Information May Be Cui In Accordance With

Information may be CUI in accordance with federal directives that define how certain unclassified data must be protected when it possesses a sensitive nature despite lacking a classified status. Understanding when and why information falls under the Controlled Unclassified Information (CUI) umbrella is essential for government contractors, academic researchers, and private‑sector partners who handle data on behalf of the United States government. This article explains the concept of CUI, outlines the legal and regulatory framework that governs its designation, provides practical steps for identifying CUI, and describes the safeguards required to keep such information secure.

What Is Controlled Unclassified Information (CUI)?

Controlled Unclassified Information refers to information that the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, which requires safeguarding or dissemination controls consistent with applicable laws, regulations, and government‑wide policies, but is not classified under Executive Order 13526 or the Atomic Energy Act. In short, CUI is unclassified yet sensitive enough to warrant specific handling procedures.

Key characteristics of CUI

• It is not classified as Confidential, Secret, or Top Secret.
• It is subject to specific safeguarding or dissemination controls mandated by law or regulation.
• It can exist in any format—electronic, paper, oral, or visual.

Legal and Regulatory Foundations

The modern CUI program stems from a series of directives aimed at standardizing the protection of sensitive but unclassified information across the federal enterprise.

Executive Order 13556 (2010)

Executive Order 13556, “Controlled Unclassified Information,” established the CUI program and tasked the National Archives and Records Administration (NARA) with:

1. Designating a CUI Registry that lists all approved CUI categories and subcategories.
2. Issuing CUI Marking Handbook guidance for consistent labeling.
3. Overseeing the implementation of the program across federal agencies.

NARA’s CUI Registry

The CUI Registry is the authoritative source that defines what qualifies as CUI. It organizes information into 20 basic categories (e.g., Privacy, Proprietary, Critical Infrastructure) and numerous subcategories that reflect specific statutory or regulatory authorities.

Supporting Regulations and Standards

• Federal Acquisition Regulation (FAR) Clause 52.204-21 requires contractors to safeguard CUI in accordance with NIST SP 800-171.
• NIST Special Publication 800-171 (“Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”) provides the technical security requirements for protecting CUI.
• DFARS Clause 252.204-7012 extends these requirements to defense contractors, mandating incident reporting and cybersecurity maturity model certification (CMMC) alignment.

These documents collectively answer the question: information may be CUI in accordance with which authorities? The answer is any federal law, regulation, or government‑wide policy that NARA has incorporated into the CUI Registry.

Determining When Information May Be CUI

Identifying whether a particular piece of information qualifies as CUI involves a systematic analysis. The following steps help organizations make that determination reliably.

Step 1: Verify the Source

Ask whether the information originated from, was created for, or is being used on behalf of a U.S. federal agency. If the answer is no, the information is unlikely to be CUI unless it falls under a specific statutory provision that applies to private entities (e.g., certain export control data).

Step 2: Check for a Governing Authority

Look for any law, regulation, or government‑wide policy that explicitly mandates protection of the information. Examples include:

• The Privacy Act of 1974 (protects personally identifiable information).
• Section 1512 of the Homeland Security Act (protects critical infrastructure information).
• Export Administration Regulations (EAR) and International Traffic in Arms Regulations (ITAR) (protect export‑controlled technical data). If such an authority exists, the information is a candidate for CUI designation.

Step 3: Consult the CUI Registry

Search the NARA CUI Registry for the relevant category and subcategory that matches the authority identified in Step 2. The registry provides:

• The official CUI designation (e.g., CUI//SP-PRIVACY).
• Required marking conventions.
• Applicable safeguarding or dissemination controls.

If a match is found, the information may be CUI in accordance with that authority.

Step 4: Apply Marking and Handling Instructions

Once confirmed, apply the appropriate CUI markings according to the CUI Marking Handbook. Markings typically appear as a banner header and footer on documents, or as metadata tags in electronic systems. Proper marking ensures that downstream recipients understand the handling obligations.

Categories and Subcategories of CUI

The CUI Registry organizes information into the following high‑level categories (examples only; the full list contains 20 categories):

| Nuclear | Information related to nuclear materials or facilities that is not classified. | Nuclear facility security plans | | Defense | Information concerning defense capabilities, plans, or operations not classified. | Defense contractor bid information | | Personnel | Information about federal employees or contractors requiring protection. | Personnel security clearance records | | Transportation | Sensitive data related to transportation security or infrastructure. | Vulnerable transit system schematics | | Security | Information related to physical or cybersecurity vulnerabilities. | Critical infrastructure threat assessments |

The Imperative of Proper CUI Handling

Mismanagement of CUI carries significant consequences. Unauthorized disclosure can lead to:

• National Security Risks: Compromising sensitive defense, intelligence, or critical infrastructure information.
• Privacy Violations: Exposing protected personal or health information.
• Economic Harm: Revealing proprietary business data or trade secrets.
• Legal Repercussions: Violations of federal statutes like FERPA, HIPAA, or export control laws.
• Loss of Public Trust: Eroding confidence in government and contractor handling of sensitive information.

Agencies and contractors must implement robust safeguards, including access controls, encryption, auditing, and comprehensive training for personnel handling CUI. The CUI Program's standardized framework ensures consistent protection across the federal government and its partners.

Conclusion

Identifying and managing Controlled Unclassified Information is a critical responsibility for federal agencies and their contractors. By systematically applying the four-step process—identifying the governing authority, consulting the CUI Registry, applying proper markings, and adhering to handling requirements—organizations can ensure sensitive information receives the appropriate level of protection. The CUI Registry provides the essential structure, defining categories and subcategories based on specific legal authorities and mandating clear safeguarding measures. Ultimately, the effective implementation of the CUI Program is vital for safeguarding national security, protecting individual privacy, preserving proprietary interests, and maintaining public trust in the responsible stewardship of sensitive government information. It represents a crucial layer of protection, bridging the gap between publicly accessible data and highly classified national security secrets.