Resources / What is CUI
What Is CUI, and Do IHandle It?
Last reviewed: October 14, 2026
Controlled unclassified information (CUI) is information the U.S. government creates or possesses, or that a company holds for the government, that law, regulation or government-wide policy says must be safeguarded or have its distribution limited. It is not classified. If a defense customer gives you CUI or has you create it for them, you must protect it, and CMMC is how DoD checks that you do.
Who decides what is CUI?
The government does. The CUI program was created by Executive Order 13556, run by the National Archives and Records Administration, and set out in federal regulation 32 CFR Part 2002. Agencies designate information as CUI under categories in the CUI Registry. See NARA’s CUI program page. A company cannot make something CUI by labeling it, and information a company created and keeps for its own purposes is generally not CUI.
What does CUI look like in defense work?
Typical examples in the defense supply chain include technical drawings and specifications a customer gives you, export-controlled technical data, and information about how a system is built or operated. The CUI Registry lists the official categories, and your customer’s contract or statement of work should identify which apply.
Five questions that tell you whether you handle CUI
- Does your contract include DFARS 252.204-7012? That clause applies to systems that handle covered defense information, so it is a strong signal.
- Does anything you receive carry a CUI marking? A banner or footer reading CUI or CONTROLLED is a clear sign. Missing markings do not prove you are in the clear, so keep going.
- Does your customer send drawings, specifications or technical data that are not public? If so, ask what category applies.
- Do you create technical data for a customer, such as test results or designs built to their requirements? Information created for the government can be CUI.
- Has a prime contractor asked for your CMMC level or your SPRS score? That usually means they believe CUI or contract information flows to you.
If you answer yes to any of these, ask your customer in writing which of your information is CUI and which systems and people touch it. Keep the answer. It becomes the starting point for your scope.
Why it matters: scope
Every system, person and vendor that stores, processes or transmits CUI is in scope for assessment. Mapping where CUI actually goes often shows it can be contained in far fewer places than people assume, and that lowers the cost of compliance. See CUI scoping and enclave design.
Frequently asked questions
Is CUI the same as classified information?
No. CUI is unclassified but still controlled, and it needs a lower level of protection than classified information.
Is all information a defense customer sends me CUI?
No. Only information designated under a CUI category is. Ask your customer rather than guess.
What happens if I handle CUI and do nothing?
You risk losing contracts that require CMMC, and you may breach contract clauses such as DFARS 7012.
Not sure whether you handle CUI?
Call 877-855-CMMC or email [email protected]. Related: CMMC for subcontractors, CMMC readiness.