FCI or CUI: Which One Your Shop Holds Decides What CMMC Means for You

Manufacturers in Ohio hear about CMMC constantly: from primes, from trade groups, from vendors selling assessments. A lot of what they hear assumes every shop needs a Level 2 certification. That is not how the program works. What CMMC means for your business depends on one question first: what kind of government information, if any, your shop actually holds.

There are two categories to understand. Federal Contract Information, or FCI. And Controlled Unclassified Information, or CUI. Which one you hold, or whether you hold either, decides the rest.

If you have no DoD work, CMMC is not your requirement

Start here, because it is often skipped. CMMC is a Department of Defense program. If you do not hold DoD contracts or subcontracts, and you are not bidding on them, CMMC does not apply to you. Your commercial customers may still send you security questionnaires, and good security is still worth doing, but no one should be selling you a CMMC certification you do not need.

Contracts solely for commercially available off-the-shelf items are also outside CMMC requirements, and the FAR basic safeguarding clause excludes COTS subcontracts as well.

What FCI is

FCI is defined in FAR 52.204-21 as information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government provides to the public and simple transactional information, such as what is needed to process payments.

In plain terms: if you have a federal contract or subcontract and you hold non-public information about that work, such as the contract details, delivery schedules, or specs that are not marked as CUI, that is likely FCI.

FAR 52.204-21 requires 15 basic safeguarding requirements for systems that handle FCI. They include limiting access to authorized users, authenticating users, sanitizing media before disposal, limiting physical access, escorting visitors, monitoring and protecting communications at the network boundary, separating publicly accessible systems, fixing flaws promptly, and running malware protection with current updates and scans. These are basics most well-run shops already have or can put in place.

What CUI is

CUI is a broader federal category of information that requires safeguarding under law, regulation, or government policy. For defense suppliers, it often shows up as controlled technical information: drawings, specifications, technical data packages, and process documentation marked with a CUI banner or distribution statement. When a DoD contract includes DFARS 252.204-7012 and you handle covered defense information, you must implement NIST SP 800-171 and report cyber incidents to DoD within 72 hours.

NIST SP 800-171 Revision 2 has 110 requirements. That is a much larger lift than the 15 FCI requirements, and it is where most of the CMMC conversation happens.

How the levels line up

CMMC, codified at 32 CFR Part 170, maps to these categories:

• Level 1 applies to contractors that handle FCI only. It requires an annual self-assessment against the 15 FAR 52.204-21 requirements and an annual affirmation by a senior official. Plans of action are not allowed at Level 1; you must meet all 15.
• Level 2 applies to contractors that handle CUI. It covers the 110 NIST SP 800-171 Rev 2 requirements, assessed every three years, either by self-assessment or by an authorized third-party assessor depending on the contract, with annual affirmations.
• Level 3 applies to a smaller set of contractors handling CUI on higher priority programs and involves government-led assessment.

Where the program stands today

CMMC Phase 1 began on November 10, 2025. During Phase 1, solicitations can require Level 1 self-assessments and Level 2 self-assessments. Phase 2, which would have added third-party Level 2 assessments, was planned for November 10, 2026. On July 13, 2026, the Department suspended Phase 2. During the suspension, new requirements are limited to Level 1 (Self) and Level 2 (Self), and DoD has said it will continue to enforce NIST SP 800-171 through self-assessments and select government-led assessments. The DoD CIO's CMMC page is the primary source for current status.

We covered the suspension in more detail in what manufacturers should still do on NIST 800-171 and SPRS while Phase 2 is paused. The short version: Phase 1 self-assessments still apply, and so does DFARS 7012 where it is in your contracts.

How to figure out which one you hold

Take an afternoon and answer these questions with your contracts and your engineering lead in the room:

1. Do we hold any DoD prime contracts or subcontracts, or plan to bid on them?
2. Do our contracts or purchase orders include FAR 52.204-21? DFARS 252.204-7012? A CMMC clause?
3. Have we ever received drawings, specs, or data marked CUI, or with a distribution statement limiting release?
4. Where does that information go once it arrives? Email, a shared drive, an engineering workstation, the shop floor?

If the answer to question 3 is yes, you hold CUI, and the work is NIST SP 800-171. If you only hold contract information without CUI markings, Level 1 is likely your scope. If you are not sure, ask your prime in writing which level they expect and why. Our post on handling a CUI drawing from receipt to delete shows how CUI tends to spread through a shop.

Keep the scope small

If you do hold CUI, the most useful thing you can do is limit where it goes. A shop that keeps CUI in one controlled enclave has far fewer systems to protect and assess than one where drawings sit in everyone's email. Scoping decisions made early save the most work later.

Do not overstate your status

Whatever level applies, the affirmations are signed by a senior official, and SPRS scores are representations to the government. Score honestly. An accurate score with a dated plan for the gaps is defensible. An inflated one creates real legal exposure.

How we help

TRNSFRM works with Ohio manufacturers on FCI and CUI scoping, NIST SP 800-171, and CMMC readiness. See our CMMC Level 2 guide, our NIST overview, and our manufacturing page. Score yourself with the free compliance checklist, or book a free 45-minute Compliance Gap Audit and we will help you figure out which level, if any, applies.