Is it CUI? Check one drawing, spec or email
A print lands in the shop inbox. Is it CUI, contract information, or public? Describe the one item, its source, its contract and its markings, and the tool answers with the rule behind every step and the CUI Registry category it falls in. Every rule was read on 2026-10-23.
The tool: Is it CUI? Check one drawing, spec or email
Is it CUI? decision tool, cuideck.com
Describe one item. The answer below updates as you go. Pre-filled with a print a prime emailed on a 7012 purchase order. Example only
So farTreat as CUI, Specified: CTIControlled Unclassified Information
Treat as CUI
Specified: CTI
Handle it on systems that meet NIST SP 800-171 under DFARS 252.204-7012. The Registry lists CTI as CUI Specified; DoD still protects it at the Basic level unless a law says otherwise.
Registry banner
CUI//SP-CTI
CUI Registry category
How the tool got there
- 1Where it came from: Our prime or a higher-tier sub. Given to you under a government contract. 32 CFR 2002.4(h)
- 2Distribution statement: Distribution Statement D. B to F is how CTI is marked: Controlled Technical Information. DoDI 5200.48, 3.7.c(1)
- 3Registry category: Controlled Technical Information. Listed as CUI Specified, banner CUI//SP-CTI. CUI Registry, CTI
Check before you file it
- CheckNo CUI banner. DoD's minimum is “CUI” in the banner and footer; the missing banner does not change the answer. DoDI 5200.48, 3.4.a
A subcontractor that will process, store, or transmit CUI needs a CMMC Status of Level 2 (Self) at minimum. 32 CFR 170.23(a)
Next
A decision aid, not a legal determination: the sender's marking and your contract decide. Rules read 2026-10-23.
What counts as controlled unclassified information
Two things make an item CUI: it came from the Government or was made for it, and a law, regulation or Government-wide policy says it must be controlled. The CUI Registry lists every such authority in 128 categories across 20 groupings (category list last reviewed 2025-03-06). A shop on a DoD subcontract meets a handful of them, and one far more than the rest: Controlled Technical Information, the drawings and data a part is made from.
Within a category, each authority is either Basic, where it sets no special handling, or Specified, where it does and the banner must name the category. The Registry lists CTI as Specified, banner CUI//SP-CTI. DoD's own instruction adds a wrinkle: during its phased rollout there is no required distinction between the two, and DoD protects all of it at the Basic level unless a law says otherwise (DoDI 5200.48, 3.4.g). For a contractor the handling is the same either way: the 110 requirements of NIST SP 800-171 under DFARS 252.204-7012. The longer story is in what is CUI.
Examples of CUI a machine shop meets
These are the Registry categories that reach a job shop, with the Registry's own description and where each one turns up on the floor. Filter by where you meet it, and send an example to the tool above to see its working.
Controlled Technical Information
CUI//SP-CTI
Specified
What the Registry says: Technical information with military or space application, marked with Distribution Statement B to F: engineering drawings, specifications, process sheets, technical reports, data sets, executable and source code.
In the shop: The bracket print and its STEP model, the process sheet your planner writes, the CNC program and the CMM report built from them.
Registry page, CTIreviewed 2025-05-08
Export Controlled
CUI//SP-EXPTCUI
Specified or Basic, by authority
What the Registry says: Information whose export could harm national security and nonproliferation aims, including items in the ITAR and its munitions list, the export administration regulations, and license applications.
In the shop: A technical data package for a munitions-list part, with its export warning. The ITAR authorities the Registry lists are Specified; 22 CFR 124.9(a)(5) is Basic.
Registry page, EXPTreviewed 2025-05-08
General Proprietary Business Information
CUICUI//SP-PROPIN
Basic or Specified, by authority
What the Registry says: A company's products, business or activities: financial information, trade secrets, product research and development, existing and future product designs and performance specifications.
In the shop: Another company's design or performance data that the Government passes to you under the contract and marks PROPIN.
Registry page, PROPINreviewed 2025-07-30
General Procurement and Acquisition
CUI//SP-PROCURE
Specified (one Basic authority)
What the Registry says: Information about acquiring goods and services, including cost or pricing data, contract information, indirect costs and direct labor rates.
In the shop: Pricing, cost and contract data the Government marks and shares with you. A schedule email from your prime is contract information, not this.
Registry page, PROCUREreviewed 2025-07-30
Source Selection
CUICUI//SP-SSEL
Basic or Specified, by authority
What the Registry says: Information an agency prepares to evaluate a bid or proposal, when it has not been made public (FAR 2.101, items 1 to 10).
In the shop: Evaluation details a contracting officer shares about a competition you bid on, before they are public.
Registry page, SSELreviewed 2025-07-30
Operations Security
CUICUI//OPSEC
Basic
What the Registry says: Critical information about the planning and execution of sensitive government activities, found through a formal vetting process; it almost always comes from an agency's official OPSEC program.
In the shop: Delivery dates, ship-to points or quantities that an agency's OPSEC program has flagged and marked. Not every schedule is this: the marking tells you.
Registry page, OPSECreviewed 2025-05-12
Small Business Research and Technology
CUICUI//SBIZ
Basic
What the Registry says: Certain Small Business Innovation Research and Small Business Technology Transfer program information in a government database (15 USC 638(k)).
In the shop: Your SBIR or STTR award data as the Government holds it, if your shop does SBIR work.
Registry page, SBIZreviewed 2025-07-30
DoD Critical Infrastructure Security Information
CUICUI//DCRIT
Basic
What the Registry says: Information that would reveal vulnerabilities in DoD critical infrastructure, including vulnerability assessments, explosives safety information and site-specific installation security information.
In the shop: Site drawings for work on a base: a gate, a fence line, a magazine door or its hardware.
Registry page, DCRITreviewed 2025-05-08
Physical Security
CUICUI//PHYS
Basic
What the Registry says: Information related to the protection of federal buildings, grounds or property.
In the shop: Door hardware schedules or camera layouts for a federal building you fabricate or install for.
Registry page, PHYSreviewed 2026-02-06
Information Systems Vulnerability Information
CUICUI//ISVI
Basic
What the Registry says: Information that, if not protected, could result in adverse effects to information systems.
In the shop: A government customer's findings on weaknesses in a system you install or maintain for them, such as a test cell's control network.
Registry page, ISVIreviewed 2025-05-07
General Privacy
CUICUI//SP-PRVCY
Basic (Specified under OMB M-17-12)
What the Registry says: Personal information, or personally identifiable information as OMB M-17-12 defines it.
In the shop: Names and details of government staff you receive under the contract, such as a badge or escort list for a job on a base.
Registry page, PRVCYreviewed 2026-07-20
Two that are not a category, and trip shops up
Most of what a shop holds is not on this list at all. Purchase orders, schedules and the emails about them are federal contract information; invoices are not even that. The FCI vs CUI paperwork sorter walks eight of them.
How to use the tool
- 1Pick one item: one drawing, one file, one email. A package gets one pass per document.
- 2Say who sent it, or that you made it, and find the clause list in the PO. 252.204-7012 is the one that matters.
- 3Read the markings at the top and bottom of each page and in the title block. Tick only what is there.
- 4Read the answer and its working. Each step names the rule; the link opens the text.
- 5When the answer is “ask”, copy the question in the “Send this in writing” box into an email to the prime or contracting officer, and keep the reply with the file.
One job, six documents
A CNC shop is machining a bracket for a prime. The PO carries DFARS 252.204-7012. Here is what the tool says about six documents in the job folder, and the rule that settles each.
| Document | Source | Answer | Settled by |
|---|---|---|---|
| The bracket print: Distribution D, no banner | Our prime or a higher-tier sub | Treat as CUISpecified: CTI | CUI Registry, CTI |
| Rev B of the print, emailed as a plain PDF with no marks | Our prime or a higher-tier sub | Ask the prime in writing | DFARS 252.204-7012(m)(1) |
| The CNC program written from it | We made it to perform a DoD contract | Treat as CUISpecified: CTI, if the source is CTI | DFARS 252.204-7012(a) |
| The FAI report, measured values for every dimension | We made it to perform a DoD contract | Treat as CUISpecified: CTI, if the source is CTI | DFARS 252.204-7012(a) |
| A heat-treat spec stamped FOUO years ago | Our prime or a higher-tier sub | Ask the prime in writing | DoDI 5200.48, 3.2.b |
| The prime's email moving the ship date | Our prime or a higher-tier sub | FCI, not CUI | FAR 52.204-21(a) |
Two of the six are questions, not answers, and that is the honest result: an unmarked print and a void stamp do not decide anything on their own. The fix is one email to the prime per document type, kept in the job folder. The first print gets a CTI answer without a banner, because Distribution Statements B to F are how CTI is marked, and everything the shop writes from it takes the same answer.
Where the rule says so
The tool leans on five sentences more than any others. Here they are as written, so you can quote them back to a prime who says “it isn't marked, so it isn't CUI”.
For how each marking should look on the page, banner, portion marks and the designation block, read CUI marking requirements.
What the answer changes
The answer decides which systems the item may live on, and through them the CMMC level a contract will name. If a subcontractor will process, store, or transmit CUI, a CMMC Status of Level 2 (Self) is the minimum; if it will only handle FCI, Level 1 (Self) is required (32 CFR 170.23(a)). The CMMC level finder takes it from there, and what binds today is in the box below.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
A CUI answer means every laptop, share and mailbox that holds the file is in scope for the 110 requirements: map them with the scoping worksheet and work them on the NIST SP 800-171 checklist. An FCI answer points to the 15 safeguards on the Level 1 checklist.
Questions shops ask about CUI
Is every drawing from a prime CUI?
No. A drawing is CUI when it is Controlled Technical Information, which is marked with Distribution Statement B to F, or when the sender designates it with a CUI banner. A Distribution A drawing is public. An unmarked drawing on a 7012 order is a question to send back, and you protect it as CUI while you wait.
Is a CAM file or CNC program CUI?
It is when it is built from a controlled drawing. DFARS 252.204-7012 counts computer software, executable and source code, as technical information, and a program carries the drawing's geometry and tolerances. Treat it like the print it came from and keep it on the same systems.
Our prime calls the drawing “proprietary”. Is that the same as CUI?
No. The markings listed in the CUI Registry are the only ones that designate CUI (32 CFR 2002.20(a)(1)). A proprietary legend is the prime's contract term. It can sit on a CUI drawing or on a drawing that is not CUI, so it answers nothing: ask which it is.
Is FOUO the same as CUI?
No. FOUO is a legacy marking, and legacy markings are void: they no longer show that information is protected or that it qualifies as CUI (32 CFR 2002.20(a)(2)). DoD legacy information does not automatically become CUI; its owner reviews it and re-marks it if it qualifies (DoDI 5200.48, 3.2.b). Until then, ask.
Is the part itself CUI?
The CUI rule is about information, so the tool asks about the drawing that defines the part. Hardware can still be controlled under export rules, and labels or packaging can carry controlled data. Ask the prime in writing how the parts are to be handled, and check the ITAR basics for defense articles.
How many CUI categories are there?
The CUI Registry lists 128 categories in 20 groupings. A machine shop on DoD work meets a few of them, CTI most of all. The full list, grouped, is in what is CUI.
Can we decide ourselves that something is not CUI?
No. The agency that designated it decides. If you think a marking is wrong, or that you received unmarked CUI, tell the sender (32 CFR 2002.50(a)), and keep protecting it at the level its markings show until the challenge is resolved (2002.50(d)).
Sorting a whole job folder rather than one file? The FCI vs CUI comparison has an eight-document sorter, and the level finder turns the answer into a CMMC level.