--- title: "FCI or CUI: Which One Your Shop Holds Decides What CMMC M..." url: https://trnsfrm.tech/blog/manufacturers-fci-vs-cui-cmmc description: "Whether you hold Federal Contract Information, Controlled Unclassified Information, or neither decides what CMMC means for your shop. How to tell the…" lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: FCI or CUI: Which One Your Shop Holds Decides What CMMC Means for You (https://trnsfrm.tech/blog-covers/cmmc-phase-2-pause-nist-sprs.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO October 24, 2026 # FCI or CUI: Which One Your Shop Holds Decides What CMMC Means for You Manufacturing and CMMC (https://trnsfrm.tech/blog?category=Manufacturing+and+CMMC)#cmmc #nist-800-171 #manufacturing #far-52-204-21 Manufacturers in Ohio hear about CMMC constantly: from primes, from trade groups, from vendors selling assessments. A lot of what they hear assumes every shop needs a Level 2 certification. That is not how the program works. What CMMC means for your business depends on one question first: what kind of government information, if any, your shop actually holds. There are two categories to understand. Federal Contract Information, or FCI. And Controlled Unclassified Information, or CUI. Which one you hold, or whether you hold either, decides the rest. ## If you have no DoD work, CMMC is not your requirement Start here, because it is often skipped. CMMC is a Department of Defense program. If you do not hold DoD contracts or subcontracts, and you are not bidding on them, CMMC does not apply to you. Your commercial customers may still send you security questionnaires, and good security is still worth doing, but no one should be selling you a CMMC certification you do not need. Contracts solely for commercially available off-the-shelf items are also outside CMMC requirements, and the FAR basic safeguarding clause excludes COTS subcontracts as well. ## What FCI is FCI is defined in FAR 52.204-21 (https://www.acquisition.gov/far/52.204-21) as information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government provides to the public and simple transactional information, such as what is needed to process payments. In plain terms: if you have a federal contract or subcontract and you hold non-public information about that work, such as the contract details, delivery schedules, or specs that are not marked as CUI, that is likely FCI. FAR 52.204-21 requires 15 basic safeguarding requirements for systems that handle FCI. They include limiting access to authorized users, authenticating users, sanitizing media before disposal, limiting physical access, escorting visitors, monitoring and protecting communications at the network boundary, separating publicly accessible systems, fixing flaws promptly, and running malware protection with current updates and scans. These are basics most well-run shops already have or can put in place. ## What CUI is CUI is a broader federal category of information that requires safeguarding under law, regulation, or government policy. For defense suppliers, it often shows up as controlled technical information: drawings, specifications, technical data packages, and process documentation marked with a CUI banner or distribution statement. When a DoD contract includes DFARS 252.204-7012 (https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.) and you handle covered defense information, you must implement NIST SP 800-171 and report cyber incidents to DoD within 72 hours. NIST SP 800-171 Revision 2 has 110 requirements. That is a much larger lift than the 15 FCI requirements, and it is where most of the CMMC conversation happens. ## How the levels line up CMMC, codified at 32 CFR Part 170, maps to these categories: - **Level 1** applies to contractors that handle FCI only. It requires an annual self-assessment against the 15 FAR 52.204-21 requirements and an annual affirmation by a senior official. Plans of action are not allowed at Level 1; you must meet all 15. - **Level 2** applies to contractors that handle CUI. It covers the 110 NIST SP 800-171 Rev 2 requirements, assessed every three years, either by self-assessment or by an authorized third-party assessor depending on the contract, with annual affirmations. - **Level 3** applies to a smaller set of contractors handling CUI on higher priority programs and involves government-led assessment. ## Where the program stands today CMMC Phase 1 began on November 10, 2025. During Phase 1, solicitations can require Level 1 self-assessments and Level 2 self-assessments. Phase 2, which would have added third-party Level 2 assessments, was planned for November 10, 2026. On July 13, 2026, the Department suspended Phase 2. During the suspension, new requirements are limited to Level 1 (Self) and Level 2 (Self), and DoD has said it will continue to enforce NIST SP 800-171 through self-assessments and select government-led assessments. The DoD CIO's CMMC page (https://dodcio.defense.gov/CMMC/About/) is the primary source for current status. We covered the suspension in more detail in what manufacturers should still do on NIST 800-171 and SPRS while Phase 2 is paused (https://trnsfrm.tech/blog/cmmc-phase-2-pause-nist-800-171-sprs-manufacturers). The short version: Phase 1 self-assessments still apply, and so does DFARS 7012 where it is in your contracts. ## How to figure out which one you hold Take an afternoon and answer these questions with your contracts and your engineering lead in the room: 1. Do we hold any DoD prime contracts or subcontracts, or plan to bid on them? 2. Do our contracts or purchase orders include FAR 52.204-21? DFARS 252.204-7012? A CMMC clause? 3. Have we ever received drawings, specs, or data marked CUI, or with a distribution statement limiting release? 4. Where does that information go once it arrives? Email, a shared drive, an engineering workstation, the shop floor? If the answer to question 3 is yes, you hold CUI, and the work is NIST SP 800-171. If you only hold contract information without CUI markings, Level 1 is likely your scope. If you are not sure, ask your prime in writing which level they expect and why. Our post on handling a CUI drawing from receipt to delete (https://trnsfrm.tech/blog/cui-drawing-from-prime-receipt-to-delete) shows how CUI tends to spread through a shop. ## Keep the scope small If you do hold CUI, the most useful thing you can do is limit where it goes. A shop that keeps CUI in one controlled enclave has far fewer systems to protect and assess than one where drawings sit in everyone's email. Scoping decisions made early save the most work later. ## Do not overstate your status Whatever level applies, the affirmations are signed by a senior official, and SPRS scores are representations to the government. Score honestly. An accurate score with a dated plan for the gaps is defensible. An inflated one creates real legal exposure. ## How we help TRNSFRM works with Ohio manufacturers on FCI and CUI scoping, NIST SP 800-171, and CMMC readiness. See our CMMC Level 2 guide (https://trnsfrm.tech/guides/cmmc-level-2), our NIST overview (https://trnsfrm.tech/frameworks/nist), and our manufacturing page (https://trnsfrm.tech/industries/manufacturing). Score yourself with the free compliance checklist (https://trnsfrm.tech/compliance-checklist), or book a free 45-minute Compliance Gap Audit (https://trnsfrm.tech/book) and we will help you figure out which level, if any, applies. ## Keep exploring More from the TRNSFRM team. ### All Blog Posts Browse every cybersecurity and IT article. https://trnsfrm.tech/blog ### Case Studies Real CMMC, NIST, and FTC outcomes. https://trnsfrm.tech/case-studies ### Free Compliance Checklist Score yourself across 47 controls in 10 minutes. https://trnsfrm.tech/compliance-checklist ### Compliance Frameworks CMMC, NIST 800-171, ISO 27001, HIPAA, FTC, ITAR. https://trnsfrm.tech/governance ### Cybersecurity Operations 24/7 MDR, SOC, and threat response. https://trnsfrm.tech/cybersecurity ### IT Resilience Framework Assess, Remediate, Operate, Improve. A continuous lifecycle. https://trnsfrm.tech/it-resilience-framework ### ITAR Compliance Checklist Work through ITAR readiness control by control. https://trnsfrm.tech/frameworks/itar ### MSP Partner Program White-label security and compliance for MSPs. https://trnsfrm.tech/partners/msp ### Choosing a Cybersecurity Firm 2026 buying guide and provider directory. https://trnsfrm.tech/blog/cybersecurity-companies ## More industries we secure Regulated-industry programs built by TRNSFRM. ### Aerospace & Space AS9100, CMMC, ITAR programs for aerospace suppliers. https://trnsfrm.tech/industries/aerospace-space ### Ambulatory Surgery Centers HIPAA-grade IT for ASCs and outpatient surgery. https://trnsfrm.tech/industries/ambulatory-surgery-centers ### Automotive Suppliers TISAX, CMMC, and OEM cyber flow-downs. https://trnsfrm.tech/industries/automotive-suppliers ### Behavioral Health HIPAA + 42 CFR Part 2 for behavioral health providers. https://trnsfrm.tech/industries/behavioral-health ### Defense & DoD Suppliers CMMC 2.0 & NIST 800-171 for the defense industrial base. https://trnsfrm.tech/industries/defense-dod-suppliers ### Dental Practices Real HIPAA compliance for dental groups and DSOs. https://trnsfrm.tech/industries/dental ## Featured cybersecurity insights Deeper reads from the TRNSFRM team. ### Building an Incident Response Plan You'll Actually Use A pragmatic IR playbook, not a shelf binder. https://trnsfrm.tech/blog/building-an-incident-response-plan-you-ll-actually-use ### Cloud Misconfigurations: The #1 Cause of Data Breaches Where teams get cloud wrong — and how to fix it. https://trnsfrm.tech/blog/cloud-misconfigurations-the-1-cause-of-data-breaches ### CMMC 2.0: What Defense Contractors Must Do Now The DIB compliance clock is ticking. https://trnsfrm.tech/blog/cmmc-2-0-compliance-what-defense-contractors-must-do-now ### Deepfake Fraud in the Boardroom: The New CEO Scam Why voice and video attacks now target execs. https://trnsfrm.tech/blog/deepfake-fraud-in-the-boardroom-the-new-ceo-scam ### MFA Bypass Techniques and How to Stop Them Attackers are getting past MFA — here's how. https://trnsfrm.tech/blog/mfa-bypass-techniques-and-how-to-stop-them ### Quantum Computing and the Cryptography Apocalypse Start planning your post-quantum crypto migration. https://trnsfrm.tech/blog/quantum-computing-and-the-cryptography-apocalypse Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "176", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "FCI or CUI: Which One Your Shop Holds Decides What CMMC Means for You", "description": "Whether you hold Federal Contract Information, Controlled Unclassified Information, or neither decides what CMMC means for your shop. How to tell the difference.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-10-24T14:43:57.171419+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/cmmc-phase-2-pause-nist-sprs.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "FCI or CUI: Which One Your Shop Holds Decides What CMMC Means for You", "item": "https://trnsfrm.tech/blog/manufacturers-fci-vs-cui-cmmc" } ] } ] } ] ```