Controlled Unclassified Information (CUI) Explained

Not all sensitive government information is classified. A large category sits between fully public and classified: Controlled Unclassified Information (CUI) — information that is unclassified but still requires safeguarding or dissemination controls under law, regulation, or government-wide policy.

What CUI is

CUI replaced a patchwork of inconsistent agency markings (like “For Official Use Only” / FOUO and “Sensitive But Unclassified”) with a single, standardized program. It covers categories such as certain privacy, law enforcement, financial, critical-infrastructure, and export-controlled information. The program is administered by the National Archives, which maintains the official CUI Registry of approved categories and handling rules.

How it differs from classification

• Classified information (Confidential, Secret, Top Secret) is protected under Executive Order 13526 and the classification system.
• CUI is unclassified — it never went through classification — but still requires controlled handling because other laws or policies demand it.

Treating the two the same is a common mistake: CUI has its own marking, handling, and decontrol rules, separate from the classification system.

CUI and records management

CUI is squarely a records and information management concern:

• Marking and handling — CUI records must be marked and handled per the registry category, with appropriate access controls.
• Safeguarding — protecting CUI often overlaps with privacy and security obligations; much CUI contains PII.
• Systems — when CUI lives in nonfederal systems (e.g., contractors), NIST SP 800-171 sets the security requirements for protecting it.
• Retention and disposition — CUI records are still subject to retention schedules and defensible disposition like any other record.

Why it matters

CUI is one of the most common types of sensitive information agencies and their contractors handle day to day. Getting it right — consistent marking, controlled access, and disposition on schedule — is a core part of trustworthy recordkeeping, and a frequent audit and compliance focus. See the declassification and classified records hub for related topics.