CUI Program

Controlled Unclassified Information (CUI) is information that the government creates or receives, or that an organization holds on its behalf. Law, regulation, or government-wide policy requires that it be protected or shared only under controls. Yet it is not classified. Typical examples include export-controlled technical data, personal information collected by federal agencies, critical infrastructure details, law enforcement sensitive material, and proprietary data submitted to a regulator.

Before the program existed, agencies protected such material with a patchwork of informal labels, such as “sensitive but unclassified”, “for official use only”, and “law enforcement sensitive”, plus dozens more. The CUI program replaced them with one framework and one rule. If an information type is not listed in the official registry, it is not CUI and must not be marked as such. In everyday terms, CUI is one part of the wider family of sensitive data.

Executive Order 13556 (November 2010) ordered the executive branch to adopt a single, uniform system for designating, marking, and handling sensitive unclassified information. The implementing regulation, 32 CFR Part 2002, was published in 2016 and took full effect in November 2017. It binds every federal agency across the whole life cycle: designation, marking, safeguarding, dissemination, decontrol, and incident reporting.

The National Archives and Records Administration (NARA) acts as Executive Agent. Within NARA, the Information Security Oversight Office (ISOO) maintains the registry, publishes guidance and training, and reviews agency implementation. Each agency appoints a senior official responsible for its own CUI operations. Some parts of the government add rules on top. The Department of Defense, for example, regulates its supply chain.

The CUI registry is the program's backbone. It is the authoritative list of every approved category and subcategory. For each one, it records the legal authority, the exact marking, and how the information must be safeguarded, disseminated, and decontrolled. Agencies cannot invent categories of their own. The marking mechanics are deliberately uniform:

CUI does not stay inside the government. Defense, aerospace, healthcare, energy, and research organizations receive it under contracts and grants. When it leaves a federal system, the requirements follow the information. Obligations reach nonfederal organizations in two ways: through terms in the contract or agreement, or directly through federal law or regulation.

In practice, the safeguarding baseline is NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. Its second revision has 110 security requirements in fourteen control families, from access control and audit to incident response, media protection, and personnel security. Specific clauses determine how strictly it is enforced:

• DFARS 252.204-7012: defense contracts require full NIST SP 800-171 compliance for systems that handle CUI, the same requirements flowed down to subcontractors, and incident reporting within 72 hours for covered defense information.
• FAR 52.204-21: contracts without the full clause still require basic safeguards, such as access limits, monitoring, and hygiene controls, for systems that process or store CUI.
• Assessment and certification: the Department of Defense verifies compliance through scored self-assessments. Its certification program adds third-party assessment for the defense supply chain.
• Handling rules: CUI must not be sent to personal email accounts or stored on personal devices. It must be destroyed by approved methods, and staff who handle it must be trained.

For a nonfederal organization, the program becomes a concrete work cycle in five steps:

1. 1

   Identify CUI

   Find which information in each contract is designated as CUI.

2. 2

   Scope storage and processing

   Define where CUI is stored and processed, ideally in a dedicated environment set aside for it.

3. 3

   Implement NIST SP 800-171

   Put the NIST SP 800-171 controls in place in that environment.

4. 4

   Mark and train

   Mark internal documents consistently and train the people who have access.

5. 5

   Prepare the incident process

   Prepare the incident process in advance.

The recurring failure modes are well known. Organizations treat CUI like ordinary confidential business data. They let it spread into unscoped systems and personal accounts. Or they let assessments go stale after the environment changes.

Anexet does not manage the CUI registry or assign CUI markings. Its blocking rules can, however, test a Microsoft sensitivity label on a file, so a rule can build on data labeling that is already in place, the same way content-aware blocking works with labels and fingerprints.

A CUI program is not a one-time exercise. The registry evolves, contract clauses change, and assessments must be refreshed to stay defensible.