What is the difference between FCI and CUI?

Short Answer

Federal Contract Information (FCI) is non-public information provided by or generated for the Government under a contract. Controlled Unclassified Information (CUI) is a higher-sensitivity category with far more requirements. FCI is protected at CMMC Level 1. CUI is protected at Level 2. Neither is classified.

FCI

FCI is information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government. It excludes information the Government makes public and simple transactional information such as payment data. Purchase orders, drawings, and contract correspondence are typically FCI.

CUI

CUI is a higher-sensitivity category. Under 32 CFR 2002.4(h) it is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is designated CUI by the Government and carries the full Level 2 requirement set. Whether information is CUI is determined by the Government, not by the supplier.

Why the distinction matters

The two map to different CMMC levels and very different amounts of work. DoD selects the level for each contract based on whether the work involves FCI or CUI (32 CFR 170.3(d)), and the contracting officer states it in the solicitation and contract (DFARS 204.7503(a)). On a subcontract, the prime flows the level down based on the information shared (32 CFR 170.23). Which of your systems handle that information is the scoping decision you make.