What Is Controlled Unclassified Information?
CUI is information the government requires you to protect, but which was never classified. That combination is what makes it confusing. There is no clearance involved, no safe to lock it in, and nothing about the document announces itself as sensitive — yet mishandling it can cost you a contract.
The category exists because of Executive Order 13556, issued in 2010 to replace a sprawl of agency-specific labels like “For Official Use Only” and “Sensitive But Unclassified” with one federal standard. The rules live in 32 CFR Part 2002, and the approved categories live in the CUI Registry maintained by the National Archives. That last point matters more than it sounds: CUI is not a label you or your customer invents. If information does not map to a registry category, it is not CUI.
For a defense contractor, the practical question is narrower. CUI becomes your problem when DFARS 252.204-7012 appears in a contract, because that clause obliges you to safeguard it to NIST SP 800-171 Revision 2.
What CUI is, and what it is not
It helps to rule things out first. CUI is not classified information, and it is not simply anything a customer would rather you kept quiet. Commercial confidentiality between two private companies is a contract matter, not a CUI matter. Nor is public information that happens to sit on a government website.
What CUI is: unclassified information that a law, regulation, or government-wide policy requires be safeguarded or disseminated under controls. The authority has to exist independently. That is why the Registry is the arbiter — each category in it points at the statute or regulation that created it.
Where the rules come from
- Executive Order 13556 (2010) established the CUI Program and named the National Archives as its executive agent.
- 32 CFR Part 2002 is the implementing regulation. It sets the uniform handling standard that applies across the executive branch.
- The NARA CUI Registry lists every approved category and the authority behind it.
- DFARS 252.204-7012 is the contract clause that turns all of the above into an obligation with teeth for defense contractors, by requiring NIST SP 800-171 safeguarding and 72-hour incident reporting.
CUI Basic and CUI Specified
Every category is one or the other, and the difference changes what you have to do. Basic follows the uniform handling standard in 32 CFR 2002. Specified carries additional controls written into the law or regulation that created the category, and those controls override the baseline.
If you are handling Specified CUI and applying only the Basic standard, you have a gap — and it is a gap that does not show up in a control checklist, because the control set looks complete. The categories page covers which groupings defense contractors actually encounter and how to tell Basic from Specified.
How CUI relates to FCI
Most contractors handle Federal Contract Information. A much smaller number handle CUI. The distinction decides whether you owe 17 requirements or 110, so it is worth settling before you spend anything. We work through the test in detail on FCI vs CUI.
Marking
Marking is where CUI most often goes wrong in practice, because the rules look like classification rules and are not. The banner marking is mandatory; portion markings are optional for Basic. The designating agency decides, and derivative material carries the marking forward. How to mark CUI covers banners, email, media and decontrol.
Finding it in your own environment
CUI rarely arrives announcing itself. It comes in through email, customer portals, physical media and engineering file transfers, and then it spreads. The boundary you draw around it is the single largest cost driver in this whole process. Finding CUI in your environment walks through how to trace it.
What handling CUI obliges you to do
Once DFARS 252.204-7012 is in your contract, you owe adequate security on any system that processes, stores or transmits covered defense information — defined by reference to NIST SP 800-171 Revision 2 and its 110 requirements. You also owe a self-assessment, a score posted to SPRS under 252.204-7019 and 7020, and cyber incident reporting within 72 hours.
The July 2026 suspension of CMMC Phase 2 removed the third-party verification layer. It did not remove any of the above. See program status for what changed.
Frequently asked questions
Is CUI classified information?
No. CUI is unclassified by definition. It requires safeguarding under law, regulation or government-wide policy, but it carries no clearance requirement and is not marked with a classification level.
Can my customer decide something is CUI?
Only if it maps to a category in the NARA CUI Registry. The designating agency applies the marking, and it must rest on an underlying authority. A label a prime invents does not create CUI, though it may still create a contractual obligation you should read carefully.
Does the CMMC suspension change my CUI obligations?
No. The July 2026 suspension removed the third-party assessment layer. DFARS 252.204-7012, which obliges you to safeguard CUI to NIST SP 800-171 Revision 2, remains in force, as do the 252.204-7019 and 7020 self-assessment and SPRS reporting requirements.
What happens if CUI is spilled?
DFARS 252.204-7012 requires reporting a cyber incident affecting covered defense information to DoD within 72 hours of discovery. Spillage handling is also governed by your contract and by the designating agency, so the clause is the starting point rather than the whole answer.
What is the purpose of the CUI Registry?
The CUI Registry, maintained by the Information Security Oversight Office (ISOO) at the National Archives, is the official list of CUI categories, the laws and regulations behind each one, the limited dissemination controls, and marking guidance. Executive Order 13556 and 32 CFR Part 2002 make it the authoritative reference: if a category is not in the Registry, it is not CUI. DoD keeps its own aligned registry for defense-specific categories.
What is DoDI 5200.48?
DoD Instruction 5200.48, issued in March 2020, is the Department of Defense policy for CUI. It sets how DoD and its contractors identify, mark, safeguard, disseminate and decontrol CUI, replaces legacy markings such as FOUO, and is the policy that DFARS 252.204-7012 contract requirements point back to for defense information.
Who oversees the CUI program?
NARA is the CUI Executive Agent, and ISOO carries out that role: it issues policy, maintains the Registry and monitors agency compliance. Each agency, including DoD, runs its own CUI program inside that framework, and contractors take their obligations from the contract.