Determining what types of information your organization possesses is one of the first steps you need to take when starting efforts to enact cybersecurity controls. This classification of information dictates how the data must be controlled and protected.
Here are the different categories of information.
FCI – Federal Contract Information
As defined by 48 CFR 52.204-21, this is, “Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information by the Government to the public (such as public websites) or simple transactional information, such as necessary to process payments.”
National Archives and Records Administration (NARA) specifies, “Non-federal systems that store, process, or transmit FCI that does not also qualify as CUI must follow, at a minimum, the basic safeguarding requirements outlined in FAR clause 52.204-21.”
It is important to note that FCI (CMMC Level 1) is the minimum if you have a Federal contract.
CUI – Controlled Unclassified Information
According to 42 CFR 2002.4, CUI is, “Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.
“CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.”
Additional Safeguards / Classifications:
- CUI Basic: Requiring or permitting agencies to control or protect the information but providing no specific controls.
- CUI Specified: Requiring or permitting agencies to control or protect the information and providing specific controls for doing so.
- CUI Specified, with basic controls where not specified by authority: Requiring or permitting agencies to control the information and specifying only some needed controls.
NARA states that, “NIST SP 800-171 will be the minimum standard for protecting CUI in non-federal information systems and organizations (per 32 CFR 2002.14 and 2002.16).”
CUI categories for the defense industrial base (DIB)
Refer to this chart to see how to classify your CUI.
| Banner Marking | CUI Category | Organization Grouping |
| CUI//SP-CTI | Controlled Technical Information | Defense |
| CUI//SP-CEII | Critical Energy Infrastructure Information | Critical Infrastructure |
| CUI//SP-EXPT | Export Controlled | Export Control |
| CUI//SP-FISA(B) | Foreign Intelligence Surveillance Act (Business Records) | Intelligence |
| CUI//SP-PRVCY | Privacy | Privacy |
| CUI//SP-PROCURE | General Procurement & Acquisition | Procurement & Acquisition |
| CUI//SP-PROPIN | General Proprietary Business Information | Proprietary Business Information |
| CUI//SP-NNPI | Naval Nuclear Propulsion Information | Defense |
| CUI//SP-SRI | Nuclear Security Related Information | Nuclear |
| CUI//SP-PERS | Personnel Records | Privacy |
| CUI//SP-MFC | Proprietary Manufacturer | Proprietary Business Information |
| CUI//SP-PCII | Protected Critical Infrastructure Information | Critical Infrastructure |
| CUI//SP-DCNI | Unclassified Controlled Nuclear Information – Defense | Defense |
| CUI//SP-UCNI | Unclassified Controlled Nuclear Information – Energy | Nuclear |
Learn More
While this blog can get you started on determining how to classify your information, the experts at CyberSheath would be happy to help your company identify your FCI and CUI and create plans for safeguarding it. Contact us to take the next step in learning how to protect your sensitive information.