What Is CUI (Controlled Unclassified Information)? A Plain-English Guide for Defense Contractors

CUI is the reason CMMC exists. If your organization handles Controlled Unclassified Information on behalf of the federal government, you're subject to NIST SP 800-171, DFARS 252.204-7012, and potentially CMMC Level 2 certification. Here's what CUI actually is, how to identify it, and what it requires from you.

The Official Definition

Under 32 CFR Part 2002 and Executive Order 13556, CUI is defined as information the federal government creates or possesses, or that an entity creates or possesses on behalf of the government, that a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls.

In plain English: CUI is sensitive government information that isn't classified but still needs to be protected. It's the middle ground between publicly available government information and classified national security information. Not classified, but still don't post it on Reddit.

The National Archives and Records Administration (NARA), the federal agency responsible for managing the CUI program, maintains the authoritative CUI Registry at archives.gov/cui, which lists every approved CUI category, the laws or regulations that require protection, and the handling requirements for each. Think of it as the government's official master list of what counts as sensitive.

CUI vs. Classified Information

CUI is frequently confused with classified information, they are fundamentally different:

• Classified information (Confidential, Secret, Top Secret) is designated under Executive Order 13526 and requires security clearances to access
• CUI does not require a security clearance but does require specific handling controls defined by the applicable CUI category
• You can receive and work with CUI without a clearance, which is exactly why so many small defense contractors are subject to CMMC requirements, including the 10-person machine shop making aerospace components that just discovered what CUI stands for

CUI vs. FCI: A Critical Distinction for CMMC

CMMC distinguishes between two types of sensitive federal information:

• Federal Contract Information (FCI), information provided by or generated for the government under a contract, not intended for public release. CMMC Level 1 (17 basic practices) applies.
• Controlled Unclassified Information (CUI), information that meets a specific CUI category definition and requires protection under law or regulation. CMMC Level 2 (110 practices from NIST SP 800-171) applies.

Every contractor who receives CUI also receives FCI, but not vice versa. If you're only receiving FCI, invoices, contract administrative information, scheduling data, you may only need CMMC Level 1. If you receive CUI, CMMC Level 2 obligations apply.

Common CUI Categories for Defense Contractors

There are over 20 CUI category groups in the NARA registry. These are the ones most commonly encountered by defense contractors:

How to Identify CUI in Your Organization

Identifying CUI is the critical first step before you can protect it. Here's a practical approach:

Step 1: Review Your Contracts

Your contracts are the primary source of CUI identification. Look for DFARS 252.204-7012 (which references CUI), DD Form 1423 (Contract Data Requirements List), or any contract language specifying data handling requirements or referencing specific CUI categories. If your contract includes these clauses, you are handling CUI.

Step 2: Inventory Your Data Flows

Map where government-provided data goes in your organization. Which systems store it? Who has access? What gets emailed, shared, or transferred to subcontractors? Your System Security Plan (SSP) must document this, it's called the system boundary and is one of the first things a CMMC assessor reviews.

Step 3: Apply the CUI Registry

For any information you're uncertain about, look up the relevant CUI category at archives.gov/cui. Each category entry lists the authorizing law or regulation, the required handling protections, and whether it's basic CUI or CUI-Specified (which has additional controls beyond the baseline).

Step 4: Ask Your Contracting Officer

When in doubt, ask. Your Contracting Officer or Contracting Officer's Representative (COR) can confirm which information in your contract is designated CUI and what marking requirements apply. Getting written confirmation protects you.

CUI Marking Requirements

Under 32 CFR Part 2002.20, agencies are required to mark CUI when they create it or when they determine existing information meets CUI criteria. Documents you create that contain CUI must be marked with the CUI designation.

The standard CUI marking is: CUI as a header/footer, with the applicable category designation if required (e.g., CUI//CTI for Controlled Technical Information). Export-controlled CUI must include the export control designation.

In practice, much government-furnished information arrives unmarked or improperly marked. Somehow, the government's own documents don't always comply with the government's own labeling rules. This does not remove your obligation to protect it, if information meets a CUI category definition, it must be handled as CUI regardless of whether the government marked it correctly.

What Handling CUI Requires

Once you've identified CUI in your environment, your obligations under NIST SP 800-171 and DFARS 252.204-7012 include:

• Implement all 110 NIST SP 800-171 security requirements across systems that process, store, or transmit CUI
• Submit an SPRS score to the DoD Supplier Performance Risk System reflecting your current compliance posture
• Maintain a System Security Plan (SSP) documenting how you meet each requirement
• Maintain a POA&M for any requirements not yet fully implemented
• Report cyber incidents affecting CUI systems to DoD within 72 hours
• Flow requirements to subcontractors who receive CUI under your contract
• Achieve CMMC Level 2 certification if your contract specifically requires it