Controlled Unclassified Information

Definition

Controlled Unclassified Information is information that the Government, or a contractor acting for or on behalf of the Government, creates or possesses and that a law, regulation, or government-wide policy requires to be safeguarded or handled with dissemination controls. It is designated CUI and should be marked accordingly. CUI is protected at CMMC Level 2, not Level 1.

CUI is a higher-sensitivity category than FCI and carries far more requirements. Contractors often generate CUI themselves under a contract, not just receive it. Where a supplier's systems only handle FCI, the work sits in the Level 1 world and CUI is not part of it.

Term identity

Term

Controlled Unclassified Information (CUI)

Framework

CMMC · Level 1

Authority

32 CFR § 2002.4(h)