Getting Started With CMMC Sensitive Information: Identification and Access Essentials

When teams mislabel DoD/DoW data, they usually create one of two problems. They either over-scope the environment (pulling too many systems and users into assessment) or under-protect controlled unclassified information (CUI) and miss required safeguards.

Proper CMMC preparation requires a clear framework to distinguish Federal Contract Information (FCI) from CUI, recognize CUI within daily workflows, and establish auditable access controls.

What “Sensitive Information” Means For CMMC 

“Sensitive information” extends beyond formally classified materials to include unclassified data that could compromise government operations, national security, or individual privacy if mishandled or disclosed without authorization.

Within the CMMC framework, “unclassified” does not mean low-risk. It indicates that the information must be protected through standardized cybersecurity baseline controls rather than classified handling protocols. 

Proper handling requires categorizing all information you handle into its exact CMMC classification before establishing access controls.

The Two Core Classifications: FCI vs. CUI 

CMMC handling requirements depend on what type of sensitive information you’re dealing with. The two categories you need to distinguish are Federal Contract Information and Controlled Unclassified Information. 

• Federal Contract Information is the baseline. It includes contract-related information that is not intended for public release and is provided by (or generated for) the government under a contract. 
• Controlled Unclassified Information falls within that larger set. It is still unclassified, but it comes with an additional requirement: law, regulation, or government-wide policy requires specific safeguarding or dissemination controls. 

A simple way to remember it is that all CUI is FCI, because it is still non-public contract-related information. However, not all FCI is CUI, because a lot of contract information does not require special handling.

How CUI Becomes “CUI”

CUI can be identified in two main ways:

• It inherently qualifies because it matches a recognized CUI category/subcategory (as defined in the National Archives CUI Registry).
• It is designated by an authorized holder, or a person or organization permitted to handle CUI (often through contract), who is responsible for determining CUI status at creation and applying markings and dissemination instructions.

For contractors, this creates a practical responsibility. While you may receive CUI already marked, you may also generate CUI (or copy CUI into new documents, tickets, reports, or repositories). When that happens, you need a consistent internal method for handling and marking it in accordance with the requirements that apply to your work. 

For example, an invoice submitted for contract payment is often FCI because it supports contract performance and isn’t intended for public release. It is not CUI unless it includes information that triggers special handling. 

On the other hand, technical data marked as a controlled category (for example, certain controlled technical information) is both FCI and CUI, and it carries stricter handling expectations. 

Who Should Have Access to Controlled Unclassified Information? 

CUI access should be governed strictly by intent, with a clear reason you can explain and support. Before you share, transmit, or grant access to CUI, run an evaluation across four criteria: 

• Lawful Government Purpose: Does the recipient have a legitimate purpose aligned to government-authorized work?

• Dissemination Controls: Are there any restrictions that limit who can receive it?

• Need-to-Know For the Task: Does the recipient need this specific CUI to perform an assigned function?
• Able to Safeguard: Is the recipient trained and positioned to safeguard it appropriately?

Even inside your organization, the operational standard should be least privilege: give access only to what is required for as long as required.

Reducing Risk and Scope: Controlling Where CUI Flows 

When CUI ends up scattered across inboxes or unauthorized devices, it creates two major challenges:

• Your vulnerability increases because you have a greater risk of data loss or unauthorized access.
• Your assessment boundary expands because more systems are brought “in scope” for CMMC controls.

A practical way to keep both under control is to map how CUI moves through your environment across five core phases: 

• Where CUI enters (prime, government portal, customer email, supplier transfer)

• Where it is stored (repositories, engineering tools, ticketing, shared drives)

• Who touches it (roles and processes, not names)

• How it is transmitted (email, secure portals, file transfer, integrations)

• Where it exits (deliverables, reporting, supplier handoffs)

How Business Transformation Institute Helps Organizations Operationalize CUI Protection 

Protecting controlled unclassified information usually breaks down in the same places: unclear data definitions, inconsistent markings, access that spreads over time, and CUI copied into more systems than anyone intended. At Business Transformation Institute, we help organizations close those gaps with a practical, auditable approach. 

Our focus is on keeping CUI safeguards tied to real workflows and clear ownership, rather than relying on informal tribal knowledge or one-time cleanups. We help you build a program that’s easier to manage and explain during assessment. 

Further Guidance

For deeper knowledge on how CUI categories work, how authorized holders apply markings and dissemination rules, and how official policy language supports access decisions, access our comprehensive guide: Identification and Access of Sensitive Information.