What is Controlled Unclassified Information (CUI)?

What counts as CUI

CUI is defined by category. The CUI Registry, kept by the National Archives, lists each category and the law, regulation or policy that requires the information to be protected. The categories defence suppliers meet most often are controlled technical information, such as engineering drawings and specifications with a military use, and export-controlled information.

Information is CUI when it falls in a registry category and is created or held by or for the government. The government, or the prime contractor flowing work down, should mark it and say in the contract that CUI is involved. Markings are often missing in practice, so contractors need their own way of recognising it.

• CUI Basic. The authority requires protection but sets no specific handling rules, so the standard CUI controls apply.
• CUI Specified. The authority sets extra handling or dissemination rules, which apply on top of the standard controls.

What handling CUI requires of a contractor

In contractor systems, CUI is protected using NIST SP 800-171. DFARS clause 252.204-7012 has for several years required defence contractors to meet it for covered defence information, and to report cyber incidents to the Department of Defense within 72 hours of discovery.

CMMC adds verification. At Level 2, most contracts require an assessment by a C3PAO, which checks each of the 110 requirements against your System Security Plan and evidence. Level 3, for the most sensitive programmes, adds requirements from NIST SP 800-172 and a government-led assessment.

The CUI-specific pieces sit on top of ordinary security controls: FIPS-validated encryption, marking and handling of media, and training people to recognise and handle CUI.

Why scoping comes first

Every system that stores, processes or transmits CUI, and every system that protects those systems, falls inside the assessment boundary. If CUI travels through general email and file shares, the whole company is in scope.

Many contractors keep CUI in a separate enclave instead: a defined set of systems and people that are the only ones allowed to handle it. A smaller boundary means fewer systems to secure, a shorter System Security Plan and a narrower assessment.

Related terms

Federal Contract Information (FCI)

Information provided by or generated for the US government under a contract and not intended for public release. Handling FCI brings a contractor under CMMC Level 1.

NIST SP 800-171

The US standard of 110 security requirements for protecting Controlled Unclassified Information in non-federal systems, and the control set behind CMMC Level 2.

System Security Plan (SSP)

The CMMC and NIST SP 800-171 document describing the system boundary and how each of the 110 requirements is met. The assessor starts from it.

C3PAO

A CMMC Third-Party Assessment Organisation: a company authorised by the Cyber AB to carry out CMMC Level 2 certification assessments for US defence contractors.

Plan of Action and Milestones (POA&M)

The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.