What is the difference between a CUI marking and a FOIA exemption when deciding what to release?

A CUI marking and a FOIA exemption are easy to confuse because both touch on sensitive information, but they answer different questions and operate at different stages. One is a handling label applied inside an agency; the other is a legal basis for withholding records from the public. Understanding the distinction keeps agencies from over-withholding and helps requesters know what to expect.

What a CUI marking is

Controlled Unclassified Information is a government-wide program for marking and safeguarding unclassified information that still requires protection under a law, regulation, or government-wide policy. A CUI marking tells employees and contractors how to handle, store, and share the information internally. It is an information-management control, not a release decision.

Crucially, a CUI marking does not by itself mean information must be withheld from the public. Markings are about safeguarding while the information is in the agency’s custody.

What a FOIA exemption is

A FOIA exemption is a statutory category that allows an agency to withhold specific information in response to a public records request. The Freedom of Information Act presumes disclosure, and exemptions are the narrow, legally defined grounds for holding records back. Each exemption must be applied to the specific content at issue, and reasonably segregable non-exempt portions are still released.

How they relate when deciding what to release

• A CUI marking is a flag, not a verdict. It signals that the information may be sensitive, but the releasing official must still make an independent FOIA determination.
• The exemption analysis is what governs release. The agency asks whether the requested information actually falls within a FOIA exemption, regardless of any marking.
• Marked information may still be releasable. If no exemption applies, marked material can be disclosed.
• Unmarked information may still be exempt. The absence of a CUI label does not waive a valid exemption.

In short, CUI tells staff how to protect information; FOIA exemptions tell the agency whether the law permits withholding it from a requester. The marking can inform the review, but it never substitutes for the exemption analysis.

For more on disclosure rules and request handling, see the FOIA and public records hub.