Glossary

Controlled Unclassified Information (CUI)

Controlled Unclassified Information (CUI) is information the United States government creates or possesses — or a contractor handles on its behalf — that is not classified but still requires safeguarding under law, regulation, or government-wide policy. For contractors it is a trigger: CUI in your systems is what activates NIST SP 800-171 obligations and CMMC assessment.

Assemble Your GRC Team

Last updated July 26, 2026

What counts as CUI

CUI is a defined category, not a judgment call: the government maintains a registry of qualifying information types — controlled technical information, export-controlled data, certain personnel, procurement, and law-enforcement records — and marks documents accordingly. For a contractor the practical question is narrower: which of our systems store, process, or transmit it? That scoping exercise decides which environments carry federal obligations and which stay ordinary commercial infrastructure, so it is worth doing precisely rather than defensively assuming everything is in scope.

The obligations that follow it

Once CUI lands in a system, safeguarding duties attach to that system and everything connected to it. For defense contractors the chain is explicit: contract clauses require protecting CUI to the standard in NIST SP 800-171 — the National Institute of Standards and Technology’s control set for nonfederal systems — and the Cybersecurity Maturity Model Certification (CMMC) program now verifies that protection, with most CUI-handling contractors required to pass an assessment by a C3PAO rather than self-attest.

Scoping before certifying

The cheapest CMMC work happens before any control is implemented: shrinking where CUI can live. Contractors that confine it to an enclave — a bounded set of systems, tools, and cleared people — assess a small footprint; contractors that let it spread through email, laptops, and shared drives end up certifying the whole company. Agency starts federal engagements with exactly that data-flow mapping, then designs the boundary; the practice is described under vCISO for government contractors.

Keep exploring

CMMC 2.0

The program that verifies CUI protection — levels and assessment paths.

NIST SP 800-171

The control set CUI handling obligates you to meet.

vCISO for Government Contractors

Scoping, remediation, and assessment prep under named security leadership.

Government

Know exactly where CUI lives

Agency maps the data flows, shrinks the boundary, and builds the program that protects what remains. 1,000+ companies served since 2021.

Assemble Your GRC Team