- The full list of active contracts and purchase orders, with access to the actual clause text — not summaries
- Samples of documents actually received under each contract, so markings can be recorded as seen
- The system boundary worksheet (ATL-001), if one exists, to check where implicated information lives
ATL-002QUESTIONNAIREEDITORIAL REVIEW COMPLETE
CUI & FCI Applicability Questionnaire
A contract-by-contract questionnaire for answering the question everything else depends on: does this organization handle federal contract information or controlled unclassified information at all — and under which contracts, based on which clauses and markings, decided by whom.
Using this artifact
Purpose, inputs, and completion
Purpose. Whether an organization handles FCI or CUI — and under which contracts — is the decision every safeguard, boundary, and plan downstream depends on. Most small contractors have answered it by assumption; this questionnaire replaces the assumption with a per-contract record naming the clauses read, the markings seen, and the person who decided. Its output is the entry condition for the boundary worksheet and everything that follows.
When to use it. Complete it contract by contract, with the contract's administrator and at least one person who performs the work in the room, reading the actual clause text together. Where a clause or marking is ambiguous, write down exactly what was seen, mark the disposition UNKNOWN, and use the escalation path — a wrong guess recorded confidently is worse than an open question recorded honestly. Rerun the affected rows at every award and modification.
- Work contract by contract with the person who administers it and the person who does the work — the two rarely have the same picture.
- Read the clause list of every contract; record clauses actually present, not clauses assumed from the customer's name.
- Record markings as actually seen on received documents — by category and marking, never by copying marked content into this questionnaire.
- Assign each contract a disposition (FCI / CUI / neither / UNKNOWN) and route every UNKNOWN through the escalation path rather than guessing.
Keeping it honest
Evidence, validation, and failure modes
- A dated, per-contract applicability record naming the clauses and markings behind each disposition
- An escalation log showing that uncertain cases were raised in writing rather than resolved by assumption
- A findings summary that seeds the boundary worksheet and the rest of the governance library
- Pick one contract dispositioned 'neither' and re-read its clause list end to end; confirm FAR 52.204-21 and DFARS 252.204-7012 are genuinely absent, not just unindexed.
- Take one recently received deliverable under a CUI-dispositioned contract and ask the person who filed it where it lives; the answer must be a location the boundary worksheet authorizes.
What looks done but is not
- Dispositions assigned from contract titles or customer names instead of clause text — the flowdown hides in a purchase-order attachment nobody opened.
- Markings treated as the only signal, so unmarked information that a contract clearly identifies as controlled is dispositioned 'neither'.
- The questionnaire is completed once at award and never revisited at modification, so a scope change arrives with no applicability decision behind it.
Mapped relationships
Practices and requirements this artifact relates to
Brilliant at the Basics practices
NIST SP 800-171 Rev. 2
NIST SP 800-171 Rev. 3
Relationships are mapped support, not equivalence: completing this artifact documents work relevant to these requirements and does not by itself address any of them. Retention: Retain the completed questionnaire for the life of each contract it covers plus the retention period the contract itself names; the applicability decision is the first record a reviewer asks for.
Full document
Preview — exactly what prints
QUESTIONNAIRE · GOVERNANCE & PROGRAM MANAGEMENTv1.0 · REVIEWED 2026-08-06
CUI & FCI Applicability Questionnaire
Brilliant at the Basics Resource Center · brilliantatthebasics.us · published by inDirectIT, Inc.
Independent educational material. Not affiliated with, sponsored by, approved by, or endorsed by the U.S. Department of War. Does not establish compliance, certification, or contractual standing.
Purpose
Whether an organization handles FCI or CUI — and under which contracts — is the decision every safeguard, boundary, and plan downstream depends on. Most small contractors have answered it by assumption; this questionnaire replaces the assumption with a per-contract record naming the clauses read, the markings seen, and the person who decided. Its output is the entry condition for the boundary worksheet and everything that follows.
How to use it
Complete it contract by contract, with the contract's administrator and at least one person who performs the work in the room, reading the actual clause text together. Where a clause or marking is ambiguous, write down exactly what was seen, mark the disposition UNKNOWN, and use the escalation path — a wrong guess recorded confidently is worse than an open question recorded honestly. Rerun the affected rows at every award and modification.
How to use this questionnaire
Ten minutes of reading clause text per contract, done once, prevents months of protecting the wrong things — or failing to protect the right ones.
Answer from documents, not memory: the contract's clause list, the purchase-order attachments, and documents actually received from the customer. Every disposition in the table below must be traceable to something a second person could read and reach the same conclusion from.
Describe markings — never copy marked content
Record information types and markings by category ('CUI-marked drawings', 'distribution statement D deliverables'), never by pasting marked content, drawing excerpts, or contract-sensitive details into this questionnaire. The completed questionnaire itself should be handleable as an ordinary business record.
Contract-by-contract applicability
One row per active contract or purchase order. The disposition column is the questionnaire's product; the other columns are the reasons a reviewer can check.
Rows beginning EXAMPLE: show the expected shape — replace them with your own.
| Contract / order | Clauses present | Information types handled | Markings actually seen | Disposition (FCI / CUI / neither / UNKNOWN) |
|---|---|---|---|---|
| EXAMPLE: PO 4501 (prime: Alderman Aero) | FAR 52.204-21; DFARS 252.204-7012, -7019, -7020 | Part drawings, process specs, delivery schedules | CUI // SP-CTI on drawings from prime portal | CUI |
| EXAMPLE: GSA order 7788 (office furniture) | None of the data-handling clauses | Commercial catalog items, invoices | None | Neither |
Indicators that CUI is present
None of these alone is a determination — but any of them means the contract cannot honestly be dispositioned 'neither' without escalation.
- DFARS 252.204-7012 appears in the contract or flows down from the prime
- Check purchase-order attachments and the prime's terms-and-conditions link, not just the front matter.
- Received documents carry CUI banner markings or a CUI designation indicator block
- Deliverables carry distribution statements other than A, or export-control warnings
- Export-controlled technical data has its own obligations on top of anything this questionnaire records.
- The statement of work references controlled technical information, covered defense information, or a security classification guide
- The customer transfers files through a controlled portal rather than ordinary email
- The work involves defense articles, military end items, or their components
When you are not sure: escalation path
An UNKNOWN disposition is an action item, not a resting state. Raise it in writing, log it here, and handle the information conservatively until answered.
Ask in this order: the prime's contracts point of contact (in writing, quoting the clause or marking in question); then the contracting officer for direct awards; then outside counsel or a registered consultant if the written answers conflict. Until resolved, handle the implicated information as if the more protective disposition applied.
Escalation log
| Contract | Question raised | Raised with (name / role) | Date raised | Answer received | Date resolved |
|---|---|---|---|---|---|
Findings summary
Written last. This is the paragraph the executive sponsor signs and the boundary worksheet starts from.
| Disposition | Contract count | Systems implicated (from the rows above) |
|---|---|---|
| EXAMPLE: CUI | 3 | Business cloud tenant; engineering workstations; backup service |
| FCI (no CUI) | ||
| Neither | ||
| UNKNOWN — escalation open |
Summary and next actions
| One-paragraph applicability summary | Next actions with owners and dates | Completed by / date |
|---|---|---|
Document control, version history, and approval
An artifact without an owner, a review date, and an approval trail is a snapshot, not a record. Complete this section before the document is used, and update it at every review.
| Field | Entry |
|---|---|
| Document owner (named person) | |
| Suggested owner role | Contracts or compliance lead |
| Approval authority | Executive sponsor |
| Review frequency | At every new contract award or modification, and at least annually across the full contract list |
| Next scheduled review | |
| Storage location of the completed document | |
| Retention | Retain the completed questionnaire for the life of each contract it covers plus the retention period the contract itself names; the applicability decision is the first record a reviewer asks for. |
Version history
| Version | Date | Author | Summary of change | Approved by |
|---|---|---|---|---|
Review and approval
| Reviewed by | Role | Date | Signature / initials |
|---|---|---|---|
Complete this offline — and mind what you write down
Fill this in inside your own environment, not on any public website or unapproved cloud tool. A completed copy may reveal your security posture: never include CUI, export-controlled data, credentials or keys, unremediated vulnerability details, network diagrams, or customer-sensitive information beyond what the artifact strictly needs, and store the completed document with the same care as the systems it describes.
What completing this artifact does and does not do
This is independent educational material. Completing it documents your work and produces records a reviewer can examine — it does not, by itself, implement a safeguard, satisfy any NIST SP 800-171 requirement, establish compliance with DFARS or CMMC, or replace your own analysis within your defined system boundary. Requirement references are mapped relationships, not equivalence claims. Tailor every section to your technical, operational, contractual, regulatory, and safety requirements.