Who Is Responsible for Protecting CUI? A Contractor's Guide to Safeguarding Controlled Unclassified Information

If your company touches a federal contract, someone in your organization is responsible for protecting CUI — and that someone is probably you. Controlled Unclassified Information is the sensitive information the government shares with contractors to get work done, and mishandling it can cost you a contract, a certification, or worse. Yet the question of who actually carries responsibility for safeguarding it trips up even experienced defense contractors.

This guide answers it directly: who is responsible for protecting CUI, who applies the markings, what the rules require, and how the whole CUI program fits together for a contractor. If you handle CUI and want to understand exactly where the responsibility sits and what you must do to meet it, this is the plain-English breakdown.

What is controlled unclassified information?

Controlled Unclassified Information, or CUI, is information the government creates or possesses that requires safeguarding or dissemination controls under law, regulation, or government-wide policy — but that isn't classified. It sits in the gap between fully public information and classified national security information. CUI is information sensitive enough to need protection, common enough that contractors handle it every day.

The category exists to standardize how sensitive information gets protected across the government and its contractors. Before the CUI program, agencies used a patchwork of labels — "For Official Use Only," "Sensitive But Unclassified," and dozens of others — with no consistent rules. The CUI program replaced that mess with one framework, defining what qualifies as CUI and how to handle it using safeguarding or dissemination controls.

For contractors, the practical point is that a lot of what you receive on a federal contract falls under CUI. Technical drawings, security information, personally identifiable data, and controlled technical information can all be considered CUI. Our essential guide to controlled unclassified information covers the full scope of what qualifies and why it matters.

Who is responsible for protecting CUI?

Here's the direct answer: everyone who handles CUI is responsible for protecting it. There's no single office or officer that carries the whole burden. The authorized holder — any individual or organization that has lawful access to CUI — is responsible for safeguarding it in accordance with government requirements. When the Department of Defense provides CUI to a contractor, that contractor becomes an authorized holder and inherits the duty to protect it.

Responsibility runs at multiple levels. At the government level, the CUI Executive Agent, a role held by the National Archives and Records Administration, oversees the entire CUI program and maintains the rules everyone follows. At the agency level, the office that originates the information is responsible for determining that information qualifies as CUI and applying the correct markings. At the contractor level, your organization is responsible for ensuring anyone who handles CUI does so correctly.

So when someone asks who is responsible for protecting CUI, the accurate answer is layered. The government designates and marks it; the contractor who receives it must safeguard it. Every authorized holder is responsible for protecting the confidentiality of CUI in their possession. That shared model is why CUI compliance can't be delegated to one person and forgotten — it's an organizational obligation. If you're standing up a program to manage this, OryonIQ Insights can help you track your CUI and compliance obligations.

Who is responsible for applying CUI markings?

Marking is where responsibility gets specific. The entity that designates information as CUI is responsible for applying CUI markings and dissemination instructions. Usually that's the government agency that originates the information — it decides the data qualifies as CUI, then marks it before sharing. The originator, not the recipient, makes the initial call on what falls under the CUI category.

That said, contractors aren't off the hook on marking. When you create new documents that incorporate or derive from CUI you've received, you're responsible for applying CUI markings to that new material, carrying forward the controls from the source. If you generate a report containing CUI, that report must be marked as CUI. Properly marking CUI in the document you create is part of handling it correctly, and getting it wrong can expose the information or breach your contract.

The markings themselves aren't decoration — they tell every subsequent holder how to handle the information. A CUI marking identifies the information as controlled, indicates its category, and specifies any dissemination controls that limit who can receive it. Understanding CUI marking requirements is essential, because a document that isn't properly marked can be mishandled by someone who doesn't realize what they're holding.

What's the difference between CUI Basic and CUI Specified?

CUI comes in two flavors, and the distinction drives how you protect it. CUI Basic is the default. It covers information that requires safeguarding or dissemination controls but where the underlying law or policy doesn't spell out specific handling requirements. For CUI Basic, you apply the standard baseline of protection defined by the CUI program.

CUI Specified is the stricter tier. CUI Specified is a subset of CUI where the authorizing law, regulation, or government-wide policy lays out specific handling or dissemination controls beyond the baseline. When information is CUI Specified, you must follow those particular requirements, which can be more restrictive than the general standard. Controlled technical information and certain security information often fall into this category.

Knowing whether information is CUI Basic or CUI Specified tells you which rules apply. The marking should indicate which category you're dealing with, and the NARA CUI Registry lists every CUI category and its safeguarding requirements. An authorized holder is responsible for determining the correct handling by checking the category — you can't protect CUI properly if you don't know which type you're holding.

What does the CUI Registry tell you?

The CUI Registry is the government's master catalog of everything that qualifies as CUI. Maintained by the National Archives and Records Administration as the CUI Executive Agent, the NARA CUI Registry is the authoritative source for the CUI categories, their markings, and the legal authorities behind each one. When you need to know whether information falls under CUI, the registry is where you check.

The registry organizes CUI into categories and lists them by grouping — things like defense, export control, and critical infrastructure. Each entry identifies whether the category is CUI Basic or CUI Specified and points to the law or policy that controls it, including any specific safeguarding or dissemination controls. This is how a contractor confirms that DoD critical infrastructure security information, for instance, qualifies as CUI and learns how to handle it.

For contractors, the registry turns an abstract obligation into concrete guidance. Rather than guessing whether data is controlled, you consult the CUI categories listed in the registry and apply the requirements attached to the relevant one. Making the registry part of your CUI handling process is one of the simplest ways to ensure you protect CUI correctly and consistently.

How do NIST SP 800-171 and CMMC relate to protecting CUI?

Protecting CUI on your own systems means meeting a defined security standard. For CUI in non-federal information systems — that is, on contractor networks — the governing standard is NIST SP 800-171. This publication from the National Institute of Standards and Technology lays out the security controls contractors must implement to safeguard CUI. If you handle CUI, meeting NIST SP 800-171 is the baseline expectation, and the NIST SP 800-171 requirements define exactly what that involves.

CMMC is how the Department of Defense verifies you're actually meeting that standard. The Cybersecurity Maturity Model Certification program checks that defense contractors have implemented the required controls rather than just claiming to. For contractors handling CUI, CMMC Level 2 aligns with the NIST SP 800-171 requirements, and achieving it demonstrates your systems can protect the information the DoD entrusts to you. Our complete CMMC 2.0 compliance guide walks through what certification takes.

The two fit together cleanly. NIST SP 800-171 defines the requirements for protecting CUI; CMMC verifies you've met them. Contractors who handle CUI must meet both — the standard and the certification that proves compliance with it. Falling short on either can put a defense contract out of reach, which is why the DoD ties them so tightly to CUI protection.

What happens if you fail to protect CUI?

Failing to protect CUI carries real consequences. At the contract level, mishandling CUI can breach the terms of your agreement, exposing you to corrective action, financial liability, or loss of the contract entirely. For DoD work, an inability to demonstrate CMMC compliance can disqualify you from bidding at all. The cost of getting CUI wrong is measured in lost business.

Beyond the contractual hit, mishandled CUI can cause genuine harm. This is sensitive information the government controls precisely because its exposure could damage security, privacy, or operations. A breach involving controlled technical information or DoD critical infrastructure security information isn't a paperwork problem — it can undermine national security interests, which is why the rules exist and why enforcement is serious.

There's also a reputational dimension that follows you. A contractor known for mishandling CUI becomes a poor risk for future federal work, and past performance records travel. Consistently protecting CUI, by contrast, builds the trust that agencies weigh when awarding contracts. Treating CUI compliance as a core capability rather than a checkbox is what keeps you eligible and competitive over time.

How can contractors build a CUI protection program?

Building a real CUI program starts with knowing what you have. Identify where CUI enters your organization, where it lives, and who touches it, then map that against the CUI requirements for each category. You can't safeguard CUI you haven't located, so an inventory of your CUI data is the foundation of any serious effort to manage CUI.

From there, it's controls, training, and documentation. Implement the NIST SP 800-171 security controls on the systems where CUI resides, train everyone who handles CUI on proper marking and handling, and document your practices so you can demonstrate compliance during a CMMC assessment. Every person handling CUI must meet the requirements, so awareness across your team matters as much as technical controls. Knowing how to decontrol CUI when it's no longer sensitive is part of the lifecycle too.

Ongoing management is what keeps the program alive. CUI policy, access controls, and regular review ensure CUI stays protected as people and projects change. This is where a tracking tool earns its keep — OryonIQ Insights helps contractors monitor CUI obligations and compliance readiness so nothing slips between assessments. A living program, not a one-time scramble, is what genuinely protects controlled unclassified information.

FAQs about protecting CUI

Who is ultimately responsible for protecting CUI? Every authorized holder. Any individual or organization with lawful access to CUI is responsible for safeguarding it. For contractors, that means your organization becomes responsible the moment the government provides CUI to you.

Who applies CUI markings? The entity that designates the information as CUI applies the initial markings — usually the originating agency. Contractors are responsible for applying CUI markings to any new documents they create that contain or derive from that CUI.

Does protecting CUI require CMMC? For DoD contractors handling CUI, yes. CMMC Level 2 verifies you've implemented the NIST SP 800-171 controls required to protect CUI in non-federal information systems.

Key things to remember

• Everyone who handles CUI is responsible for protecting it. Every authorized holder — including any contractor the government provides CUI to — must safeguard it. Responsibility can't be delegated to one person.
• The government marks it; you protect it. The originating agency designates and marks CUI. Contractors apply CUI markings to new documents they create from it.
• Know CUI Basic vs. CUI Specified. CUI Specified is a subset with extra handling requirements. Check the NARA CUI Registry to confirm the category and its controls.
• The CUI Registry is authoritative. Maintained by the National Archives and Records Administration, it lists every CUI category and its safeguarding requirements.
• NIST SP 800-171 and CMMC go together. NIST SP 800-171 defines the controls for protecting CUI on contractor systems; CMMC Level 2 verifies you've met them.
• Failure is costly. Mishandling CUI can breach your contract, block DoD bids, and damage your past performance record.
• Build a living program. Inventory your CUI, apply controls, train your team, and manage it continuously rather than treating compliance as a one-time task.