What is CUI?
Sensitive unclassified information that requires protection.
Controlled Unclassified Information: CUI Marking & Protection Guide
Learn what CUI is, why it matters for defense contractors, and how to mark CUI documents, devices, media, work areas, and facilities.
What Is Controlled Unclassified Information (CUI)?
Controlled Unclassified Information is unclassified information that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy.
CUI is not classified information—but it is not public information either.
DESIGNATION INDICATOR
Illustrative example
Illustrative example
CUI in 30 Seconds
Who handles it?
Government agencies, contractors, subcontractors, and other authorized organizations.
Where can it exist?
Documents, digital systems, removable media, equipment, workspaces, and physical facilities.
Why does it matter?
Once information is properly identified as CUI, applicable safeguarding and dissemination requirements must be followed.
What Can CUI Look Like?
Engineering drawingsTechnical dataManufacturing informationTesting informationProcurement informationProgram informationControlled technical informationExport-controlled information (when applicable)SpecificationsResearch informationCertain personally identifiable informationGovernment-provided contract information
Context matters. Information is not automatically CUI simply because it relates to a government or defense program. The applicable authority, contract, source, category, and government/customer guidance matter.
CUI vs. Classified vs. FCI
| Topic | CUI | Classified Information | FCI |
|---|---|---|---|
| Is it unclassified? | Yes | No | Yes |
| Requires protection? | Yes – safeguarding and dissemination controls per law, regulation, or government-wide policy | Yes – under the national security classification system | Yes – basic safeguarding under FAR 52.204-21 |
| Common contracting relevance | DFARS 252.204-7012 and contracts identifying CUI | Contracts requiring a facility clearance, DD Form 254 | Federal contracts not intended for public release |
| Typical examples | Controlled technical information, export-controlled data, certain PII | Information designated Confidential, Secret, or Top Secret | Contract details, internal pricing, and non-public information provided by or generated for the government |
| Relationship to CMMC | Generally CMMC Level 2 or higher | Handled under separate classified security programs, not CMMC | Generally CMMC Level 1 |
Simplified overview. Always follow your contract and government guidance.
Does My Organization Have CUI?
Working with the federal government or Defense Industrial Base does not automatically mean every piece of information your company handles is CUI. Organizations should consider:
- Contract requirements
- Government/customer markings
- The source of the information
- Applicable CUI categories
- Information generated during contract performance
- Government or contracting activity guidance
Follow CUI Through Your Facility
One of the easiest ways to understand your physical CUI environment is to follow where CUI enters, is created, viewed, printed, stored, moved, and destroyed.
- 1Receive
- 2Create
- 3View
- 4Print
- 5Store
- 6Move
- 7Destroy
Where could an unauthorized person see the information?
Where could CUI be misidentified or mishandled?
Where could information accidentally leave the controlled environment?
How Is CUI Marked?
Official marking requirements apply to the information itself. Depending on the situation, they may apply to:
DocumentsDigital filesEmailsRemovable mediaPackages or containersOther information-bearing media
CUI banner markings
The control marking placed at the top (and commonly bottom) of CUI documents.
Designation indicator blocks
Identifies the designating agency or organization and point of contact, as required by applicable guidance.
Dissemination controls
Limited dissemination control markings, used only where applicable.
Official CUI media labels
Such as agency-approved labels for removable media, where applicable.
Marking requirements vary by media, agency, and contract. Not every situation uses the same marking—follow applicable DoD/agency guidance.
Official Markings vs. Physical Visual Controls
Official or Standardized CUI Markings
- Document banner markings
- Designation indicator blocks
- Approved CUI media labels where applicable
- Required dissemination markings
Physical & Visual Controls That Can Support a CUI Program
- Controlled-area signage
- Visitor identification
- Printer/scanner identification
- Storage identification
- Asset identification
- Floor or boundary controls
- Destruction-area notices
- Workstation reminders
Supplemental physical controls can help organizations communicate handling expectations and support consistent safeguarding procedures, but they should not be presented as universal federal marking requirements.
CUI Doesn't Live Only on a Computer
Documents
Paper records, drawings, reports, printed technical information
View related CUI solutions →Devices & Digital Media
Computers, removable drives, external media
View related CUI solutions →Printers & Scanners
Devices used to print, copy, or scan CUI
Read the printer & scanner guide →Workstations
Desks, screens, and work areas where CUI is accessed
Read the workstation guide →Storage
File cabinets, rooms, containers, and secure storage areas
View related CUI solutions →Controlled Areas
Rooms, labs, production areas, and engineering areas
View related CUI solutions →Visitors & Personnel
Visitor access, escort procedures, and personnel identification
View related CUI solutions →Destruction & Disposal
Shredding, destruction containers, and approved disposal workflows
View related CUI solutions →CUI Destruction
CUI that still requires safeguarding should not enter ordinary trash or recycling. When CUI is destroyed, the method should render the information unreadable, indecipherable, and irrecoverable in accordance with applicable requirements.
Do CUI destruction containers need to be marked? →Ready to Apply This to Your Facility?
Walk through where CUI is created, viewed, printed, stored, transported, and destroyed, then build a physical marking and visual-control system around your actual workflow.
Frequently Asked Questions
Controlled Unclassified Information.
No. CUI is unclassified, but it still requires safeguarding or dissemination controls under law, regulation, or government-wide policy.
The government. Agencies designate CUI based on categories in the NARA CUI Registry, and contracts and customer guidance tell contractors what is CUI.
No. It depends on your contracts, the information you receive or create, and government guidance.
Use the Do I Have CUI? checklistYes. Information a contractor creates or possesses for the government under a contract may be CUI when it falls within a CUI category.
Learn where CUI originatesNo. CUI can exist on paper, removable media, equipment, and in physical workspaces.
Generally, yes. CUI should be marked according to applicable CUI program and agency guidance; required markings vary by media and situation.
Read the CUI marking guideNot universally. Signage is a supplemental control that can help communicate controlled areas and support handling procedures, depending on your environment and requirements.
Learn about CUI zonesThe SF-901 is the standard CUI cover sheet, which may be used to shield CUI documents from unauthorized view.
Learn about SF-901 useThe SF-902 is a standard form label for identifying media containing CUI. Agencies may also use other approved CUI labels; follow your agency and contract guidance for which to use.
No. CUI that still requires safeguarding must be destroyed so it is unreadable, indecipherable, and irrecoverable.
Any area where an organization has adequate physical or procedural controls to protect CUI from unauthorized access or disclosure.
FCI is non-public information provided by or generated for the government under a contract. CUI is a narrower set of information that falls within a CUI category and requires added safeguarding.
Continue Learning
Do I Have CUI?
Learn how to identify whether the information you handle is actually CUI.
Start the checklistHow to Mark CUI
Understand markings for documents, media, and applicable marking practices.
Read the marking guideWhat Is a Controlled Environment?
Explore the physical spaces where CUI is handled and protected.
Learn about CUI zonesHow to Protect Physical CUI
Documents, devices, visitors, storage, printers, and disposal.
Start your physical CUI programOfficial CUI Resources
CUI Supply's educational content is built on primary government and standards sources.
NARA CUI RegistryDoD CUI ProgramDoD CUI Marking & Identification Guidance32 CFR Part 2002NIST SP 800-171Last reviewed: September 2026
Our Partners
We’re proud to partner with these outstanding organizations that have supported our online events, contributed valuable information to our blog, and inspired the development of our products.
- Choosing a selection results in a full page refresh.
- Opens in a new window.