- FCI and CUI have defined meanings; neither simply means all company-confidential information.
- A document’s purpose, source, authority and handling instructions matter.
- Uncertainty should lead to an authorized clarification, not an invented designation.
Learning objectives
This lesson introduces Federal Contract Information, or FCI, and Controlled Unclassified Information, or CUI. You will practice using context to explain why a document might require particular handling and why appearance alone does not settle the question. The goal is to recognize what you know, what you need to learn and who should resolve an uncertainty.
The examples use invented information. Treat them as reasoning exercises rather than a classification service for real files. A learner should not remove a marking, forward a questionable document or create an unofficial public version merely to test a classroom conclusion.
- Describe the core distinction between FCI and CUI.
- Identify contextual facts relevant to information handling.
- Recognize when a designation question needs an authorized answer.
Understand the definitions before using the labels
FCI concerns information intended to remain nonpublic that the government supplies, or others produce for it, under a contract to provide a government product or service. The definition excludes government-provided public information and simple transactional information, such as payment processing. CUI requires a government connection: the government, or an entity acting for it, creates or possesses the information. An applicable law, regulation or governmentwide policy must require or permit safeguarding or dissemination controls. The definitions depend on context and authority.
Do not treat CUI as a synonym for classified information or for every confidential commercial record. A company's privately developed business plan may be sensitive without automatically becoming CUI. Conversely, a technical document can have handling requirements that are not obvious from its ordinary appearance. The National Archives CUI Registry helps identify authorized categories and their underlying authorities.
Ask about the information rather than the container
A PDF, spreadsheet, email or drawing format tells you how information is packaged, not its governing status. Ask who supplied or created it, for what activity, under which agreement and with what instructions. Read the relevant markings and accompanying context. If something is missing or inconsistent, preserve the information appropriately and route the question to the responsible authority or established organizational contact.
An absent label is not a reliable permission slip, and a bold “confidential” label does not explain every government handling obligation. Learning the distinction means avoiding both shortcuts. It also means distinguishing a classroom hypothesis from a decision that affects real handling. Your role may be to recognize uncertainty and escalate it, while another authorized person determines the applicable instruction.
Worked example: three items in one project folder
A hypothetical engineering team has a public agency brochure, a nonpublic project schedule supplied for contract work and a technical package carrying specific CUI handling instructions. A learner initially labels the whole folder CUI because it belongs to a defense project. Another learner assumes none of it is controlled because the filenames look ordinary. Both conclusions skip the relevant context.
The public brochure has a documented public source. The schedule requires review against the FCI definition and contract context. The technical package has explicit handling instructions that must be understood and followed. The lesson is to examine the items and their context rather than treating the folder name as the authority. Keeping the items together does not remove their differences or authorize casual redistribution.
Practice a context card
For each fictional item, record its source, purpose, intended recipients, public-release context, visible instructions and unresolved question. Do not include real content. Then write the next appropriate learning action: read the governing instruction, confirm the information owner, or request clarification through the established channel. Avoid adding a final label when the scenario does not provide enough evidence.
Now change one fact. Suppose the team creates a new analysis from the technical package. Ask what handling instructions apply to the derived work rather than assuming that a new file format or authorship makes it unrestricted. This exercise shows why information handling follows the content and applicable authority through work, not merely the original attachment.
Self-check and answer
A colleague says, “The file has no CUI marking, so I can put it in our general training folder.” What is wrong with that conclusion, and what should the learner do next? Use the reasoning from this lesson without attempting to designate the file yourself.
Answer: the absence of a marking does not establish that general distribution is authorized. The learner needs the file's source, purpose, contractual context and applicable instructions, then should use the organization's approved clarification and handling process. The appropriate conclusion is that permission has not been established. The exercise tests recognition of missing context, not an ability to make every information determination independently.
Sources & further learning
Use primary sources and the current requirements relevant to your situation. This guide is a learning resource, not a contract-specific or assessment determination.
Follow information through its whole lifecycle
Build on this guide with a connected concept, then explain how the two ideas fit together.
Continue learningWhen the concept becomes a practical question
Bring the questions from this lesson to Federal Bid Partners to discuss their connection to your organization’s work and readiness needs.
Talk with Federal Bid PartnersSelf-checks are educational reflection activities. They do not confer a credential, demonstrate compliance, or establish certification. Read our editorial approach.