What Is CUI (Controlled Unclassified Information)?

CUI is the government-wide label for sensitive but unclassified information that laws, regulations, or government-wide policies require to be protected. The category system is managed by the National Archives, and the CUI Registry lists the approved categories, which include export-controlled technical data, controlled technical information, procurement-sensitive information, and privacy data. CUI is not a classification level. It sits below Confidential, Secret, and Top Secret, but mishandling it still carries contractual and legal consequences.

For defense contractors, CUI is the trigger for the heaviest cybersecurity obligations in the supply chain. DFARS 252.204-7012 requires any contractor whose systems process, store, or transmit covered defense information, a category of CUI, to implement NIST SP 800-171 and report cyber incidents to the DoD. Under CMMC, handling CUI places a contractor at Level 2, which means all 110 NIST SP 800-171 requirements apply.

The most common practical mistake is not knowing where CUI actually lives. Drawings, specifications, and deliverables migrate into email, file shares, and personal devices, and every system they touch becomes in scope. Scoping a defined CUI enclave is usually the difference between a manageable compliance boundary and an enterprise-wide one. See CMMC Level 2 requirements for small business for how scoping shapes cost.