FCI or CUI: How Your Contract Determines Your CMMC Requirements

Your required CMMC level depends on the type of information your contract involves. FAR 52.204-21 defines Federal Contract Information as non-public data generated for or provided by the government under a contract, excluding public information and simple transactional data like payment processing details. Controlled Unclassified Information, under DFARS 252.204-7012, is data marked by DoD in the contract or collected and used by a contractor to perform it, such as engineering drawings and technical reports. Level 1 requires the 15 FAR 52.204-21 security requirements with annual self-assessment and no POA&M allowed, while Level 2 follows the 110 NIST SP 800-171 Rev. 2 requirements with triennial assessment and a limited POA&M closable within 180 days. The article advises contractors to review contract clauses, check for CUI markings on customer-provided materials, and identify what they will create from controlled data to determine their level.