As a defense contractor, the contracts you're bidding or already working on likely involve handling Controlled Unclassified Information (CUI). But if you're not sure exactly what category that CUI falls into, you may not know what specific safeguards are required to protect it. That's exactly what the CUI Registry is for. 

This article explains what the ISOO and DoD CUI Registries are, why they each exist, and walks through the CUI categories you're most likely to encounter.

What is the ISOO CUI Registry?

The ISOO CUI Registry is the official, government-wide list of every category and subcategory of Controlled Unclassified Information, maintained by the National Archives' Information Security Oversight Office (ISOO). It's the authoritative source for determining whether a given type of information qualifies as CUI, and if so, which category it falls under and what safeguarding requirements apply.

What is the purpose of the ISOO CUI Registry?

The purpose of the ISOO CUI Registry is to give every federal agency, and every contractor working with those agencies, a single, standardized reference for identifying and handling CUI. 

Before the CUI Program existed, different agencies used inconsistent labels like "For Official Use Only" and "Sensitive But Unclassified," with no shared definitions or rules. Executive Order 13556 created the CUI Program specifically to address this.

The ISOO CUI Registry's purpose is to:

• Define every CUI category and subcategory in one place, tied to the specific law, regulation, or government-wide policy that requires its protection
• Specify whether each category is CUI Basic or CUI Specified, and what CUI markings it requires
• Give contractors and agencies a consistent way to apply the same safeguarding rules to the same type of information, regardless of which agency they're working with

For a defense contractor, this means you don't have to guess whether something is CUI or interpret a contract clause in isolation. You can check it against the registry directly and get a clear, authoritative answer.

CUI categories: The full index

The ISOO Registry organizes 126 CUI categories into 20 Organizational Index Groupings. Each grouping contains multiple CUI categories, and each category is tied to a specific legal authority.

For most defense contractors, Defense, Export Control, Privacy, Procurement and Acquisition, Proprietary Business Information, and Critical Infrastructure are the categories you'll encounter most often. 

Types of Controlled Unclassified Information

Within each category, the registry also specifies whether a given subcategory is CUI Basic or CUI Specified.

• CUI Basic follows the CUI Program's standard safeguarding and dissemination rules, which align with NIST SP 800-171. 
• CUI Specified carries additional requirements imposed by the specific law or policy tied to that subcategory, on top of the standard NIST 800-171 baseline.

The registry's per-category pages specify whether the CUI category qualifies as Basic or Specified, along with the exact banner marking required for each. 

The DoD CUI Registry

The ISOO Registry is the government-wide source, but if you're working under a DoD contract, the DoD CUI Registry at dodcui.mil is likely the resource you'll actually use day to day. Per DoD Instruction 5200.48, the DoD CUI Registry mirrors the national registry but adds DoD-specific context, aligning each category with relevant DoD policy, DFARS requirements, and CMMC.

Why the DoD registry is often more useful for contractors

The DoD registry groups its categories into 19 organizational indexes (eliminating the ISOO Registry’s “Provisional” category, a temporary holding category for information awaiting a final CUI determination). 

Within each index, the DoD registry lists every category and subcategory alongside its abbreviation, the same abbreviations used in CUI category markings. Each category also links to its own detail page covering the category description, and governing authorities. 

What makes the DoD CUI Registry useful is that in many cases, each detail page also includes concrete examples of what information falls under that category of CUI. This DoD-specific context is especially useful for contractors trying to make a real-world determination about their CUI categories and safeguarding requirements.

DoD's version also ties each CUI category directly to DFARS clauses and CMMC requirements, rather than the broader set of laws and policies the ISOO Registry has to account for across every federal agency. It connects CUI handling directly to certification requirements in a way the ISOO site doesn't.

When to reference each CUI Registry

The DoD registry doesn't always restate the Basic-or-Specified determination or the exact banner marking format the same way the ISOO pages do. For that specific detail, the ISOO Registry's per-category pages remain the more complete source. In practice, many contractors end up using both: the DoD registry to understand a category in context and confirm it applies to their contract, and the ISOO Registry to confirm the precise Basic/Specified status and banner marking before applying it to a document.

Using the registry to identify CUI in your organization

When you're trying to determine whether something in your environment is CUI, the registry is just one tool to check against. 

1. Identify the type of information in question (technical data, personnel records, contract documents, and so on).
2. Check the registry (ISOO or DoD, depending on your contract) for a matching category or subcategory.
3. Confirm whether that subcategory is Basic or Specified, and note the required banner marking.
4. Apply the corresponding safeguarding and dissemination requirements.

Running your information through this process consistently is what turns "this seems sensitive – do any official handling requirements apply?" into a defensible, documented CUI determination, which is exactly what you'll need when it's time for a CMMC assessment.