What is CUI Basic?
CUI Basic is CUI where the authorizing law, regulation or government-wide policy does not set specific handling controls. It is handled under the uniform controls in 32 CFR Part 2002 (32 CFR 2002.4).
What is CUI Specified?
CUI Specified is CUI where the authorizing law, regulation or policy sets specific handling controls that differ from CUI Basic. It is marked "CUI//SP-[category]", for example CUI//SP-EXPT (32 CFR 2002.4, 32 CFR 2002.20).
Who can decontrol CUI?
The designating agency decides when CUI is decontrolled. Authorized holders may decontrol CUI only as the designating agency permits (32 CFR 2002.18). A contractor should not decontrol CUI on its own judgment.
What is the purpose of the ISOO CUI Registry?
The CUI Registry is NARA's online repository of CUI categories, markings and policy. It is where you check whether information is CUI and which category and marking apply (archives.gov/cui).
What DoD instruction implements the DoD CUI program?
DoD Instruction 5200.48, "Controlled Unclassified Information (CUI)", implements the DoD CUI program (DoDI 5200.48 on esd.whs.mil).
Who is responsible for protecting CUI and applying markings?
Everyone authorized to access CUI is responsible for protecting it. The person or agency that creates or designates the CUI applies the markings (32 CFR 2002.20; DoDI 5200.48).
Basic vs Specified at a glance
| CUI Basic | CUI Specified | |
|---|---|---|
| Handling rules | Uniform rules in 32 CFR Part 2002 | Extra or different rules from the authorizing law or policy |
| Banner marking | CUI | CUI//SP-[category] |
| Where to check | The CUI Registry | |
Related guides
See the CUI marking guide, how to draw a CUI boundary, and ITAR vs CUI.