CUI Categories and How to Tell Them Apart
There is no single list of “things that are CUI.” There is a registry, maintained by the National Archives, organised into groupings — Defense, Export Control, Critical Infrastructure, Proprietary Business Information, Privacy, and others — each containing named categories with their own authorities.
Two distinctions do most of the practical work. The first is CUI Basic versus CUI Specified. Basic follows the uniform handling standard in 32 CFR Part 2002. Specified carries extra handling controls written into the law or regulation that created the category, and those controls override the baseline. If you are handling Specified CUI and applying only the Basic standard, you have a gap.
The second is that most defense contractors, most of the time, are dealing with one category: Controlled Technical Information. Drawings, specifications, process sheets, software — the technical data package. If you can identify CTI reliably, you have solved the majority of your scoping problem.
CUI Basic vs CUI Specified
| Aspect compared | CUI Basic | CUI Specified |
|---|---|---|
| Handling standard | Uniform standard in 32 CFR 2002 | Baseline plus controls from the underlying authority |
| Banner marking | CUI | CUI//SP-<CATEGORY> |
| Portion marking | Optional unless agency policy requires it | Optional unless the authority or agency requires it |
| Where the extra rules live | Nowhere — the baseline is the rule | In the statute or regulation that created the category |
The groupings defense contractors actually meet
- Defense — the grouping that contains Controlled Technical Information. This is the one most in-scope work sits in.
- Export Control — overlaps with ITAR and EAR obligations. Note that the regimes are separate: not all ITAR data is CUI and not all CUI is export-controlled, but where they overlap the stricter rule governs.
- Proprietary Business Information — appears where the government holds a contractor’s own proprietary data.
- Privacy — personnel and personally identifiable information held under contract.
- Critical Infrastructure — relevant where work touches protected infrastructure information.
Controlled Technical Information in practice
CTI is technical data with military or space application. In a manufacturing setting that means the drawing on the machine operator’s screen, the process sheet beside it, the inspection plan, and the printed copy someone taped to the wall. All of it is in scope, which is why tracing where CUI comes to rest matters more than knowing the definition.
Distribution statements are a useful signal. Technical data marked with a distribution statement other than Distribution A is a strong indicator that you are holding CTI, and the marking usually arrives with the data rather than needing to be derived.
Reading a distribution statement
For technical data, the distribution statement is usually the fastest reliable signal that you are holding CTI. It is a letter code, A through F, applied by the controlling DoD office, and it travels with the drawing.
Distribution A means approved for public release. If a drawing genuinely carries Distribution A, it is not CUI on the basis of that statement. Anything from B through F carries a limitation — to US Government agencies, to contractors, to DoD components, and so on — and indicates controlled technical information.
Two cautions. A missing statement is not the same as Distribution A; unmarked technical data from a prime should be treated as in scope until the customer confirms otherwise. And a statement applies to the document it appears on, so a derivative model or report built from it inherits the control rather than escaping it.
Where categories overlap
Categories are not mutually exclusive, and the overlaps are where obligations multiply rather than merge.
CTI and Export Control. A great deal of defense technical data is both. The regimes are separate: ITAR has no certification scheme but carries criminal penalties, and its US-person access rule is stricter than anything in CMMC. Where they overlap, the stricter rule governs — which in practice means an ITAR-covered drawing constrains who may see it, not merely how it is stored.
CTI and Proprietary Business Information. A drawing can be both government-controlled and commercially sensitive to a supplier. The CUI obligation does not displace the commercial one.
Privacy and everything else. Personnel data held under contract can be CUI in its own right, and it tends to live in systems — HR platforms, payroll — that nobody thought to include when scoping for drawings.
How categories drive your scope
Identifying the category is not an academic exercise. It sets three things.
- Which systems are in scope — wherever that category of information is processed, stored or transmitted.
- Which handling rules apply — the baseline for Basic, the baseline plus the authority’s own controls for Specified.
- What your markings must say — a bare
CUIbanner for Basic, a category-bearing banner for Specified. See how to mark CUI.
What is not CUI
- Information the government has released publicly.
- Commercial confidentiality between two private companies with no federal authority behind it.
- Classified information — that is a separate regime entirely.
- A label a customer invented that maps to no Registry category. Raise it rather than ignoring it, since it may still create a contract obligation.
Once you know which categories you hold, the next question is marking them correctly — see how to mark CUI. And if you want the whole picture scored against the standard, that is what NIST SP 800-171 covers.
Frequently asked questions
What is the difference between CUI Basic and CUI Specified?
CUI Basic follows the uniform handling standard set out in 32 CFR Part 2002. CUI Specified carries additional handling controls written into the law or regulation that created the category, and those controls override the baseline where they conflict.
What is CTI?
Controlled Technical Information is a category in the Defense grouping covering technical data with military or space application — drawings, specifications, process sheets, software, and the wider technical data package. It is the category most defense contractors actually hold.
Where is the official list of CUI categories?
The National Archives maintains the CUI Registry, which lists every approved category and organisational grouping together with the statute or regulation that authorises it. A category that does not appear there is not CUI.
Does every CUI category require the same controls?
No. Basic categories share a common baseline. Specified categories add controls from their underlying authority. Applying the Basic standard to Specified CUI leaves a gap that a control checklist will not reveal, because the checklist looks complete.