FCI, CUI, ITAR and CMMC explained

What it is. Information provided by or created for the government under a contract that isn’t meant for public release: purchase orders, delivery schedules, contract correspondence, non-public part lists. If you hold a DoD contract or subcontract, you almost certainly hold FCI.

What it asks of you. The 15 basic safeguarding requirements in FAR 52.204-21, which CMMC calls Level 1: controlled user accounts and sign-in, physical access, malware protection, timely patching and keeping public-facing systems separate. Level 1 is a yearly self-assessment, affirmed by a senior official in the DoD’s Supplier Performance Risk System (SPRS).

What it is. Information the government requires you to protect that isn’t classified: technical drawings and specifications with a distribution statement, export-controlled technical data, some contract and program data. It usually arrives marked, or your contract identifies it.

What it asks of you. DFARS 252.204-7012 requires the 110 security requirements of NIST SP 800-171, which CMMC calls Level 2, plus reporting cyber incidents to the DoD within 72 hours. Your contract states whether Level 2 is a self-assessment or an assessment by an authorized third-party organization (a C3PAO).

What it is. U.S. State Department rules for defense articles and the technical data behind them. ITAR is not part of CMMC, but ITAR technical data is usually CUI as well, so the two overlap on the same files.

What it asks of you. Controls on who can see the data (U.S. persons, unless the State Department has authorized otherwise), where it is stored and who can support the systems that hold it. That is why many ITAR shops use Microsoft 365 GCC High. Export classification is decided by your empowered official or export counsel; Retrisa works within that decision.

What it is. The Department of Defense program that checks contractors actually protect FCI and CUI, rather than taking it on trust. It is written into DoD contracts and flows down from primes to subcontractors.

What it asks of you. Level 1 for FCI (yearly self-assessment). Level 2 for CUI (NIST SP 800-171, self-assessed or assessed by a C3PAO every three years, with a yearly affirmation). Level 3 for a small number of high-priority programs, assessed by the DoD itself. Your contract states the level and the type of assessment.

1. Scope. Find where FCI and CUI actually live: which mailboxes, file shares, laptops, machines and people touch them. A tight, well-documented scope is the biggest single saving in CMMC.
2. Gap assessment. Check your environment against Level 1 or NIST SP 800-171 and give you a written list of gaps in priority order, with what each one will take to close.
3. Remediate. Configure Microsoft 365, devices and access to close the gaps: MFA, encryption, logging, device management, backups and access control. If you need GCC High or a separate, smaller environment for CUI, we plan and quote the move.
4. Document. Write the System Security Plan, policies and Plan of Action & Milestones, and collect the evidence an assessor will ask to see.
5. Keep it current. Controls drift as people join, leave and change devices. We keep them working and the evidence up to date every month, ready for your yearly affirmation and your next assessment.

Retrisa is not a C3PAO and does not issue CMMC certifications. We prepare your environment and your documentation; formal Level 2 certification assessments are carried out by an authorized C3PAO. This page is general information, not legal advice: your contract and contracting officer set your requirements.

Can Retrisa certify us?

No. Only an authorized C3PAO can carry out a Level 2 certification assessment, and Level 3 assessments are done by the DoD. Retrisa gets your environment and documentation ready for it, and keeps them ready afterwards.

Do we need Microsoft 365 GCC High?

Not always. Level 1 can usually be met in commercial Microsoft 365. For CUI, and especially ITAR technical data, many contractors move to GCC High or keep that data in a separate, smaller environment. We recommend one after scoping; a migration is quoted separately.

How long does readiness take?

It depends on the gaps. Level 1 is often a matter of weeks. Level 2 readiness usually takes several months, longer if a migration is involved. The gap assessment gives you a realistic plan before you commit to the work.

Is CMMC part of a managed plan?

Keeping you compliant is: the Managed Compliance plan keeps your controls, System Security Plan, POA&M and evidence current every month. Getting ready in the first place (scoping, remediation and documentation) is quoted as a project.

We only have FCI. Is this still worth a call?

Yes. Level 1 is smaller, but it still needs the 15 requirements in place and a senior official to affirm them every year. A short call tells you how far you are from that.