How should organisations determine whether information in a defence contract is CUI or only FCI?

The key test is whether a law, regulation, or government-wide policy requires safeguarding or dissemination controls. FCI is contract-related information not intended for public release, but it does not meet that threshold. If the data is sensitive technical, operational, privacy, or export-controlled information, it is more likely to be CUI and should be handled under the relevant federal requirements.

Why This Matters for Security Teams

Defence contracts often mix program management language with data that may trigger legal safeguarding obligations, so the first task is not “is this important?” but “is this information covered by a rule that requires protection?” That distinction matters because FCI is simply contract-related information not intended for public release, while CUI is defined by statute, regulation, or government-wide policy. Misclassification can lead to under-protection of technical drawings, export-controlled details, or operational data, or to over-classification that slows delivery. Current guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces that controls should track the sensitivity and required protections of the information, not just the contract label. NHI Management Group’s Ultimate Guide to NHIs also shows why this classification question matters operationally, since poor information handling often travels with weak identity and secrets governance. In practice, many security teams encounter CUI exposure only after a subcontractor, shared repository, or service account has already handled the data without the right controls.

How It Works in Practice

The practical test is to trace the information back to an actual protection requirement. If a contract deliverable contains data covered by a CUI category, handling instruction, export control rule, privacy law, or other government-wide safeguarding mandate, it should be treated as CUI. If it is only contract administration content, pricing discussions, routine schedules, or general project correspondence not subject to those rules, it is usually FCI. That said, organisations should not rely on document titles alone. A file named “status update” can still contain CUI if it includes technical performance data or controlled operational details.

A defensible workflow usually includes three steps:

• Identify the governing source that creates the protection requirement.
• Map the information to the specific CUI category or marking instruction.
• Apply the correct handling, access, retention, and sharing controls.

For NHI-heavy environments, this is especially important because service accounts, API keys, and automation pipelines often move defence contract data across systems faster than humans review it. The visibility problem is real: NHI Management Group reports that only 5.7% of organisations have full visibility into their service accounts, which makes it easier for CUI to spread unnoticed through automation. Use NIST SP 800-53 Rev 5 Security and Privacy Controls as the control baseline for access limitation, auditing, and media protection, then align classification decisions with the contract’s actual data content. These controls tend to break down when contractors reuse shared folders and machine identities across programs because the same automation path may process both FCI and CUI without clear separation.

Common Variations and Edge Cases

Tighter classification often increases review overhead, requiring organisations to balance speed against the cost of over-protecting routine contract data. That tradeoff becomes sharper in mixed documents, where one appendix is FCI and another contains CUI or export-controlled material. Current guidance suggests classifying at the most sensitive level present in the record set, then separating or redacting where possible, but there is no universal standard for every contract format.

Edge cases usually appear in these situations:

• Technical attachments that are not marked but are covered by export or program-specific controls.
• Subcontractor exchanges where one party assumes FCI handling is sufficient for all deliverables.
• Machine-generated outputs from build systems or test environments that reproduce controlled content.
• Legacy repositories where markings were never applied consistently.

Security teams should also remember that classification is not the same as access design. A file can be properly labeled FCI or CUI and still be overexposed if secrets, service accounts, or shared credentials grant broad access. NHI Management Group’s Ultimate Guide to NHIs notes that excessive privilege is widespread across non-human identities, which is why access control must follow the data, not just the repository. When uncertainty remains, the safe path is to treat the item as potentially CUI until the contract authority, security office, or designated compliance owner resolves the governing requirement.

Related resources from NHI Mgmt Group

• Why do manual contract processes create operational and governance risk in larger organisations?
• Why do organisations handling CUI often need GCC High instead of standard cloud tenants?
• How should organisations mark Controlled Unclassified Information across documents, emails, and slide decks?
• What breaks when CUI is shared without the right banner and designation information?