government-wide policy requires to be safeguarded. It is designated CUI by the Government and carries the full Level 2 requirement set. Whether information is CUI is determined by the Government, not by the supplier.

Why the distinction matters

The two map to different CMMC levels and very different amounts of work. Which one applies depends on what information a specific contract involves, a boundary decision the customer makes based on the contract and its markings.