CUI Registry

Controlled Unclassified Information (CUI) is information that the U.S. government requires to be protected because of its sensitivity. It does not meet the threshold for classification under national security rules. Before 2010, this material was spread across more than a hundred inconsistent agency labels, such as For Official Use Only, Sensitive But Unclassified, and Law Enforcement Sensitive. Executive Order 13556 replaced that patchwork with one governmentwide program and assigned the National Archives and Records Administration (NARA) to run it.

The CUI Registry is the public reference book for the CUI Program. NARA maintains it through its Information Security Oversight Office (ISOO). It is the authoritative list of every approved CUI category and subcategory, with the markings, handling controls, and legal basis for each one. The program's operating rule for agencies and contractors is 32 CFR Part 2002. The registry is where the concrete decisions recorded in that framework live.

The registry sorts CUI into about twenty top-level categories. Each category is divided into subcategories that carry the actual markings. Every entry has the same parts:

The registry separates two kinds of protection. CUI Basic covers information whose handling rules come from the CUI Program itself. Authorized holders apply the uniform baseline controls of 32 CFR Part 2002, with no agency-specific additions. Most registry entries are Basic.

CUI Specified covers information for which a law or regulation outside the CUI Program already sets handling rules, such as longer retention, stricter access or different decontrol. The registry cites the controlling authority for these entries, and holders follow that authority's specific controls where they differ from the baseline. This matters for anyone writing handling procedures, because Specified categories cannot be handled with one policy for all.

The registry is the only legitimate source of CUI markings, and marking is one form of data labeling. That is what keeps markings uniform across government. In practice, the rules work in this order:

1. 1

   Designation

   The authorized holder who creates or receives the information applies the CUI banner marking, or CUI with a category and subcategory identifier, using the exact spelling from the registry.

2. 2

   Portion markings

   Each portion of a document that contains CUI carries its own marking, so a mixed document can be handled portion by portion.

3. 3

   Dissemination controls

   Optional caveats such as FED ONLY or NOFORN are added when the registry entry or the designating agency requires them.

4. 4

   Legacy markings

   Retired labels such as For Official Use Only and Sensitive But Unclassified had to be mapped to registry categories and re-marked during the transition.

5. 5

   Decontrol

   CUI is decontrolled when the basis for protection expires, for example, when a contract ends. The registry records which categories have mandatory decontrol events.

For a federal agency, and for the contractors and grantees that hold CUI on its behalf, the registry is the starting point of the classification workflow. Before information is marked, the organization finds the law, regulation or policy behind it. The basis field in each entry exists for that check.

The registry also sets the working rules. Staff choose the narrowest subcategory that fits, and if none fits, the information is not CUI, because agencies cannot invent their own categories. Markings are copied verbatim into documents, templates, and systems, and staff are trained on the categories they handle. Data classification and DLP tools are seeded with the registry categories. Inspectors, including those who check nonfederal systems against NIST SP 800-171, test whether CUI is marked consistently with the registry.

The registry covers only unclassified information. Anything that meets national security classification thresholds follows the separate classified system, not the CUI Registry. Not every sensitive document qualifies either. If no law, regulation or governmentwide policy requires protection, the information is outside the program, even if the agency would prefer to guard it.

The common mistakes all break these rules. Because the registry is public and versioned, the defense against them is the same: look up the subcategory.

• Inventing a local category: Use a registry subcategory; if none fits, it is not CUI
• Marking everything as CUI: Judge the real sensitivity of the information first
• Skipping decontrol: Decontrol when the basis for protection expires
• Copying markings unchecked: Check the registry entry before reusing a marking

Start with the information your organization actually holds, then match each group to a registry subcategory. Marking rules written before that step cannot be checked against the registry.