Controlled Unclassified Information (CUI) Definition
Controlled unclassified information (CUI) is information the U.S. government creates or possesses that requires safeguarding or dissemination controls under law, regulation, or government-wide policy, but that is not classified under Executive Order 13526 or the Atomic Energy Act. In short, it's sensitive-but-unclassified data that can't be released publicly without review.
The CUI Program was established by Executive Order 13556 and implemented through 32 CFR Part 2002, with the National Archives (NARA) serving as Executive Agent. It replaced a patchwork of inconsistent agency-specific labels like "For Official Use Only" with one standardized system for designating, marking, safeguarding, and decontrolling sensitive information. CUI is organized into categories, such as controlled technical information, privacy data, and export-controlled information, catalogued in the CUI Registry.
What is the difference between CUI Basic and CUI Specified?
Who is responsible for protecting CUI?
Responsibility is layered rather than held by one party. At the top, the CUI Executive Agent, NARA, through its Information Security Oversight Office, oversees the government-wide program and sets baseline rules. Each federal agency designates a Senior Agency Official to implement the program internally; for defense work, the DoD does this through DoD Instruction 5200.48. At the operational level, responsibility falls to authorized holders: any individual, organization, or group permitted to designate or handle CUI. For contractors, this obligation becomes binding once CUI requirements are incorporated into a contract, typically via clauses like DFARS 252.204-7012. Notably, if you create a document under a DoD contract, determining whether it's CUI and applying the correct markings is your responsibility, not the government's.
Who can decontrol CUI?
Decontrol authority rests with the designating agency, the federal executive branch agency that originally applied or approved the CUI designation. Within that structure, three parties typically hold authority: the information's originator, the original classification authority (OCA) when the information falls under a classification guide, and designated decontrol offices. Critically, contractors cannot decontrol CUI themselves; they can request it, but only the designating agency can remove the designation. Decontrol happens either automatically (a preset date or event arrives, the governing law changes, or the agency publicly releases the information under FOIA) or through positive decontrol, an active agency decision. One common misconception: decontrol removes CUI handling requirements but does not authorize public release.