What Is Controlled Unclassified Information (CUI)?
One engineer forwards a marked-up drawing to a personal Gmail account. One quality lead saves export-controlled data to an unencrypted shared drive. Either mistake can trigger a reportable incident, or worse, a terminated contract.
Controlled Unclassified Information (CUI) is unclassified information that still requires safeguarding or dissemination controls under a specific law, regulation, or government-wide policy.
It's not classified. It's not public, either. It sits in a middle zone that trips up defense contractors, aerospace suppliers, and government vendors who assume "unclassified" means "unrestricted."
Primes are already asking suppliers to show a CMMC pathway before awarding new work. Getting CUI identification wrong doesn't just risk an audit finding. It risks the contract itself.
This article covers the legal definition, how CUI Basic differs from CUI Specified, Registry categories, real examples, handling rules across the information lifecycle, and who's responsible for what.
Key Takeaways
- CUI is unclassified, but it isn't ordinary unrestricted business information.
- A qualifying legal, regulatory, or policy basis determines CUI status, not sensitivity alone.
- CUI Basic uses standardized controls; CUI Specified adds authority-specific requirements.
- Contracts, markings, and the NARA CUI Registry together determine handling obligations.
- Everyone who touches CUI has safeguarding duties, and contractors must meet contract-specific requirements.
What Is CUI? Definition and Legal Foundation
The official definition comes from 32 CFR 2002.4(h). CUI is information the government creates or possesses, or that a contractor creates or possesses on the government's behalf.
A law, regulation, or government-wide policy must require or permit an agency to handle that information with safeguarding or dissemination controls, per eCFR's CUI definition.
Three elements must be present for information to qualify as CUI:
- Unclassified: CUI is explicitly not classified information; the two programs run on separate authorities.
- Government connection: the information must be created, possessed, or generated for the government.
- Legal authority: a specific law, regulation, or policy must authorize controls. Internal sensitivity labels don't qualify on their own.
CUI is a handling designation, not a clearance level. It doesn't require a security clearance to access, and it isn't interchangeable with classification markings like Secret or Top Secret.
Executive Order 13556, signed in November 2010, created the uniform CUI program and named the National Archives and Records Administration (NARA) as Executive Agent. DoD implements CUI through DoDI 5200.48 (effective March 2020). Contractor safeguarding and reporting obligations flow through DFARS 252.204-7012.
How CUI Status Gets Determined
Contractors don't get to decide what counts as CUI. The designating agency does. DoD's own instruction is explicit: whenever DoD provides information to a contractor, it must identify any CUI through the contracting vehicle and mark it accordingly.
To figure out whether something in your hands is CUI, check:
- The contract, statement of work, and any attachments like a DD Form 254
- Distribution statements already applied to the document
- Markings supplied by the government on received material
- The NARA CUI Registry category that matches the content
One catch: distribution statements and CUI markings aren't the same thing. A document can carry a distribution statement without being CUI, and missing a marking doesn't exempt you from applicable handling rules if the content qualifies.
CUI Categories, Examples, and What Is Not CUI
CUI splits into two subsets, and the difference matters for how you handle each one.
| Factor | CUI Basic | CUI Specified |
|---|---|---|
| Source of controls | Standard government-wide controls | Additional controls from the specific authority |
| Markings | Generic CUI banner | May require a category-specific banner, such as CUI//SP-CTI |
| Dissemination limits | Standard limited dissemination controls | Authority may impose stricter or different limits |
| What to check | CUI Registry baseline | The underlying law or regulation itself |
Specified controls aren't automatically "more sensitive." They're simply different, dictated by whatever law or regulation governs that category.
Registry Categories Relevant to Defense Contractors
The NARA CUI Registry organizes dozens of categories under broader groupings. Categories most relevant to aerospace and defense suppliers include:
- Controlled Technical Information (CTI): engineering data, drawings, specifications, process sheets, manuals, technical reports
- Export Control: items, technology, or software whose export could affect U.S. national security
- Procurement and Acquisition: source selection information, small business research data
- Privacy: personnel records, health information
- Critical Infrastructure: vulnerability information, protected infrastructure data
This isn't a complete list. Always confirm against the current Registry rather than assuming a category applies by default.
Common Examples and What Isn't CUI
Common CUI artifacts for defense suppliers include:
- Engineering drawings, technical data packages, and bills of materials
- Test reports, manufacturing instructions, and procurement data
- Export-controlled technical information
It can live in paper, CAD files, emails, spreadsheets, photographs, removable media, and verbal discussions.
Related terms often get confused with CUI:
- Federal Contract Information (FCI) is a separate FAR 52.204-21 baseline, not CUI itself.
- Covered Defense Information (CDI) is a DFARS contract term tied to CUI categories.
- ITAR/EAR-controlled data overlaps with the Export Control CUI category but isn't automatically identical to it.
Not CUI by itself:
- Ordinary public information
- Generic commercial data with no government nexus
- Anything labeled "sensitive" only by internal company preference
None of that qualifies without a government connection and a legal authority behind it. When you're unsure, ask the contracting officer, export-control counsel, or a qualified compliance professional rather than removing controls on your own judgment.
CUI Handling Rules Across the Information Lifecycle
Handling requirements depend on the category, the governing authority, and whether you're dealing with CUI Basic or CUI Specified. The lifecycle itself follows a consistent shape: identify, mark, control access, store, transmit, retain, and eventually destroy or decontrol.
Marking and Access
NARA's marking handbook requires a CUI or CONTROLLED banner at the top of each page, applied consistently throughout a document. DoD also requires a designation indicator identifying the originating agency, component, and any limited dissemination controls like NOFORN or FEDCON.
A CUI banner, a DoD distribution statement, and an export-control warning serve three different purposes. One doesn't replace the other two; all three can appear on the same document.
Access rules under 32 CFR 2002.16 require:
- A lawful government purpose for each disclosure
- Compliance with the governing authority's restrictions
- Confirmation that the recipient's system is approved to receive CUI
Storage, Transmission, and Media
Physical and system protections include:
- Controlled environments that prevent unauthorized viewing or overhearing
- At least one physical barrier when CUI isn't under direct control
- Compliant transmission methods, including properly marked packages for physical mail
- System-level protections aligned to NIST SP 800-171 control families, such as access control, media protection, and system and communications protection
These controls come from the applicable contract clause, not generic cybersecurity best practice. Check what your specific DFARS clause requires before assuming a given control is optional.
Retention, Destruction, and Decontrol
Retain CUI according to your contract and records schedule. When destruction is appropriate, the method has to make the information unreadable, indecipherable, and irrecoverable, not just deleted from a visible folder.
Destruction and decontrol are different actions:
- Destruction disposes of the information entirely.
- Decontrol removes the CUI handling requirement while the information still exists.
Contractors generally can't decontrol government information on their own authority. That sits with the designating agency, and an unauthorized disclosure never counts as decontrol. The information stays controlled even after a leak.
When handling controls fail or a breach is suspected, response speed matters as much as prevention.
Responding to a Suspected Incident
- Stop further disclosure immediately to limit exposure
- Notify internal security or compliance contacts so the response can be coordinated
- Preserve evidence, including system images where relevant
- Determine external reporting obligations under your contract
- Follow contract-specific procedures for containment and recovery
Under DFARS 252.204-7012, covered contractors must rapidly report applicable cyber incidents within 72 hours of discovery, according to Acquisition.gov's DFARS clause. Evidence preservation runs on a separate clock, at least 90 days from when the report is submitted. These are distinct deadlines, and not every CUI-handling mistake triggers the same reporting requirement.
Who Is Responsible for CUI and How It Connects to Compliance Frameworks
CUI responsibility isn't a single job. It's distributed across several roles:
- Designating agency: establishes the category, applies initial markings, authorizes decontrol
- Contractor/authorized holder: handles CUI per contract and governing requirements, flows obligations down to subcontractors
- System owner: maintains approved systems and technical controls
- Individual employee: recognizes CUI, follows markings, uses approved systems, reports incidents, completes training
- Subcontractor: inherits flow-down obligations when receiving or processing CUI
CUI connects to a web of overlapping frameworks, and not every CUI holder carries identical obligations:
- FAR 52.204-21 sets the baseline for Federal Contract Information, separate from CUI
- DFARS clauses (7012, 7019, 7020) layer on safeguarding, assessment, and reporting duties
- NIST SP 800-171 defines the technical control families contractors implement to protect CUI on nonfederal systems
- CMMC verifies that implementation through self-assessment or third-party assessment
- ITAR/EAR adds export-control obligations on top of CUI handling where applicable
CMMC's rollout has changed recently. As of the July 2026 Phase II suspension, the expanded rollout is paused. Procurement documents can designate self-assessments instead of third-party Level 2 or Level 3 assessments, according to DoD's suspension memo. That changes assessment logistics. It does not remove the underlying CUI safeguarding requirement.
That pace of change is where training often falls behind. QMS Learning's CMMC & NIST 800-171 course includes a standing instruction to verify current contract and regulatory requirements separately, because frameworks like this shift faster than most internal training libraries get updated.
Where CUI lives in your organization also determines your system boundary, your assessment scope, and which suppliers need their own controls. Get the inventory wrong, and the rest of the compliance program is built on a shaky foundation.
Practical CUI Readiness Checklist for Defense and Aerospace Teams
Start with an inventory, not a policy document. You can't protect what you haven't mapped.
- Map CUI entry points: where it enters your organization, who creates or receives it, where it's stored, how it moves, which suppliers touch it, and when it gets destroyed or returned
- Build a decision record: linking each data type to its contract source, Registry category, authorizing authority, required marking, permitted recipients, and disposition method
- Train by role: engineers, quality staff, purchasing, production, IT administrators, managers, and subcontractors each need different depth
- Document evidence: training completion, access reviews, marking checks, supplier acknowledgments, incident records, and media destruction logs
- Review periodically: after contract changes, engineering changes, supplier changes, system migrations, or regulatory updates
One engineer emailing a CAD file to personal Gmail. One marked-up drawing sitting on an unencrypted shared drive. Either scenario is enough to trigger a reportable incident or jeopardize a contract, which is why role-specific capability matters more than a one-time training session.
QMS Learning's Aerospace & Defense Audit-Ready pathway covers AS9100D, ITAR, and counterfeit parts avoidance. Its Document Management System compiles controlled documents, revision history, and acknowledgments into a single audit-evidence package.
Neither replaces legal advice, technical security implementation, or agency approval. Both give teams a documented, repeatable way to show an auditor how CUI moves through their organization and who's accountable at each step.
Conclusion: Treat CUI as a Lifecycle and Capability Requirement
Correctly identifying CUI is the starting point for everything downstream: markings, access control, system scoping, supplier flow-down, training, incident response, and eventual destruction. Skip that first step, and every control built on top of it is guesswork.
Build the rest as an operating capability. Start by reviewing your contracts and the CUI Registry, inventory where CUI actually flows through your operation, and assign clear ownership. Get qualified guidance for anything ambiguous.
The identification work is tedious. A finding, a breach, or a terminated contract costs far more.
Frequently Asked Questions
What is controlled unclassified information (CUI)?
CUI is unclassified, government-related information that requires safeguarding or dissemination controls under a law, regulation, or government-wide policy. It's not classified information and doesn't require a security clearance to access.
What does CUI stand for?
CUI stands for Controlled Unclassified Information. The word "controlled" matters because it signals handling restrictions still apply, even though the information isn't classified.
What are the two types of CUI?
CUI Basic and CUI Specified. CUI Basic follows standard government-wide controls, while CUI Specified follows additional or different controls set by the specific authorizing law or regulation.
What is not considered CUI?
Information isn't CUI just because it's sensitive, proprietary, or related to government work. It needs a qualifying legal, regulatory, or policy basis; internal labeling alone doesn't count.
How should CUI be handled?
CUI handling covers identification, required markings, authorized access, approved storage and transmission, controlled sharing, retention, destruction, and incident reporting under applicable contract and regulatory requirements.
Who is responsible for protecting CUI?
The designating government agency establishes the category and controls. Contractors, employees, subcontractors, and system owners are each responsible for protecting CUI within their specific contractual and operational roles.