CUI: Controlled Unclassified Information — The US Government's "Sensitive But Not Secret" Label

CUI (Controlled Unclassified Information) is a standardized marking system used by the US federal government to identify information that:

• Is not classified (Confidential/Secret/Top Secret)
• But is sensitive enough to require safeguarding and controlled dissemination
• Must be protected per law, regulation, or government-wide policy

What Counts as CUI?

Over 125 categories across 20+ groupings, including:

• Privacy: PII (SSN, medical, financial), FERPA, HIPAA data
• Law Enforcement: Investigation records, informant identities, techniques
• Critical Infrastructure: Vulnerability assessments, grid maps, SCADA data
• Export Control: ITAR, EAR technical data (not classified but restricted)
• Financial: Banking supervision, procurement integrity, grant details
• Proprietary Business: Trade secrets, bid/proposal info submitted to gov
• Statistical: Census microdata, BLS survey responses

Why CUI Exists

Before 2010 (EO 13556), agencies used 50+ inconsistent markings (FOUO, SBU, LES, etc.). CUI creates a unified framework for:

• Marking (banner lines, portion markings: CUI//CAT//SP-CTRL)
• Handling (access controls, encryption, need-to-know)
• Decontrol (authorized release, destruction)
• Training & auditing

Who Must Comply?

All federal agencies, contractors, grantees, and subcontractors handling CUI — mandated by 32 CFR Part 2002 and NIST SP 800-171 (for non-federal systems). CMMC (Cybersecurity Maturity Model Certification) enforces it for defense contractors.

CUI isn't "secret" — but losing it can harm privacy, security, competitiveness, or public trust. Treat it like it matters. Because it does.