CUI basics

What Is Controlled Unclassified Information (CUI)?

Controlled Unclassified Information (CUI) is information the Government creates or possesses — or that an entity creates or possesses for or on behalf of the Government — that a law, regulation, or Government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls. That is the definition in 32 CFR 2002.4. CUI is not classified, but it still must be protected.

If your company works on defense contracts that touch CUI, you must protect it under DFARS 252.204-7012 and NIST SP 800-171 — and that is what drives CMMC Level 2.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 19, 2026

Check your CUI scope Free CMMC Quick Score

CUI vs classified vs FCI

Three categories of government-related information get confused constantly:

Classified — Confidential, Secret or Top Secret. Handled under entirely separate rules (facility clearances, SCIFs, cleared personnel). CUI explicitly excludes classified information.
CUI — unclassified, but a law, regulation or Government-wide policy requires safeguarding or dissemination controls. This is what CMMC Level 2 protects.
FCI (Federal Contract Information) — information provided by or generated for the Government under a contract, not intended for public release. Broader and less sensitive than CUI; it is what FAR 52.204-21 and CMMC Level 1 protect.

CUI Basic vs CUI Specified

CUI Basic is the default: protect it under the CUI rule's baseline controls. CUI Specified is CUI where the authorizing law, regulation or policy spells out specific handling requirements — the CUI Registry shows which categories are Specified. The full comparison is in CUI Basic vs CUI Specified.

Examples of CUI for defense contractors

The authoritative list of CUI categories is the CUI Registry maintained by the National Archives (NARA). Categories defense contractors commonly encounter include:

Controlled Technical Information — technical data with military or space application, such as engineering drawings, specifications and test data.
Export Controlled — information controlled under export control laws (ITAR/EAR). See ITAR vs CUI.

Whether a specific document is CUI depends on the contract and the marking guidance that flows with it — when in doubt, ask your contracting officer rather than guessing.

Marking CUI

CUI is marked with a banner — at minimum the letters "CUI" in the banner line at the top of the document — plus designation indicators where required. The practical rules are in our CUI marking guide, and the governing instruction is DoDI 5200.48.

Safeguarding and destroying CUI

When CUI must be destroyed, 32 CFR 2002.14 requires destroying it so it is "unreadable, indecipherable, and irrecoverable" using methods such as those in NIST SP 800-88, Guidelines for Media Sanitization. Simply deleting a file or putting a document in the recycling bin does not meet the standard.

Who must protect CUI, and under what

Any contractor or subcontractor whose systems store, process or transmit CUI for DoD must implement the 110 requirements of NIST SP 800-171 Rev. 2 under DFARS 252.204-7012. CMMC Level 2 is how DoD verifies that — see What is NIST SP 800-171? and DFARS 252.204-7012 explained.

CUI training

DoD provides mandatory CUI training for its workforce through the DoD CUI Program (dodcui.mil) and DCSA's Center for Development of Security Excellence (securityawareness.dcsa.mil/cui). Contractors typically assign equivalent internal training so staff can recognize, mark, handle and destroy CUI correctly — training records are evidence under NIST SP 800-171 family 3.2.

Frequently asked questions

What is CUI?

Controlled Unclassified Information: information the Government creates or possesses, or that an entity creates or possesses for the Government, that a law, regulation or Government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls (32 CFR 2002.4).

What are examples of CUI?

For defense contractors, common CUI Registry categories include Controlled Technical Information (engineering drawings, specifications, test data) and Export Controlled information (ITAR/EAR-controlled data). The full category list is the CUI Registry at archives.gov.

Is CUI classified?

No. CUI is unclassified by definition — the CUI rule explicitly excludes classified information. It still requires safeguarding and dissemination controls, but under the CUI framework (32 CFR Part 2002), not the classified system.

How must CUI be destroyed?

32 CFR 2002.14 requires destroying CUI so it is unreadable, indecipherable and irrecoverable, using methods such as those in NIST SP 800-88, Guidelines for Media Sanitization.

What law requires CUI protection for contractors?

For DoD contractors, DFARS 252.204-7012 requires adequate security — NIST SP 800-171 — on systems that store, process or transmit covered defense information (which includes CUI). The Government-wide CUI framework itself is 32 CFR Part 2002.