FCI, CUI or unresolved: build an information decision trail

“It came from the government” is an incomplete classification rule. So is “the file has no banner.” A small supplier needs a repeatable way to ask what a document contains, why it is being handled, and which requirements apply. The objective is an information decision trail that can be explained to a colleague without forwarding the sensitive file itself.

Start with a description rather than a copy. “Drawing package for contract workstream B, received through the customer portal” is enough for an initial management log. Do not paste real controlled information into this site’s tool, a public search engine or an unapproved AI service. The record should point authorized reviewers to the controlled source.

Use definitions without inventing a designation

FAR 52.204-21 defines FCI around information not intended for public release that is provided by or generated for the government under a contract to develop or deliver a product or service. It excludes public government information and simple transactional information needed for payment. A public solicitation and a nonpublic performance report therefore deserve different questions.

The National Archives CUI program explains the framework for information requiring safeguarding or dissemination controls under law, regulation or governmentwide policy. Its category registry helps locate the relevant authority. Finding a category name does not by itself prove that a particular contractor file falls in it. Record the government identification, applicable terms and any clarification you receive.

Work through a fictional inbox

Northline Calibration, a fictional company, receives three messages during contract startup. A public agency fact sheet arrives first. An internal delivery roster follows. A technical attachment arrives with conflicting instructions: the cover email says “routine,” but the referenced contract identifies controlled technical information. Northline should not make a final classification from the email subject alone.

The third entry is “unresolved,” not “uncontrolled.” Northline follows its authorized interim handling process and asks the customer’s designated contact for clarification. It records who may decide, what question was asked and when the answer is needed. A proposal writer or sales employee should not quietly remove the uncertainty by changing a label.

Follow the information, not just the folder

A classification discussion is incomplete if it ends at the original document. Ask whether people copy excerpts into email, work instructions, tickets, meeting notes or printed packets. Examine exports and backups, including the workflow used by outside support. Derived content may need review; simply changing a file format does not establish a different handling requirement.

Use a small sample of normal work to reveal the routes. Ask one employee to describe receiving a job, performing it, answering a customer question and archiving the result. Record system names and owners, without exposing the contents in a public worksheet. Compare that route with the proposed assessment boundary under 32 CFR 170.19.

A five-field decision that survives a handoff

1. Description: what kind of information is involved, without copying it.
2. Basis: the contract location, marking, authority or written clarification.
3. Handling: the authorized workspace and transfer route.
4. Uncertainty: the exact unresolved question and interim instruction.
5. Accountability: the reviewer, decision date and trigger for reconsideration.

Make review triggers concrete. A new attachment type, changed customer instruction or new subcontractor is a reason to revisit the entry. A well-maintained trail helps management notice when the information has changed before assuming the old system decision still fits. It does not replace the customer’s designation authority or a formal assessment.