Controlled Unclassified Information (CUI)
Last reviewed · By Chad Griffith
Controlled Unclassified Information (CUI) is information requiring safeguarding or dissemination controls per laws, regulations, or government-wide policies — but not classified information. The CUI Program is administered by the National Archives and Records Administration (NARA) and codified at 32 CFR Part 2002. The CUI Registry at archives.gov/cui lists every approved CUI category along with applicable safeguarding and dissemination controls. CUI handlers in the defense industrial base must implement NIST SP 800-171 controls under DFARS 252.204-7012 and achieve CMMC Level 2 or 3 certification (depending on CUI sensitivity).
Frequently Asked Questions
What categories of CUI exist?
The CUI Registry lists 20+ categories spanning all federal agencies. Defense-relevant categories include: Critical Infrastructure (Critical Energy Infrastructure Information), Defense (Naval Nuclear Propulsion, Unclassified Controlled Nuclear Information), Export Control (ITAR information not classified), Privacy (PII, Personnel Records), Procurement and Acquisition (Source Selection), and Technical Data. The Registry is maintained at archives.gov/cui.
How is CUI marked?
CUI documents must be marked with: a banner marking at the top identifying 'CONTROLLED UNCLASSIFIED INFORMATION' or 'CUI'; category markings if applicable (e.g., 'CUI//SP-PRVCY' for Privacy CUI); and dissemination controls if applicable. The DoD provides specific marking guidance through its CUI Program implementation policies.
What is the difference between CUI and classified information?
Classified information (Confidential, Secret, Top Secret) requires security clearances, secure facilities, and is governed by Executive Orders. CUI is unclassified but still requires controlled handling per specific laws and regulations. CUI does not require security clearances and can be processed in non-classified environments meeting NIST 800-171 standards. The DoD has both classified networks (SIPR, JWICS) and CUI-enabled unclassified networks.
Who decides what is CUI?
The federal agency that originated the information determines its CUI status. The CUI Registry sets the framework, but agencies apply categorization. Contractors should not unilaterally classify information as CUI or non-CUI — when in doubt, request clarification from the contracting officer or agency CUI representative.
Authoritative sources
Related terms
FileFlo classifies and tracks compliance documents against rule packs that map directly to the regulators referenced above. Run a free CFR-cited audit →