How-to: Identifying CUI, FCI and Sensitive Data - First Pass

In order to protect something, one must know what they are protecting. Whether the target is CUI (Controlled Unclassified Information), FCI (non-public Federal Contract Information), or sensitive commercial data, an early step is to identify the various types of data in the organization's "inventory."