Controlled Unclassified Information

Definition

Controlled Unclassified Information is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. It is designated CUI and should be marked accordingly. CUI is protected at CMMC Level 2, not Level 1.

CUI is a higher-sensitivity category than FCI and carries far more requirements. Contractors often generate CUI themselves under a contract, not just receive it. Where a supplier's systems only handle FCI, the work sits in the Level 1 world and CUI is not part of it.

Term identity

Term

Controlled Unclassified Information (CUI)

Framework

CMMC · Level 1

Authority

32 CFR § 2002.4(h)