Controlled Unclassified Information is the center of gravity of the entire CMMC program — and one of the most misunderstood terms in defense contracting. CUI is information the government creates or possesses, or that a contractor creates or handles for the government, that is not classified but that law, regulation, or government-wide policy requires be safeguarded or dissemination-controlled. The regime comes from Executive Order 13556 and is implemented government-wide by 32 CFR Part 2002, with the National Archives (NARA) running the official CUI Registry of categories.
CUI Basic vs. CUI Specified
Every CUI category is one of two kinds, and the difference drives handling. CUI Basic is the default: safeguard it per the baseline rules (for contractors, that becomes NIST SP 800-171). CUI Specified means the underlying law or regulation itself dictates specific handling or dissemination controls beyond the baseline — export-controlled technical data is the classic defense example, where ITAR adds US-persons restrictions on top of everything 800-171 requires. If your contracts touch Specified categories, your architecture decisions get stricter; that is usually the moment GCC High enters the conversation.
The marking tells you which you hold: banner lines like CUI // SP-CTI flag a Specified category (controlled technical information), while a bare CUI marking is Basic. The DoD CUI program office publishes the DoD-specific registry and marking guidance implemented by DoD Instruction 5200.48.
Who decides what is CUI — and who marks it
Designation follows the information, not the opinion of whoever holds it. The government authority that creates or commissions the information designates it against a registry category, and marking obligations flow with it. Contractors do not get to declare their own work product "not CUI" because handling is inconvenient — but the inverse mistake is just as costly: marking everything CUI out of caution drags your whole company into scope. When a contract is ambiguous about what is CUI, the right move is to ask the contracting officer in writing; the answer scopes your entire compliance program.
What CUI looks like in a defense contractor’s day
- Controlled technical information: drawings, specifications, process sheets, test plans and results arriving from a program office or prime.
- Work packages, repair specs, and technical orders in sustainment and ship-repair supply chains.
- Program correspondence, deliverables, and reports marked CUI by the government customer.
- Export-controlled technical data (ITAR/EAR) — CUI Specified, with personnel restrictions attached.
CUI vs. FCI vs. classified
Three regimes, three different obligations. Classified information lives on government-accredited systems under facility clearances — not on your corporate network, and not CMMC’s subject. Federal Contract Information (FCI) — information you handle under contract that is not for public release — rides below CUI and triggers the 15 basic safeguarding requirements and CMMC Level 1. CUI triggers NIST SP 800-171 under DFARS 252.204-7012 and, under the CMMC program, Level 2 with independent assessment for most contracts.
What handling CUI actually requires
For a contractor, handling CUI means: a defined boundary where it is stored, processed, and transmitted; the 110 requirements of NIST SP 800-171 implemented inside that boundary; incident reporting obligations under DFARS 252.204-7012; and — as CMMC phases in — a Level 2 assessment to prove it. The practical sequence is scoping first (the enclave decision), then remediation (the checklist), then the body of evidence that makes it assessable. Concentrating CUI into the smallest honest footprint is the single biggest cost lever you control.