Reference · Cybersecurity & CMMC
CUI
Controlled Unclassified Information
Controlled Unclassified Information (CUI) is government-created or -owned information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy — but is not classified. Protecting CUI on contractor systems is what triggers NIST SP 800-171 and CMMC obligations.
What it is
CUI is a government-wide category established by Executive Order 13556 (2010) to standardize how sensitive-but-unclassified information is marked and handled. The National Archives' Information Security Oversight Office (ISOO) maintains the CUI Registry of categories — for example Controlled Technical Information, Export Controlled, and Privacy.
Why it exists
Before CUI, agencies used dozens of inconsistent markings (FOUO, SBU, and others). EO 13556 and 32 CFR Part 2002 replaced them with one framework so information is handled consistently across agencies and contractors. For the Department of Defense, DoDI 5200.48 implements it.
Who it applies to
Any contractor that stores, processes, or transmits CUI on its own information systems. That obligation flows down through DFARS 252.204-7012, which requires NIST SP 800-171 protection of covered defense information — a subset of CUI.
Frequently asked
Is CUI classified information?
No — CUI is explicitly unclassified. It is unclassified information that still requires safeguarding or dissemination controls under law, regulation, or government-wide policy. If information is classified (Confidential, Secret, or Top Secret), it is not CUI.
Related terms
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.