Controlled Unclassified Information (CUI) Marking & Handling

At a Glance

Who it applies to

Any contractor that creates, receives, or handles CUI in performing a federal contract

What it obligates

Recognize, properly mark, safeguard, disseminate, and destroy CUI per the governmentwide standard

Governing authority

Executive Order 13556 and 32 CFR Part 2002 (NARA is the CUI Executive Agent)

The CUI Registry

NARA's public registry lists the CUI categories (e.g., Controlled Technical Information, Privacy, Procurement) and their handling rules

The stakes

Mishandling CUI breaches your safeguarding obligations (DFARS 7012 / CMMC) and can trigger incident reporting

What It Is

Controlled Unclassified Information (CUI) is the governmentwide category for information that is sensitive but not classified — information the government requires to be safeguarded or disseminated under a law, regulation, or governmentwide policy, but which isn't marked Confidential, Secret, or Top Secret. It was created by Executive Order 13556 (2010) and is implemented by 32 CFR Part 2002, with the National Archives and Records Administration (NARA) as the CUI Executive Agent. Before CUI, agencies used dozens of inconsistent labels — 'For Official Use Only' (FOUO), 'Sensitive But Unclassified' (SBU), 'Law Enforcement Sensitive,' and many others — with no common rules. The CUI program replaced that patchwork with a single system: a public CUI Registry (maintained by NARA) lists the approved categories — such as Controlled Technical Information, Privacy, Proprietary Business Information, Procurement and Acquisition, and Export Control — and the marking, handling, dissemination, and destruction rules for each. For a contractor, CUI matters because it's the thing all the safeguarding machinery is built to protect: the DoD calls the CUI it entrusts to contractors 'Covered Defense Information,' DFARS 252.204-7012 requires you to protect it to NIST SP 800-171, and CMMC Level 2 verifies that protection. Your obligations run to the full lifecycle: recognizing when information is CUI (often it should be marked, but you may also generate CUI yourself), marking it with the correct banner and category, storing and transmitting it only on properly safeguarded systems, sharing it only with those who have a lawful government purpose, and destroying it by approved means. In plain terms: CUI is the sensitive information; the safeguarding clauses and CMMC are how you're required to protect it.

When It Applies

• Whenever a contract requires you to handle information the government marks — or that meets a CUI category — such as controlled technical information.
• When you generate information in performance that itself qualifies as CUI (you may have to mark it).
• When storing, transmitting, sharing, or destroying CUI — each step has governmentwide handling rules.
• As the trigger that determines whether DFARS 252.204-7012 and CMMC Level 2 (vs. only FCI-level requirements) apply.

Key Features

The SDVOSB Angle

For a small SDVOSB, the most valuable CUI skill is simply recognizing it early, because whether a contract involves CUI is what flips your cybersecurity cost from cheap (FCI basics / CMMC Level 1) to expensive (NIST SP 800-171 / CMMC Level 2). Read the solicitation for a CUI or Covered Defense Information designation and any DFARS 7012 clause before you bid, and ask the contracting officer if it's ambiguous — discovering CUI obligations after award is a margin killer. Operationally, the single best move a small firm can make is to build a CUI 'enclave': keep CUI on a small, well-controlled subset of systems rather than letting it spread across every laptop and mailbox, so your safeguarding and CMMC assessment scope stays small and affordable. Mark and handle CUI exactly as the registry and your contract require, train the handful of employees who touch it, and flow the handling requirements to any similarly situated subcontractor who will receive it — a mishandling incident is both a compliance failure and, under DFARS 7012, a reportable event.

How to Comply

1. Check the solicitation and contract for a CUI / Covered Defense Information designation before you bid.
2. Consult NARA's CUI Registry to identify the category and its specific marking and handling rules.
3. Keep CUI in a small, controlled enclave rather than spread across all your systems.
4. Mark, store, transmit, share, and destroy CUI according to the registry and contract requirements.
5. Train the employees who handle CUI and flow the handling requirements to subcontractors who receive it.

Watch Out For

• Not recognizing CUI (including CUI you generate) and therefore under-scoping your safeguarding obligations.
• Letting CUI sprawl across every system, which balloons your NIST SP 800-171 / CMMC assessment cost.
• Mismarking or over-marking — both create compliance and dissemination problems.
• Improper destruction — CUI must be destroyed by approved methods, and mishandling can be a reportable incident.

Run the Numbers

Frequently Asked

Primary Sources

• 32 CFR Part 2002 — Controlled Unclassified Information
• Executive Order 13556 — Controlled Unclassified Information
• NARA CUI Registry

Plain-English reference, not legal advice. Cybersecurity and information-safeguarding rules are fact-specific and change often — the FAR, DFARS, NIST publications, and the CMMC program rule are amended and phased in over time. Always read the current FAR/DFARS text and the safeguarding clauses in your specific contract, check the version of NIST SP 800-171 your contract requires, confirm the SPRS and CMMC requirements with the contracting officer, and consult qualified counsel or a cybersecurity professional before relying on a compliance position or making a certification.

Related Safeguarding Requirements

Systems You’ll Use

Clauses That Apply

How It Plays by Contract Type

Terms Used on This Page

In the FAQ Knowledge Base