Short answer: Controlled Unclassified Information (CUI) is information the government creates or owns, or that a contractor creates or holds for the government, that a law, regulation, or government-wide policy says must be protected, but that isn’t classified. For defense contractors, CUI often means technical drawings, specifications, and export-controlled data. If you handle CUI on your systems, DFARS 252.204-7012 requires you to protect it with the 110 security requirements of NIST SP 800-171, and CMMC Level 2 applies.
Where does the definition come from?
The CUI program was created by Executive Order 13556 to replace the patchwork of agency-specific labels (“For Official Use Only,” “Sensitive But Unclassified,” and others) with one government-wide system. The National Archives (NARA) is the program’s Executive Agent, and its Information Security Oversight Office (ISOO) runs it day to day.
The rules are in 32 CFR Part 2002. It defines CUI as information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to protect or control. Classified information is not CUI.
What does CUI look like for a defense contractor?
The official list of CUI categories lives in the CUI Registry, maintained by NARA. For a small manufacturer, engineering firm, or IT services company, the CUI you’re most likely to see includes:
| Type of information | Typical examples |
|---|---|
| Controlled technical information | Engineering drawings, technical data packages, specifications, test data for military items |
| Export-controlled information | Technical data controlled under ITAR or the Export Administration Regulations |
| Critical infrastructure and security information | Facility security plans, vulnerability details |
| Procurement and acquisition information | Certain source selection or contract information the government designates |
| Privacy information | Personnel records or other personal data handled for the government |
What matters is not the file type but the source and purpose. If the government gave it to you under a contract, or you created it to perform the contract, and it falls into a Registry category, treat it as CUI.
FCI vs. CUI: what’s the difference?
Federal Contract Information (FCI) is non-public information provided by or generated for the government under a contract, such as contract details, schedules, or internal project correspondence. Almost every contractor has FCI. CUI is a narrower, more sensitive subset that a law or policy specifically requires to be protected.
The distinction decides your CMMC level: FCI only means Level 1 (15 basic requirements); CUI means Level 2 (the 110 requirements of NIST SP 800-171). See CMMC Level 1 vs. Level 2 for a side-by-side comparison.
What’s the difference between CUI Basic and CUI Specified?
- CUI Basic is CUI where the underlying law or policy doesn’t set out specific handling rules. The standard controls in 32 CFR Part 2002 and the CUI Registry apply.
- CUI Specified is CUI where the underlying law or policy does set specific handling rules, such as limits on who can receive it. Those specific rules apply in addition to, or instead of, the standard controls.
For your systems, the practical point is the same: CUI Basic on a contractor’s systems is protected with NIST SP 800-171, and Specified categories may add extra handling or dissemination limits that you must follow.
How is CUI marked?
Under 32 CFR 2002.20:
- Banner marking. Documents containing CUI carry a banner at the top of each page. The banner must include the control marking, either “CUI” or “CONTROLLED”. CUI Specified documents must also list the Specified category markings in the banner.
- Designation indicator. Every document containing CUI must show who designated it. At a minimum, this names the designating agency, often on the first page.
- Portion markings (marking individual paragraphs) are permitted and encouraged, but not always used.
- Legacy markings such as “FOUO” are no longer valid CUI markings on their own. You may still receive older documents carrying them.
Watch out: markings aren’t always applied consistently. If information looks like it fits a CUI category but isn’t marked, ask your contracting officer or prime to confirm rather than assuming it’s not CUI.
What does protecting CUI require?
If your contract includes DFARS 252.204-7012 (see DFARS 252.204-7012 Explained), you must:
- Implement the 110 requirements of NIST SP 800-171 Rev. 2 on every system that processes, stores, or transmits CUI.
- Document how you meet them in a System Security Plan (SSP), with a plan of action for anything not yet met.
- Report cyber incidents affecting CUI to DoD within 72 hours.
- Flow the requirements down to subcontractors who will handle CUI.
- Assess and post your status in SPRS where your contract requires it (see What Is an SPRS Score?).
The rules also require protecting CUI at no less than a moderate confidentiality level, keeping it in controlled environments (or behind at least one physical barrier when outside one), and destroying it so it can’t be recovered.
How do you find all the CUI in your business?
Most small contractors underestimate where CUI ends up. A practical approach:
- Start with your contracts. List which ones include DFARS 252.204-7012 and what CUI they involve.
- Follow the data. Trace where drawings and technical data arrive (email, portals, file shares), where they’re stored, who edits them, and where they go next: CAD workstations, shop-floor machines, backups, and subcontractors.
- Draw the boundary. Everything that touches CUI is in scope for NIST SP 800-171. Many small businesses reduce cost by keeping CUI in a smaller, separate environment rather than securing the whole network.
That boundary decision drives most of the cost and effort of compliance, so it’s worth getting right first.
Frequently Asked Questions
Is all information from the Department of Defense CUI?
No. Much of what contractors receive is Federal Contract Information, which needs only basic safeguarding. Information is CUI only if it falls into a category in the CUI Registry and a law, regulation, or government-wide policy requires protecting it. Your contract and the markings on the information are the first places to check.
What happens if we receive CUI but our systems aren’t compliant?
If your contract includes DFARS 252.204-7012, you’re already obligated to protect that CUI with NIST SP 800-171. Misrepresenting your compliance, for example with an inaccurate SPRS score or affirmation, carries contractual and legal risk. Talk to your contracting officer or prime and start closing the gaps right away.
Can we store CUI in Microsoft 365 or another cloud service?
Yes, if the cloud service meets the security requirements of the FedRAMP Moderate baseline (or equivalent) and the incident-reporting requirements of DFARS 252.204-7012. Many standard commercial cloud plans don’t qualify, so check the specific offering before moving CUI into it.
Does the CMMC Phase II suspension change how we handle CUI?
No. The suspension paused the move to mandatory third-party CMMC certification. DFARS 252.204-7012 and the requirement to protect CUI with NIST SP 800-171 Rev. 2 remain in effect. See CMMC Phase II Is Suspended.
How USCIBER can help
USCIBER helps small contractors find where CUI lives, draw a sensible boundary, and meet NIST SP 800-171 without securing more than they need to. Our NIST 800-171 & DFARS compliance work and CMMC Readiness Review (from $7,500) start with exactly this scoping step. Engagements are led by security leadership holding CISSP, CISA, and CISM credentials.
Sources
- National Archives — About Controlled Unclassified Information (CUI) and the CUI Registry
- 32 CFR Part 2002 — definitions (§ 2002.4), safeguarding (§ 2002.14), and marking (§ 2002.20)
- acquisition.gov — DFARS 252.204-7012
- NIST — SP 800-171 Rev. 2
- DoD CIO — CMMC
This article is general information, not legal advice.