What is CUI? Controlled unclassified information, explained
Published 2026-10-23, 11 min read
Controlled
A law, regulation or Government-wide policy requires or permits the Government to protect it or limit who sees it.
32 CFR 2002.4(h)
Unclassified
It is not classified under Executive Order 13526 or the Atomic Energy Act. CUI sits below classified, with rules of its own.
32 CFR 2002.1(b)
Information
In any form: a drawing, a model file, an email, a spreadsheet, even a conversation. The rule's idea of a document covers all of them.
32 CFR 2002.4(w)
CUI is government information that is not classified but that a rule says must be protected or shared only with the right people. In a small defense shop it usually arrives as a drawing or a spec with a distribution statement on it, and under the standard DoD clause, DFARS 252.204-7012, every system that holds it falls under NIST SP 800-171.
Where CUI comes from: five documents, one chain
Before CUI, every agency had its own stamps for sensitive but unclassified paper, and they did not agree with each other. The CUI program replaced that patchwork with one set of rules. Here is the chain that ends at your purchase order.
- 2010
Executive Order 13556
Creates one CUI program for the whole executive branch and makes the National Archives (NARA) its Executive Agent.
32 CFR 2002.4(ii), 2002.6(a)
- 2016
32 CFR Part 2002
The rule itself: how agencies designate, protect, mark, share, decontrol and destroy CUI. In force since 2016-11-14, run by NARA's Information Security Oversight Office.
81 FR 63324; 32 CFR 2002.1(a), 2002.6(b)
- Live
The CUI Registry
NARA's public list of every category, its marking and the law behind it. A category that is not on it cannot be CUI.
32 CFR 2002.10, 2002.12(b)
- 2020
DoDI 5200.48
How the Department of Defense runs CUI, including what it must tell a contractor in the contract.
DoDI 5200.48, March 6, 2020
- Your contract
DFARS 252.204-7012
Calls it covered defense information and puts NIST SP 800-171 on every system of yours that holds it.
DFARS 252.204-7012(a), (b)(2)
The rule is written for federal agencies, so why does it reach a 12-person shop? Its own scope answers that: it binds contractors through the contract. Two sentences carry the weight.
For a defense subcontractor, the agreement is DFARS 252.204-7012, the clause your prime passes down to you. It is also why this site exists: the clause turns a drawing on your server into a list of 110 security requirements. What that list is, and how CMMC checks it, is in what is NIST SP 800-171 and DFARS 252.204-7012 explained.
The CUI Registry: the only list that counts
CUI is not whatever feels sensitive. It is information that fits a category on the CUI Registry, the public list NARA keeps at archives.gov. Each category names the law or regulation behind it, its marking, and whether it is Basic or Specified. Agencies may use only those categories.
Read on the Registry on 2026-10-23 (page last reviewed 2025-03-06). The three groups a machine shop runs into are marked and open.
Critical Infrastructure11
Ammonium Nitrate, Chemical-terrorism Vulnerability Information, Critical Energy Infrastructure Information, Emergency Management, General Critical Infrastructure Information, Information Systems Vulnerability Information, Physical Security, Protected Critical Infrastructure Information, SAFETY Act Information, Toxic Substances, Water Assessments
Defense5
Controlled Technical Information, DoD Critical Infrastructure Security Information, Naval Nuclear Propulsion Information, Privileged Safety Information, Unclassified Controlled Nuclear Information - Defense
Export Control2
Export Controlled, Export Controlled Research
Financial14
Bank Secrecy, Budget, Comptroller General, Consumer Complaint Information, Confidential Consumer Complaint Information, Confidential Supervisory Information, Electronic Funds Transfer, Federal Housing Finance Non-Public Information, Financial Supervision Information, General Financial Information, International Financial Institutions, Mergers, Net Worth, Retirement
Immigration7
Asylee, Battered Spouse or Child, Permanent Resident Status, Status Adjustment, Temporary Protected Status, Victims of Human Trafficking, Visas
Intelligence8
Agriculture, Foreign Intelligence Surveillance Act, Foreign Intelligence Surveillance Act Business Records, General Intelligence, Geodetic Product Information, Intelligence Financial Records, Internal Data, Operations Security
International Agreements1
International Agreement Information
Law Enforcement18
Accident Investigation, Campaign Funds, Committed Person, Communications, Controlled Substances, Criminal History Records Information, DNA, General Law Enforcement, Informant, Investigation, Juvenile, Law Enforcement Financial Records, National Security Letter, Pen Register/Trap & Trace, Reward, Sex Crime Victim, Terrorist Screening, Whistleblower Identity
Legal12
Administrative Proceedings, Child Pornography, Child Victim/Witness, Collective Bargaining, Federal Grand Jury, Legal Privilege, Legislative Materials, Presentence Report, Prior Arrest, Protective Order, Victim, Witness Protection
Natural and Cultural Resources3
Archaeological Resources, Historic Properties, National Park System Resources
North Atlantic Treaty Organization (NATO)2
NATO Restricted, NATO Unclassified
Nuclear5
General Nuclear, Nuclear Recommendation Material, Nuclear Security-Related Information, Safeguards Information, Unclassified Controlled Nuclear Information - Energy
Patent3
Patent Applications, Inventions, Secrecy Orders
Privacy9
Contract Use, Death Records, General Privacy, Genetic Information, Health Information, Inspector General Protected, Military Personnel Records, Personnel Records, Student Records
Procurement and Acquisition3
General Procurement and Acquisition, Small Business Research and Technology, Source Selection
Proprietary Business Information6
Entity Registration Information, General Proprietary Business Information, Ocean Common Carrier and Marine Terminal Operator Agreements, Ocean Common Carrier Service Contracts, Proprietary Manufacturer, Proprietary Postal
Provisional9
Homeland Security Agreement Information, Homeland Security Enforcement Information, Information Systems Vulnerability Information - Homeland, International Agreement Information - Homeland, Operations Security Information, Personnel Security Information, Physical Security - Homeland, Privacy Information, Sensitive Personally Identifiable Information
Statistical4
Investment Survey, Pesticide Producer Survey, Statistical Information, US Census
Tax4
Federal Taxpayer Information, Tax Convention, Taxpayer Advocate Information, Written Determinations
Transportation2
Railroad Safety Analysis Records, Sensitive Security Information
Most of the list is about taxes, immigration cases and law enforcement, and a shop never sees it. Four categories are the ones that turn up in a defense machine shop, and the first one is the reason most shops hold CUI at all.
| Category | What the Registry says | Where it turns up |
|---|---|---|
| Controlled Technical InformationCTI, SpecifiedCUI//SP-CTI | Technical information with military or space application, marked with Distribution Statement B to F. Examples include engineering drawings, specifications, process sheets, technical reports and source code. | The drawing package and 3D model for the bracket you quote, and the process sheet your planner writes from it. |
| Export ControlledEXPT, Basic or Specified, by authorityCUI//SP-EXPT (Specified), CUI (Basic) | Information whose export could harm national security, including items in the export administration regulations and the ITAR munitions list. | ITAR technical data that arrives with a defense order. Most of the ITAR and EAR sections the Registry cites are Specified; 22 CFR 124.9(a)(5) is Basic. |
| DoD Critical Infrastructure Security InformationDCRIT, BasicCUI (or CUI//DCRIT) | Information that would reveal vulnerabilities in DoD critical infrastructure, including installation security and explosives safety information. | Site drawings or security details for work you do on a base: a gate, a fence line, a magazine door. |
| General Procurement and AcquisitionPROCURE, Specified (one Basic authority)CUI//SP-PROCURE | Information about acquiring goods and services, including cost or pricing data, contract information, indirect costs and direct labor rates. | The Government's own pricing and contract data in a package it marks. Your own quote in your own system is not CUI unless it came from or was made for the Government. |
Controlled Technical Information carries the weight. The Registry lists it under one authority, DFARS 252.204-7012, as CUI Specified, and says it is marked with one of the distribution statements B through F. So the quick test on any drawing is the distribution block, not the title block. Not sure about a single document? Run it through the is it CUI tool, or see how CUI and plain contract information differ in FCI vs CUI.
CUI Basic and CUI Specified
Every category is Basic, Specified, or both, depending on which law you read it under. The difference is not how secret the information is. It is whether the law behind it spells out its own handling rules.
| The question | CUI Basic | CUI Specified |
|---|---|---|
| What the law behind it says32 CFR 2002.4(j), (r); 2002.14(b) | Protect it, but sets no specific controls. | Protect it, and here is how. Where it is silent, Basic controls fill the gap. |
| The banner32 CFR 2002.20(b)(2) | CUI (the category marking is optional). | CUI plus the category, for example CUI//SP-CTI. Mandatory. |
| Who may receive it32 CFR 2002.16(b)(1)–(2) | Anyone with a lawful Government purpose, unless a dissemination control says otherwise. | Whoever the authority allows, which can be narrower. |
| On your systems32 CFR 2002.14(h)(2) | NIST SP 800-171. | NIST SP 800-171, unless the authority prescribes its own safeguarding. |
One category can be both. Export Controlled is Basic under some of the laws the Registry lists and Specified under others, and the rule allows exactly that. The marking on the document tells you which one the sender applied.
Who decides what is CUI
Shop owners often ask whether they get to decide. For what the Government sends you, no. That decision is made upstream and reaches you through paperwork:
- 01
The agency designates
The agency that owns the information decides it is CUI, picks the Registry category and marks it before handing it over. You do not get to undo that call.
32 CFR 2002.20(a)(4)
- 02
The contract identifies
DoD has to say in the contract which information is CUI, at award, and mark the documents it hands over.
DoDI 5200.48, 5.1.e and 5.3.a
- 03
The prime passes it down
Your prime decides whether what it sends you keeps its identity as covered defense information, and flows the clause to you when it does.
DFARS 252.204-7012(m)(1)
- 04
You handle it, and ask
You protect what arrives marked. If a marking looks wrong, or something looks like unmarked CUI, you tell the sender and keep protecting it at the marked level until they answer.
32 CFR 2002.50(a), (d)
Where your own judgment does come in is what you create. DoD's instruction puts the call on whoever makes a document: at the time of creation, decide whether it falls into a CUI category and mark it if so. And the clause does not stop at what DoD hands you. Its definition of covered defense information also takes in information you collect, develop, receive, use or store in support of the contract.
Handling CUI, verb by verb
The rule calls everything you do with CUI handling: marking, keeping, copying, moving, sharing and getting rid of it. Here is each verb as the rule states it, and what it looks like in a shop.
| Verb | What the rule says | On the shop floor |
|---|---|---|
| Keep32 CFR 2002.14(c) | Inside a controlled environment; outside it, under your direct control or behind at least one physical barrier. | The drawing at the machine is fine while the operator is there. At the end of the shift the traveler goes back in a locked drawer. |
| Copy and print32 CFR 2002.14(e) | Allowed for a lawful Government purpose, on equipment that does not keep the data, or is sanitized. | The office copier with a hard drive in it counts. So does the plotter in the engineering corner. |
| Ship32 CFR 2002.14(d), 2002.20(i) | Postal service or any commercial carrier, tracked where you can, addressed to a named person, nothing on the outside that says CUI. | Drawings packed with the parts go to a named receiver at the prime. No stamp on the box. |
| Share32 CFR 2002.16(a), (b)(4) | Only to people with a lawful Government purpose you reasonably expect are authorized. Only the designating agency adds limits such as NOFORN (no foreign dissemination). | Your plating or heat-treat vendor gets the drawing only if they need it for the job and the clause flows to them. |
| Destroy32 CFR 2002.14(f) | Unreadable, indecipherable and irrecoverable, by the NIST SP 800-53 / 800-88 methods or one approved for classified material. | Paper through a shredder that meets that bar, and old laptops, drives and controller memory sanitized first. |
| Decontrol32 CFR 2002.18(e), (j) | The designating agency's call. A decontrol is not a public release, and a leak is not a decontrol. | Shipping the last part does not end the CUI status of the drawing in your files. |
Marking is the seventh verb and the one with the most detail: the banner, the designation line, portion marks and what to do with a file you have to forward. It has its own guide, CUI marking requirements. For wiping a drive or a machine controller before it leaves the building, see NIST SP 800-88 media sanitization.
What holding CUI means for a small shop
On your own computers, the CUI rule points to one standard: agencies must use NIST SP 800-171 to protect CUI on systems they do not run. DFARS 252.204-7012 writes that into your contract, and CMMC is how DoD checks it. The CMMC program is changing, so this is what applies today:
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- The 110 security requirements of NIST SP 800-171 Rev 2 on every system that stores, processes or sends it. DFARS 252.204-7012(b)(2)
- A CMMC status of Level 2 (Self) at minimum, where your subcontract carries a CMMC requirement. 32 CFR 170.23(a)(2)
- Any cloud provider that stores, processes or sends it meets security requirements equivalent to the FedRAMP Moderate baseline. DFARS 252.204-7012(b)(2)(ii)(D)
- Cyber incidents that affect it reported to DoD within 72 hours of discovery. DFARS 252.204-7012(c)
- The clause passed on to any sub of yours whose work involves it, without alteration. DFARS 252.204-7012(m)(1)
- The people who handle it trained on the risks and on your procedures. NIST SP 800-171 3.2.1, 3.2.2
If your orders carry contract information but no CUI, the bar is the 15 basic safeguards of Level 1, a much smaller job; the CMMC level finder sorts it out. If CUI is there, here is the first week.
What a 5 to 50 person shop must do, level by level, is laid out in CMMC requirements for small business.
Questions shops ask about CUI
What does CUI stand for?
Controlled Unclassified Information: information the Government creates or owns, or that someone creates or holds for it, that a law, regulation or Government-wide policy says must be safeguarded or shared only under controls. It is defined in 32 CFR 2002.4(h).
Is CUI classified?
No. CUI is by definition information that is not classified under Executive Order 13526 or the Atomic Energy Act. It has its own rules, set by 32 CFR Part 2002 and, for a contractor, by the contract.
One caution: DoD contracts must require contractors to watch for CUI that, compiled together, could become classified, and to report it to a DoD representative. A full drawing set for a sensitive program is the kind of pile that question is about.
Is CUI the same as FOUO?
No. For Official Use Only was one of the old agency stamps the CUI program replaced. Under the rule, legacy markings are void and no longer show whether something is CUI. If information under an old FOUO stamp qualifies as CUI, it is still CUI, and anything you re-use from it is re-marked as CUI.
Is my own part design CUI?
Not if it is yours: information a company keeps in its own systems that never came from, and was not made for, a federal agency is outside the definition. It becomes a CUI question when it is developed for a DoD contract or mixed with a customer's CTI. The FCI vs CUI guide sorts a typical shop's paperwork.
How long does something stay CUI?
Until the designating agency decontrols it. Where it can, the agency puts a decontrol date or event on the document; after that date you may treat it as decontrolled without asking. Without one, the job ending, the part shipping or the contract closing does not end it.
Does CUI have to be encrypted?
When you use encryption to protect CUI, NIST SP 800-171 requirement 3.13.11 says it must be FIPS-validated cryptography. In the CMMC scoring, encryption that is used but not FIPS-validated costs 3 points, and none at all costs 5. The SPRS score calculator does the sum.