CUI Program Toolkit
CUI or FCI? Decide It Per Contract, Defend It in an Audit
The hardest call is which flowdown clauses actually apply
You have a contract on your desk and you are not sure whether the information is Federal Contract Information or Controlled Unclassified Information, which clauses flow down to your subcontractors, or which safeguarding standard they have to meet. Misclassifying FCI as CUI, or the reverse, creates compliance gaps that auditors and C3PAOs will find during assessments. The two categories carry distinct safeguarding obligations, and the analysis has to be documented per contract, not assumed at the program level.
Get instant access to the toolkit
- Answer six yes/no questions about government-generated data, DFARS 252.204-7012, FAR 52.204-21, and the DD Form 254
- Record the source document beside each answer
- Determine whether a law, regulation, or government-wide policy specifically authorizes the information to be controlled
- If yes, it is CUI under a registered category
- Map obligations to subcontractors across 7012, 7020, 7021, and FAR 52.204-21
- Mapped by whether CUI or FCI applies
- One page for the contract file
- Records classification result, sources, safeguarding standard, and who signed off
Mapped to a named regulatory hook
Every artifact maps to a named hook under 32 CFR Part 2002 or a NIST SP 800-171 Rev 2 control family.
Citations throughout
32 CFR 2002.14, 2002.16, 2002.20, 2002.30, and 2002.32, DFARS 252.204-7012/7020/7021, FAR 52.204-21, and the NARA CUI Registry at cui.gov.
CUI Category Reference Table
Aligned to the NARA CUI Registry with the authorizing instrument listed per category.
800-171 / 800-172 crosswalk
Artifact-to-control crosswalk citing specific requirement identifiers such as 3.1.3, 3.8.3, and 3.13.8.
Destruction guidance with real specs
Aligned to NIST SP 800-88 Rev. 1 and DIN 66399 Level P-4 cross-cut shredding.
Per contract. The analysis must be completed for each contract and attached to that contract file, not assumed at the program level, because clause triggers and data types vary from award to award.
The recommended baseline is the life of the contract plus three years, absent a stricter period in your contract, agency guidance, or federal recordkeeping schedule. Auditors and C3PAOs will request it during assessments.
CUI Basic applies when safeguarding is required but no handling controls beyond 32 CFR Part 2002 and NIST SP 800-171 are specified. CUI Specified applies when the authorizing instrument imposes additional or different controls, for example CUI//SP-CTI or CUI//SP-ITAR, and you check that instrument directly.
No. The toolkit is for informational and educational purposes and does not replace legal counsel, your contracting officer, or a qualified CUI compliance consultant. The templates are starting points you verify against primary sources and your contract before relying on them.
Contract leads and compliance officers at defense industrial base contractors who have to make a per-contract classification call and know a wrong one creates findings.