Your CMMC level comes from your contract, and the type of information the contract brings decides which level fits. Here is how to tell FCI from CUI, and what each one requires.

FCI: federal contract information

FAR 52.204-21 defines FCI as information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service. It does not include information the government provides to the public or simple transactional information, such as what is needed to process payments.

FAR 52.204-21 lists 15 basic safeguarding requirements for systems that process, store or transmit FCI, such as limiting access to authorized users, sanitizing media before disposal, and scanning for malicious code.

CUI: controlled unclassified information

CUI comes through the contract.…