CUI examples are not simply files containing personal data, proprietary information, or legacy FOUO markings. A document qualifies only when an authority requires safeguards or dissemination controls. Its handling must also align with an ISOO CUI Registry category.
Controlled Unclassified Information (CUI) is not a catch-all label for sensitive data. Rather, it is unclassified information that a law, regulation, or government-wide policy requires agencies to safeguard or control. These controls fall under 32 CFR Part 2002.
Decide whether a file is actually CUI
CUI is an authority-based designation.
Documents that may qualify as CUI
The following are potential examples, not automatic classifications. The originating agency, contract language, applicable authority, and information context determine the final designation.
| Potential document or data | Possible CUI category | Why it may qualify | Verification needed |
|---|
| DoD design drawings and manufacturing specifications | Controlled Technical Information | Technical content may need controls under acquisition or DoD policy. | Contract clause, issuer marking, and Registry category. |
| ITAR-controlled design package | Export Controlled Information | Export restrictions can require controlled dissemination. | ITAR authority, agency direction, and export classification. |
| Pre-award source-selection material | Procurement and Acquisition | Disclosure could compromise a federal acquisition process. | FAR context, authority, and source agency instructions. |
| Agency investigative case records | Law Enforcement | The record may be restricted by statute or regulation. | Record owner, applicable authority, and dissemination limits. |
CUI Basic has no control requirements beyond the CUI Program. CUI Specified has added controls set by its underlying authority. Contractors should not assume every export, technical, or acquisition file is CUI. They must validate the authority first.
Data often mislabeled as CUI
PII, PHI, trade secrets, and Federal Contract Information may need protection. However, they do not automatically become CUI.
| Sensitive item | Normally CUI? | What governs it instead or also |
|---|
| Employee HR file with ordinary PII | No, unless an applicable CUI authority applies. | Privacy law, company policy, state breach rules. |
| Legacy FOUO-marked document | Not automatically. | Originating agency review and current marking guidance. |
| Supplier pricing or internal business plan | Usually no. | NDA, trade-secret law, and commercial controls. |
| Classified national security material | No, it is a separate regime. | Classified information rules and security classification guidance. |
Apply the four-part test
A defensible CUI decision answers four questions: Who originated the information? What authority mandates controls? Which Registry category or subcategory fits? Who may designate or decontrol it?
Decision record to retain: Record the source and owner, contract or agency instruction, Registry category, authority citation, and marking decision. Also record approved locations and permitted access roles. This record makes later audit and incident decisions traceable.
Separate CUI from FOUO, PII, and FCI
Similar labels do not create identical duties.
FOUO was a legacy marking used by several agencies before the CUI Program standardized many handling practices. A FOUO label may signal sensitive content, but the current owner must decide whether it maps to CUI, another regime, or decontrol.
PII and PHI need separate analysis
Personally Identifiable Information becomes CUI only when an applicable authority and Registry category support that result. Ordinary employee contact lists or customer records may need encryption, access controls, and retention controls. However, those measures do not establish a CUI designation.
Sensitive data can require protection without becoming CUI.
FCI is not always CUI
Federal Contract Information is information given by or created for the government under a contract. It is not intended for public release. It may need protection under the Federal Acquisition Regulation without meeting the CUI authority-and-category test.
For DoD contractors, DFARS 252.204-7012 matters when covered defense information is involved. Covered defense information includes CUI that needs safeguards or dissemination controls. A contract population can contain both FCI and CUI.
Classified data follows another path
Confidential, Secret, and Top Secret information are classified national security information. They are not CUI. They follow separate classification, storage, transmission, personnel, and facility rules.
Verify CUI before setting system scope
Verification must come before technical scoping.
For a potential CUI file, identify the source, contract or agency instruction, data type, and governing authority. Then search the Registry for the matching category or subcategory. Record why the content fits that category.
Use the registry as an evidence trail
Capture the authority citation and issuer handling direction in the data classification record. This makes the decision reviewable during a DCSA assessment, internal audit, or CMMC readiness review.
The Registry should support each designation decision.
Scope every processing location
A CUI boundary includes more than the main document repository. It can include endpoints, email archives, backup sets, print queues, and ticketing platforms. It can also include SIEM logs, collaboration channels, integration caches, and remote-support tools.
These systems are in scope when they process, store, or transmit the data. For DoD programs, map these flows to NIST SP 800-171 requirements. Apply NIST SP 800-172 where the contract requires it.
NIST SP 800-207 can guide a Zero Trust Architecture. It supports continuous verification, least privilege, identity and access management, microsegmentation, and security monitoring.
Avoid a false “CUI enclave” boundary
An enclave can reduce scope only when technical controls constrain and prove data flows. If users download CUI to unmanaged endpoints, the effective boundary expands. The same is true when they send CUI through personal email.
When contract terms, legacy markings, and agency instructions conflict, authoritative sources should control the final decision. Start with 32 CFR Part 2002 for federal CUI Program rules. Then verify the category, subcategory, authority, and marking format in the ISOO CUI Registry.
DoD contractors should also review DoDI 5200.48 and applicable contract clauses. They should review relevant NIST guidance, including NIST SP 800-171.
These sources distinguish valid CUI designations from company-created sensitivity labels. They also confirm controls for a given system or transfer.
Read markings as access instructions
A CUI banner directs handling.
A marking such as CUI//SP-CTI identifies CUI and Specified Controlled Technical Information. Other category markings can further limit recipients, storage locations, or transmission methods. Limited dissemination controls and agency notices can also impose limits.
Receive and store CUI safely
When receiving potential CUI, preserve sender markings and restrict access during verification. Keep the original transmission context. Do not forward the file to personal email, consumer cloud storage, unmanaged removable media, or unapproved AI services.
Do not treat encryption as proof of authorization.
Share and destroy with traceability
Before sharing, verify the recipient's need to know, authorization, approved channel, and dissemination controls. Encryption alone does not authorize a channel. The account, tenant, endpoint, and retention settings must remain inside the approved boundary.
- Receive: Retain markings and identify the owner before redistribution.
- Store: Place verified CUI only in approved repositories within the documented boundary.
- Share: Confirm recipient authorization, dissemination limits, and approved transmission.
- Transmit: Protect data in transit and prevent uncontrolled copies in personal or consumer services.
- Destroy: Follow retention and sanitization rules across primary, backup, and endpoint copies.
This guidance does not replace an agency determination, contract requirement, security official, or legal advice. It does not apply to formally classified information, which follows separate rules. It also does not apply to commercial sensitive information without an applicable CUI authority.
Read each CUI marking element separately. Do not treat the banner as a generic warning. In CUI//SP-CTI, CUI identifies Controlled Unclassified Information. SP means CUI Specified, and CTI identifies the Controlled Technical Information category.
A banner such as CUI//SP-CTI//NOFORN includes a limited dissemination control. NOFORN bars release to foreign persons or governments without authorization. The category identifies the information type. The authority and dissemination control determine handling limits.
Personnel should preserve issuer-applied markings. Consult the Registry or information owner before changing, removing, or creating a marking.
Frequently asked questions
What are examples of CUI?
Examples include controlled technical drawings, export-controlled specifications, certain acquisition records, and restricted investigative records. Each item qualifies only with an applicable authority, Registry category, and valid issuer context.
Is PII automatically CUI?
No, PII is CUI only when a specific authority and CUI Registry category apply. Ordinary employee or customer PII may still need privacy, encryption, and breach-response controls.
Is FOUO the same as CUI?
No, FOUO is not automatically CUI under the current federal program. The originating agency must decide the record's current status and required marking.
Can I store CUI on my personal computer?
Usually no, because personal devices rarely belong to an authorized CUI environment. Storage is allowed only when the device, account, network, and operating procedures meet agency and contract requirements.
What matters most:- CUI requires an applicable authority and Registry-supported category, not merely sensitive content.
- FOUO, PII, PHI, proprietary data, FCI, and classified information need separate analysis.
- Scope includes every endpoint, copy, log, backup, integration, and channel handling verified CUI.
- Markings define access and handling conditions, so validate them before sharing or storing a file.
Related sources
These articles can help you explore the topic in more depth:
