This looks like FCI, not CUI.

What to do

1. Check the contract for FAR 52.204-21, the basic safeguarding clause.
2. Meet the requirements in that clause. They map to a subset of 800-171, listed below.
3. Do not assume this stays FCI. A modification or a new deliverable can introduce CUI.
4. If the contract also contains DFARS 252.204-7012, work through this worksheet again for the data that clause covers.

FAR 52.204-21; CMMC Level 1, 32 CFR 170.15.

The Level 1 practices

FAR 52.204-21 lists fifteen basic safeguarding requirements. CMMC assesses them as these seventeen practices from NIST SP 800-171.

1. 3.1.1 Know who and what is allowed on your systems AC Level 1 5 pt
2. 3.1.2 Limit what each person can do once inside AC Level 1 5 pt
3. 3.1.20 Verify and limit outside systems AC Level 1 1 pt
4. 3.1.22 Review what goes on public sites AC Level 1 1 pt
5. 3.5.1 Give every user, process, and device an identity IA Level 1 5 pt
6. 3.5.2 Prove those identities IA Level 1 5 pt
7. 3.8.3 Destroy or wipe media properly MP Level 1 5 pt
8. 3.10.1 Limit physical access PE Level 1 5 pt
9. 3.10.3 Escort visitors PE Level 1 1 pt
10. 3.10.4 Keep physical access logs PE Level 1 1 pt
11. 3.10.5 Manage keys and badges PE Level 1 1 pt
12. 3.13.1 Guard your boundaries SC Level 1 5 pt
13. 3.13.5 Put public services in their own subnet SC Level 1 5 pt
14. 3.14.1 Find and fix flaws on a clock SI Level 1 5 pt
15. 3.14.2 Run malware protection SI Level 1 5 pt
16. 3.14.4 Keep malware definitions current SI Level 1 5 pt
17. 3.14.5 Scan on schedule and in real time SI Level 1 3 pt

Not the outcome you expected?

Run the worksheet again for one specific set of information, or read the other outcomes.

• Treat this as CUI.
• Separate it, then treat the CUI part as CUI.
• Not federal information. Out of scope.
• This one goes to your contracting officer.