What Is CUI? Controlled Unclassified Information Explained

If your organization works with a US federal agency, some files you receive may carry a CUI banner. That label means the information isn't classified but still comes with handling rules, and for contractors it can bring security requirements for their own systems. This guide covers where the rules come from, how CUI is marked and protected, and what defense contractors need to know about CMMC.

What is Controlled Unclassified Information (CUI)?

Controlled Unclassified Information (CUI) is information the US government creates or possesses, or that an organization creates or possesses on the government's behalf, that a law, regulation or government-wide policy requires or permits agencies to protect with safeguarding or dissemination controls. CUI is unclassified, but it can't be handled or shared freely.

Each type of CUI is an approved category, such as Controlled Technical Information, Export Controlled or General Privacy, tied to the law or policy behind it. CUI doesn't include information a nonfederal organization holds in its own systems that didn't come from, and wasn't created for, a federal agency.

Where the CUI rules come from

• Executive Order 13556, signed on November 4, 2010, created the CUI program to replace the ad hoc, agency-specific markings and policies used for sensitive unclassified information.
• 32 CFR Part 2002, published on September 14, 2016 and in effect from November 14, 2016, sets the rules for designating, safeguarding, disseminating, marking, decontrolling and disposing of CUI.
• The CUI Registry lists every CUI category with its legal authority, markings and handling guidance. The National Archives' Information Security Oversight Office (ISOO) maintains it, acting for NARA as the CUI Executive Agent.

ISOO Notice 2026-07, issued on September 2, 2026, requires agencies to give prime contractors specific CUI guidance, including marking, safeguarding and training requirements, for every contract that requires access to CUI.

CUI Basic vs CUI Specified

The law or policy behind each category decides its type. CUI Basic is CUI whose authority doesn't set specific handling rules, so agencies apply the uniform controls in 32 CFR Part 2002 and the CUI Registry. CUI Specified is CUI whose authority sets its own handling controls, which may be stricter than, or simply different from, the CUI Basic controls.

How CUI is marked

Every page that contains CUI needs the same CUI banner marking at the top. The banner has up to three parts, separated by double slashes:

1. Control marking (mandatory): the acronym "CUI" or the word "CONTROLLED".
2. Category markings: mandatory for CUI Specified and written with an "SP-" prefix, as in CUI//SP-EXPT for export-controlled information. They're optional for CUI Basic unless agency policy requires them.
3. Limited dissemination controls: optional limits on who can receive the information, such as NOFORN (no foreign dissemination).

A document must also name the agency that designated the CUI, for example on letterhead or in a "Controlled by" line.

How CUI must be protected

On federal systems, agencies must protect CUI Basic at no less than a moderate confidentiality impact level, using controls from NIST SP 800-53. For nonfederal systems, such as those run by contractors and universities, 32 CFR Part 2002 requires agencies to use NIST SP 800-171 when setting security requirements, unless the law behind a category prescribes its own.

The current version, NIST SP 800-171 Rev. 3, was published in May 2024. It has 97 security requirements in 17 families, against 110 requirements in 14 families in Rev. 2. Rev. 3 adds the Planning, System and Services Acquisition, and Supply Chain Risk Management families, aligns its requirements with NIST SP 800-53 Rev. 5, and introduces organization-defined parameters: values for selected requirements that the agency sets, or the contractor sets if the agency doesn't.

CMMC: what defense contractors need to know

The Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program assesses whether contractors and subcontractors protect Federal Contract Information and CUI on their own systems. CMMC applies only to DoD contracts.

• The program rule, 32 CFR Part 170, took effect on December 16, 2024.
• The DFARS rule that puts CMMC into contracts took effect on November 10, 2025, starting Phase 1, which mainly calls for self-assessments.
• Phase 2 began on November 10, 2026. DoD now intends to require Level 2 certification by a third-party assessor (C3PAO) as a condition of award for applicable contracts. Full implementation, Phase 4, starts in November 2028.

Level 1 covers the 15 requirements in FAR 52.204-21. Level 2 covers the 110 requirements of NIST SP 800-171 Rev. 2, the revision written into 32 CFR Part 170, not Rev. 3. Level 3 adds 24 requirements selected from NIST SP 800-172.

CUI vs classified information vs public information

Do you need to follow CUI rules?

You do if you're an authorized holder of CUI: a federal employee, or a nonfederal organization that receives CUI from an agency or creates it for one, such as a contractor, grantee, university or state agency. Agencies should set out those obligations in a contract or agreement. The rules don't reach information your organization holds that didn't come from, and wasn't created for, a federal agency.

If you're not sure whether something is CUI, ask the designating agency named on the document. Defense contractors should also check the CMMC level in each solicitation.

Where DekkoCORE fits

DekkoCORE is secure file sharing and collaboration for regulated organizations. For US customers, DekkoCORE is hosted in-country in the United States, and files and messages are encrypted with AES-256 keys on the user's device before they're uploaded. Each person you share with gets the permission level you choose, such as View only or Download, and every view and download is recorded in the audit log.

Common questions

Frequently Asked Questions