Every piece of Controlled Unclassified Information belongs to a specific category defined in a federal registry, each tied to the law or policy that requires its protection, and each carrying its own marking and handling implications. For defense contractors, this is where CUI stops being an abstract label and becomes something you can actually identify: a specific engineering drawing, a particular personnel record, or a controlled data set with a name and a rule behind it.

CUI categories determine whether information carries standard safeguarding requirements or additional ones, what banner marking belongs on the document, and how confidently you can defend your classification decisions when they're questioned.

This section gives you the complete category picture: real examples of CUI across the categories defense contractors encounter most, the critical difference between CUI Basic and CUI Specified, how to navigate the ISOO and DoD CUI registries as authoritative references, where CUI ends and Federal Contract Information begins, and how ITAR-controlled technical data fits in.