Controlled Unclassified Information is the federal data that is not classified but still legally has to be protected, and for a contractor, handling it wrong can end a contract. CUI affects your eligibility, your security posture, and your legal standing, and the obligations are concrete: identify it, mark it, protect it under a defined set of controls, train your people, and run it as an ongoing program. This guide covers each of those steps.
Quick answer: CUI is unclassified information that law, regulation, or government-wide policy requires you to safeguard. It was established by Executive Order 13556, is run by NARA, and is cataloged in the CUI Registry in two tiers, Basic and Specified. Contractors protect it by implementing NIST SP 800-171 on their systems, training everyone with access, and, for DoD work, demonstrating that implementation through CMMC.
CUI is information the government creates or possesses, or that a contractor creates or possesses for the government, that a law, regulation, or government-wide policy requires to be safeguarded or disseminated only under controls. It is neither classified nor lawfully public. It sits between the two, and it carries real legal handling obligations for anyone who holds it.
The framework exists to replace the old patchwork of agency labels, "For Official Use Only," "Sensitive But Unclassified," and dozens more, that were applied inconsistently and left gaps across the government. Executive Order 13556, signed in 2010, created one program and named the National Archives and Records Administration (NARA) as executive agent, with the work delegated to its Information Security Oversight Office (ISOO). The rules are codified in 32 CFR Part 2002.
The stakes are real. Depending on the category, mishandling CUI can lead to contract termination, suspension or debarment, and civil or criminal liability under laws such as the Privacy Act or export-control regulations. For defense contractors, CUI handling also feeds directly into CMMC and award eligibility. If you are working out which people and organizations carry the obligation, from agencies to primes to subcontractors, see our guide on who is responsible for protecting CUI.
Every type of CUI belongs to a category listed in the CUI Registry, and each category is either CUI Basic or CUI Specified. Basic is the default, using the uniform controls in 32 CFR Part 2002. Specified applies when the underlying law sets its own handling or dissemination rules, which can be stricter or simply different.
The authoritative source is the CUI Registry NARA maintains. It groups categories into organizational index groupings such as Defense, Export Control, Privacy, Proprietary Business Information, Law Enforcement, Nuclear, Critical Infrastructure, and Procurement and Acquisition, and for each category it cites the law behind it and the handling it requires. When you are unsure whether something qualifies, you check the Registry. DoD contractors should also consult the DoD CUI Registry, which maps those categories to defense-specific guidance.
The tier is not academic. It decides how you label, store, transmit, and dispose of the information, and treating Specified material as Basic is exactly the misclassification auditors look for. Under 32 CFR 2002.4, CUI Specified controls "may be more stringent than, or may simply differ from" Basic, so check the Registry entry and your agency's CUI policy before you build anything.
A few categories drive most of the work on a typical federal or defense contract:
Knowing which categories you hold tells you which controls, markings, and dissemination limits apply, so it is worth listing them for every contract before work starts.
Mark CUI with a banner at the top of every page reading "CUI" or "CONTROLLED," add the category marking when the information is CUI Specified, and add any limited dissemination control that applies. DoD documents also need CUI in the footer and a designation indicator block showing who controls the information.
Marking is how everyone who touches the information knows it needs protection. Under 32 CFR 2002.20, the banner marking is mandatory and must include either "CONTROLLED" or "CUI." For CUI Specified, the category or subcategory marking is mandatory too, separated by double slashes, in the form CUI//SP-[category]. Use the exact abbreviation the Registry lists for that category rather than inventing one.
Limited dissemination controls narrow who may receive the information. The Registry's list of dissemination controls includes NOFORN (no foreign dissemination), FED ONLY (federal employees and armed forces only), FEDCON (federal employees, armed forces, and authorized contractors), NOCON (no contractor access), DL ONLY (only those on an accompanying dissemination list), and REL TO (release to specified countries). A Basic document shared with contractors might read CUI//FEDCON.
Portion markings, such as "(CUI)" at the start of a paragraph, flag which parts of a larger document are sensitive. NARA permits and encourages them but does not require them for CUI Basic; some agencies and contracts do, so follow your contract's marking guide. DoD adds its own requirements under DoDI 5200.48: "CUI" at the top and bottom of every page, plus a CUI designation indicator block on the first page or cover that names the controlling office, the CUI category, any dissemination control or distribution statement, and a point of contact. CTI also carries its distribution statement.
Marking carries into the digital world: put "CUI" in email subject lines and banners, record status in file metadata, label USB drives and other media, and apply the same markings to any derivative document you build from CUI sources. NARA's CUI program publishes the detailed marking handbook.
Everyone who creates, receives, handles, or transmits CUI needs training before they get access. DoD contractors must complete initial CUI training and an annual refresher under DoDI 5200.48. Federal agencies outside DoD must train employees when they start and at least every two years, under 32 CFR 2002.30.
The DCSA CUI FAQ for industry states that "DOD contractors require initial training and annual refresher training on CUI." For contractors the requirement flows through the contract: CUI should be identified in the DD Form 254, the RFQ or RFP, or other contract documents, and the government contracting activity (GCA) is the place to ask what training it expects. A contracting officer can ask for your training records during a review.
Good training covers what CUI is and how it differs from classified information, how to identify the relevant categories in the Registry, how to mark it, how to handle it physically and digitally, and how to report a suspected incident or unauthorized disclosure. Add role-specific training for system administrators, managers, and anyone who designates or decontrols CUI. Track who completed what and when, both to prove compliance and to find gaps.
Standardized courses are free. DCSA's Center for Development of Security Excellence offers the CUI course IF141, the DCSA CUI page collects industry resources, and NARA hosts general training at the NARA CUI training portal. The strongest programs pair the courses with job aids and short reminders, because people also have to understand the behavioral side: if an unauthorized employee can overhear a conversation about CUI or read it off a monitor, that is a failure you fix.
Contractors protect CUI on their own systems by implementing NIST SP 800-171, the federal standard for CUI in nonfederal systems. For DoD contracts, DFARS 252.204-7012 requires it, DoD currently requires Revision 2 with its 110 requirements, and CMMC verifies the implementation through self-assessment or third-party certification.
Which standard applies depends on who runs the system. Federal systems follow NIST SP 800-53. Nonfederal organizations, which means contractors handling CUI for the government, follow NIST SP 800-171 Revision 2: 110 requirements across 14 families, including access control, awareness and training, audit and accountability, incident response, and media protection. CUI Specified layers on whatever its governing authority adds.
NIST published SP 800-171 Revision 3 on May 14, 2024, reorganizing the requirements into 17 families. DFARS 252.204-7012 normally points to the current version, but DoD issued class deviation 2024-O0013 directing contractors to keep implementing Revision 2, and CMMC Level 2 is built on the 110 Revision 2 requirements. Practically, build to Revision 2 for DoD work, keep Revision 3 on your roadmap, and follow any civilian-agency contract that names a different revision. Our NIST 800-171 compliance checklist walks through the controls family by family.
The controls have to cover the whole lifecycle: creating, receiving, storing, transmitting, and destroying. At minimum you restrict access to people with a lawful government purpose, store CUI in controlled environments or approved systems, and prevent unauthorized disclosure. Technically that means multi-factor authentication, encryption at rest and in transit, role-based access, and audit logging. Disposal has to leave the information "unreadable, indecipherable, and irrecoverable," as 32 CFR 2002.14 puts it, using methods in NIST SP 800-88 or those approved for classified information, such as cross-cut shredding for paper and purging or physical destruction for electronic media.
CMMC is how DoD checks that the 800-171 work was actually done. The program rule, 32 CFR Part 170, took effect on December 16, 2024, and the DFARS rule that puts CMMC into contracts took effect on November 10, 2025, starting Phase 1. There are three levels: Level 1 covers the 15 basic safeguarding requirements in FAR 52.204-21 for Federal Contract Information, Level 2 covers the 110 NIST SP 800-171 Revision 2 requirements for CUI, and Level 3 adds 24 requirements from NIST SP 800-172 for the most sensitive programs.
In July 2026, DoD suspended the planned Phase 2 rollout of third-party (C3PAO) Level 2 certification and opened a 60-day review by a CMMC Reform Task Force. Phase 1 self-assessments, posting scores in the Supplier Performance Risk System (SPRS), annual affirmations, and DFARS 252.204-7012 obligations remain in effect. Check the DoD CIO CMMC page for the outcome, and see our CMMC 2.0 compliance guide for defense contractors for level-by-level preparation.
Treat CUI as a program, not a project. Start with an inventory of the CUI you create, receive, store, and transmit, write a policy that sets roles and lifecycle procedures, then keep it running with audits, refreshed training, and regular checks of the Registry for new or changed categories.
For the inventory, review your active contracts for CUI clauses and the DD Form 254, identify the categories involved, and map how the data actually moves through your systems and workflows. Many organizations discover at this step that CUI is sitting in shared drives, personal email, or collaboration tools that were never configured to protect it, which is exactly the visibility problem the inventory solves.
Then write a CUI policy. Name an owner, usually a compliance officer or security manager, spell out how you receive, handle, share, and dispose of CUI, including how you flow requirements down to subcontractors, and build in a way to report misuse and a corrective-action process. Keep your System Security Plan and plan of action current, because CMMC assessors and contracting officers examine your controls, marking, and safeguarding closely. It is also worth understanding how FAR and DFARS compliance intersects with your CUI obligations.
The cost of skipping this is high. Beyond termination and debarment risk, a firm known for poor CUI handling struggles to win new work no matter how strong it is technically. When a clause question comes up, Ask Oryon answers FAR and DFARS questions in plain English, and Polaris lets you search SAM.gov and other opportunities by agency, NAICS, and set-aside so you can spot DoD work that will involve CUI before the solicitation lands. You can start on the free plan, no credit card needed.
CUI, or Controlled Unclassified Information, is federal information that is not classified but that a law, regulation, or government-wide policy says must be safeguarded or shared only under controls. The program was created by Executive Order 13556, is run by the National Archives (NARA), and every category is listed in the CUI Registry.
CUI Basic is the default: the authorizing law requires protection but sets no specific handling rules, so the uniform controls in 32 CFR Part 2002 apply. CUI Specified is where the law or regulation sets its own handling or dissemination controls, which may be stricter than or simply different from Basic, and its category marking is mandatory.
Put a banner marking of CUI (or CONTROLLED) at the top of each page, add the category marking for CUI Specified, and add any limited dissemination control such as NOFORN or FEDCON. DoD documents also carry CUI in the footer and a CUI designation indicator block on the first page showing who controls the information and its category.
DoD contractors need initial CUI training before access and an annual refresher, per DCSA guidance implementing DoDI 5200.48. Federal agencies outside DoD must train employees when they start and at least every two years under 32 CFR 2002.30. Your contract or the government contracting activity sets the exact requirement for your firm.
Revision 2. NIST published Revision 3 in May 2024, but DoD class deviation 2024-O0013 directs contractors under DFARS 252.204-7012 to implement Revision 2, and CMMC Level 2 is built on the 110 requirements in Revision 2. Check your contract and dodcio.defense.gov in case DoD changes that position.
CMMC applies to DoD contracts that include the CMMC clause, with Level 2 covering contractors that process, store, or transmit CUI. The DFARS rule took effect on November 10, 2025, starting Phase 1 self-assessments. In July 2026 DoD suspended the planned Phase 2 third-party certification requirement pending a review, but DFARS 252.204-7012 and NIST SP 800-171 obligations still apply.
Are you curious about the networking events near you? Together we can expand your network and watch your pipeline exponentially grow.
Our mission is to empower the GovCon community to make better data driven decisions based on social relationships and opportunity data that is actionable, measurable, and trackable.
.webp)
.webp)
