CUI: What It Is and Why It Matters for CMMC

Defining CUI

Controlled Unclassified Information (CUI) is information the U.S. government creates or possesses — or that an entity creates or possesses on the government's behalf — that a law, regulation, or government-wide policy requires to be safeguarded or disseminated using controls consistent with established standards. The key distinction from classified information is that CUI does not require a security clearance to access — it requires authorization based on a legitimate need.

The CUI program was established by Executive Order 13556 in 2010 and is administered by the National Archives and Records Administration (NARA) through the CUI Registry at archives.gov/cui. The CUI Registry is the authoritative source for what constitutes CUI — it lists the categories, subcategories, and the underlying laws and regulations that drive each category.

The CUI Categories Relevant to Defense Contractors

The CUI Registry contains over 100 subcategories organized into 20 top-level categories. Defense contractors most commonly encounter CUI from these categories:

• Controlled Technical Information (CTI) — technical information with military or space application that is subject to controls on access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. This is the most common CUI category in defense contracts and is specifically referenced in DFARS 252.204-7012.
• Export Controlled — information covered by the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR)
• Privacy — personally identifiable information (PII) about individuals
• Procurement and Acquisition — source selection information, bid and proposal data
• Law Enforcement — investigative files or case-sensitive information shared by law enforcement agencies
• Intelligence — information related to intelligence activities
• Nuclear — unclassified information related to nuclear materials and facilities

The specific categories your contracts involve will be identified in the contract's Performance Work Statement or Data Item Descriptions, or through coordination with the contracting officer's technical representative.

How to Identify CUI in Your Environment

CUI identification is not a one-time exercise — it is an ongoing process because the types of information flowing into your environment change as you take on new work. The starting point is contract review: read every active contract for references to CUI, DFARS 252.204-7012, or specific data categories. Then trace how that information enters your organization and where it goes.

Common places CUI appears in contractor environments:

• Technical drawings and specifications received from the government or prime contractor
• Engineering models and CAD files related to defense systems
• Test data and performance specifications
• Contract proposals containing government cost data
• Meeting notes and emails discussing program details
• Collaboration spaces (SharePoint sites, Teams channels) used for government program work

The challenge is that CUI is not always explicitly labeled when it arrives. NARA's policy requires that CUI be marked with a CUI designation when it is created or shared by authorized holders, but in practice contractors receive unmarked information that may still qualify as CUI based on its content and the underlying regulation. When in doubt, treat information as CUI and discuss with your contracting officer.

CUI Handling Requirements Under NIST 800-171

The 110 security requirements in NIST 800-171 Rev 2 define the baseline for protecting CUI in non-federal systems. These requirements cover the full lifecycle of CUI handling:

At rest: CUI must be stored in systems that implement access controls, encryption, and audit logging. Unencrypted CUI on laptops, USB drives, or personal cloud storage is a violation. Requirement 3.13.16 requires protecting the confidentiality of CUI at rest.

In transit: CUI transmitted over networks must be encrypted using FIPS-validated cryptographic mechanisms. Sending CUI via standard unencrypted email violates requirement 3.13.8. Acceptable methods include FIPS 140-2 validated encryption (TLS 1.2 or higher with approved cipher suites, or end-to-end encrypted email using DoD-approved solutions).

Disposal: Media containing CUI must be sanitized before disposal using methods consistent with NIST SP 800-88. Deleting files is not sufficient — the media must be overwritten, degaussed, or physically destroyed depending on the media type and sensitivity.

Physical handling: CUI in physical form (printed documents, removable media) requires physical access controls and must be stored in locked containers when not in use. Requirement 3.10.3 covers physical access controls to CUI-containing systems and physical CUI.

Building a CUI Inventory

The foundation of any CMMC compliance program is a CUI inventory — a documented list of what CUI your organization possesses, where it lives (specific systems, folders, physical locations), how it enters and leaves your environment, and who is authorized to access it. This inventory directly informs your SSP system boundary and your access control implementation.

Organizations that cannot articulate where their CUI lives cannot credibly demonstrate that they have implemented appropriate controls around it. Assessors will ask. Building and maintaining the inventory is not just a compliance exercise — it is the first step to actually protecting the information your contracts require you to protect.