What CUI is
Controlled Unclassified Information is information the government creates or possesses, or that someone creates or possesses for the government, that a law, regulation, or government-wide policy says must be protected or limited in who can see it. It is not classified. It is the large middle ground between public information and classified information.
The rules for the whole federal government are in 32 CFR Part 2002. The CUI Registry, run by the National Archives (NARA), is the official list of what counts: each category, what it covers, the law behind it, and how it is marked.
There are two flavors:
- CUI Basic: the law behind it does not set special handling rules, so the standard CUI rules apply.
- CUI Specified: the law behind it adds its own handling rules on top, which can be stricter or simply different.
CUI versus FCI
Both come up in CMMC, and the difference decides your level.
Federal Contract Information (FCI) is information, not intended for public release, that is provided by or generated for the government under a contract to develop or deliver a product or service. It does not include information the government has made public, or simple transactional information such as what is needed to process payments.
In practice, almost every company performing a DoD contract holds FCI: purchase orders, delivery schedules, statements of work. FCI on your systems means CMMC Level 1.
CUI is a narrower, more sensitive set. If you handle CUI, you also handle FCI, and CUI on your systems means CMMC Level 2.
What CUI looks like for a small contractor
These are common ways CUI shows up in defense supply chains. Each is a sign to check, not proof by itself.
- Technical drawings and specifications for a military program, especially ones carrying a distribution statement from B through F. DoD calls this controlled technical information (technical information with a military or space application that is subject to access controls).
- Export-controlled information (ITAR or EAR technical data).
- Documents marked "CUI" or "CONTROLLED" in a banner at the top of the page.
- Older markings such as "FOUO" (For Official Use Only). Material marked before the CUI program existed is called legacy material; it can still need protection.
Who decides whether it is CUI
The government does. Under DFARS 252.204-7012, the CUI you must protect (called covered defense information) is information that is marked or otherwise identified in the contract and provided to you by or for DoD, or that you collect, develop, receive, transmit, use, or store in support of the contract.
That means you should not have to guess, but in practice you may receive information that is unmarked or marked inconsistently.
How to tell whether you handle it
- Check your contracts for DFARS 252.204-7012. It applies when covered defense information is involved.
- Look at what you actually receive. Search shared drives and email for drawings, specifications, and anything with a CUI banner or a distribution statement.
- Ask your prime or contracting officer in writing whether the work involves CUI, and which information it will be.
- Think about what you create. Information you generate for the contract can be CUI too, for example drawings derived from CUI drawings.
What changes if you do handle CUI
- Your CMMC requirement becomes Level 2: the 110 requirements of NIST SP 800-171.
- DFARS 252.204-7012 also applies: cyber incidents involving covered defense information must be reported to DoD within 72 hours of discovery, and cloud services that store or process it must meet FedRAMP Moderate or an equivalent.
- Where CUI lives starts to matter a lot. Every system that touches it is in scope for assessment. See Scoping and enclaves.