Skip to main content

🔔 Notifications Hub: See compliance updates in one place

Controlled Unclassified Information (CUI)

Controlled Unclassified Information is non-classified information that a law, regulation, or government-wide policy says must be safeguarded. Created by Executive Order 13556 in 2010 and standardized under 32 CFR Part 2002. CUI replaced the pre-2010 patchwork of agency-specific markings like 'For Official Use Only' and 'Sensitive But Unclassified.' For defense contractors, CUI is what triggers CMMC Level 2 and NIST SP 800-171.

CUI Basic vs CUI Specified

  • CUI Basic: Standard handling under 32 CFR Part 2002. Default when no other rule applies.
  • CUI Specified: A law or regulation adds extra handling requirements on top of Basic. Marked with the category code (e.g., CUI//SP-EXPT for export-controlled).

CUI Categories Defense Contractors See Most

  • Controlled Technical Information (CTI): military/space technical data with Distribution Statements B through F.
  • Export Controlled (EXPT): ITAR or EAR-controlled information.
  • Critical Infrastructure (CRIT): related to national critical infrastructure.
  • Proprietary Manufacturer (PROPIN): business-sensitive manufacturing information.
  • Privacy: PII and certain health-related categories.

CUI Marking Rules

The minimum marking is a 'CUI' banner at the top of each page. For CUI Specified, add the category code after 'CUI//'. For limited dissemination controls, add 'NOFORN' (no foreign) or similar after another slash. The NARA CUI Marking Handbook has the full specification, including how to mark emails, redacted documents, and documents with mixed CUI and non-CUI content.

CUI Handling Requirements

  • Storage: in systems with access controls, audit logging, and (for electronic CUI) FIPS-validated encryption at rest.
  • Transmission: FIPS-validated encryption in transit; physical shipments via trackable commercial carrier or USPS.
  • Destruction: follow NIST SP 800-88 media sanitization guidance for electronic media. Cross-cut shred or burn paper.
  • Training: everyone with CUI access completes CUI training appropriate to their role.

CUI vs FCI

FCI is the broader bucket of non-public contract information. CUI is a specific subset with explicit safeguarding requirements. FCI-only work means CMMC Level 1. CUI work means CMMC Level 2. The CUI Registry at archives.gov/cui is the authoritative list.