What is Controlled Unclassified Information (CUI)?

Controlled Unclassified Information (CUI) is information that is not classified but still requires protection or controlled handling under a law, regulation, or government-wide policy. It’s the large middle ground between fully public information and classified national security information.

A single standard

The CUI program, administered by the National Archives, replaced an inconsistent patchwork of agency labels — like “For Official Use Only” (FOUO) and “Sensitive But Unclassified” — with one standardized system. NARA maintains the official CUI Registry, which lists the approved categories (such as certain privacy, law-enforcement, tax, critical-infrastructure, and export-controlled information) and the handling rules for each.

CUI vs. classified

This is the key distinction:

• Classified information (Confidential, Secret, Top Secret) is protected under Executive Order 13526.
• CUI is unclassified — it never went through classification — but other laws or policies still require it to be controlled.

Treating them the same is a common error; CUI has its own marking, handling, and decontrol rules separate from the classification system.

Why it matters for records management

CUI is squarely a records concern. CUI records must be marked and handled per their registry category, protected with access controls (NIST SP 800-171 sets requirements when CUI lives in nonfederal systems, such as contractors’), and remain subject to normal retention and disposition. Much CUI also contains personally identifiable information, so CUI handling and privacy obligations frequently overlap. It’s one of the most common types of sensitive information agencies and contractors manage day to day.