Ask where the information came from
Start with actual contract work. What information does the government or prime provide? What does your team generate for that work? What is already public, and what is intended to remain nonpublic? FAR 52.204-21 distinguishes FCI from public information and certain simple transactional information.
For CUI questions, use the National Archives CUI Registry and the responsible agency’s direction. Not every nonpublic business file is CUI, and a missing marking is not a safe basis for dismissing an information-handling question. Record unresolved questions and get clarification through the proper channel before choosing a handling approach.
Map information through a real task
Choose one work item and list its journey: receipt, download, editing, collaboration, submission, retention, and disposal. Include the people, devices, email services, shared repositories, backups, and external parties involved. Describe what happens in practice, including convenient shortcuts the team may have adopted.
This exercise is valuable even before every classification question is resolved because it identifies the places that need a decision. Keep a clear distinction between confirmed information types and assumptions. If you later learn that the work includes CUI, review the entire route rather than changing a label in one folder and assuming the rest of the environment is addressed.
Separate classification from tooling
A subscription tier, a vendor badge, or the presence of encryption does not decide what information the organization handles. Likewise, an isolated workspace is only useful if the actual workflow and connected services fit the intended boundary. Review the Level 1 and Level 2 comparison alongside the contract language.
When comparing tools, ask what data the service receives, what the customer must configure, what the provider can demonstrate, and how support and backups work. Those questions support a responsible decision; they do not replace the specific requirements that apply to the service and information.
Document the decision in a reusable form
Keep a short information-flow record: work activity, information type, source of the determination, authorized locations, recipients, and owner. Reference the contract or agency instruction without copying sensitive material into an unrestricted document. Review the record when the work or customer direction changes.
For example, a fictional manufacturer could receive public drawings for one effort and separately controlled technical information for another. Treating both jobs as identical because they use the same shop floor would miss the information question. Use the actual facts to guide scoping and ask for qualified assistance when the answer remains unclear.
Sources & further reading
- FAR 52.204-21: the basic safeguarding clause ↗
- National Archives: the CUI Registry ↗
- 32 CFR 170.19: assessment scoping ↗
Published October 24, 2026. Government and company references were checked while preparing this page. General information and practical workflow suggestions; confirm the requirements and services that apply to your organization.
