Understand what the terms do
Federal Contract Information is nonpublic information provided by or generated for the Government under a contract to develop or deliver a product or service. FAR 52.204-21 excludes public government information and simple transactional information such as information needed to process payments. That definition is a starting point for a conversation about an actual workflow, not a label for every file in a business.
Controlled Unclassified Information is a different concept. NARA explains that CUI requires safeguarding or dissemination controls grounded in applicable law, regulation, or government-wide policy. CUI is unclassified, but that does not make it ordinary public information. A Level 1 readiness plan must not become a reason to overlook a CUI obligation.
Use a three-question intake
First ask where the information originated and why the company has it. A publicly posted solicitation and a nonpublic instruction issued during contract performance may have different treatment. Second ask what the contract, data markings, and agency guidance say. Third ask who can give an authoritative clarification when those signals disagree.
For an illustrative manufacturer, a public capability brochure, a nonpublic delivery instruction, and a technical drawing should not automatically receive the same label. The drawing requires investigation into the actual designation and contractual context. Neither its file extension nor the fact that it came by email answers that question.
Record uncertainty without spreading the data
Create an internal intake record containing a short description, source organization, related contract, owner of the classification question, and the clarification received. Keep the underlying material in an approved environment. A generic planning tool should contain a reference such as “data intake question 04,” not an uploaded contract attachment.
Do not move suspected CUI into a new personal account to make it easier to inspect. Route the question to the appropriate customer contact and your responsible security or contracts personnel. Document the answer and adjust the systems, access, and readiness work affected by it.
Revisit the decision when the work changes
A company may begin with a limited FCI workflow and later receive different information under an expanded task. Build a review trigger into onboarding, changes in work scope, and new supplier relationships. The question is about the information actually handled and the obligations that apply, rather than a permanent company-wide nickname.
If CUI is involved, investigate the additional contractual safeguards and assessment requirements before treating Level 1 as sufficient. This guide does not determine your required level. Its practical purpose is to help you gather the right questions and avoid investing around an assumption that the contract does not support.