Terms / Scope and assets
CUI asset
An asset that can process, store, or transmit CUI. These are assessed against all 110 Level 2 requirements, so the count drives your cost.
Also called CUI assets, Controlled Unclassified Information asset.
Official Source Material
Controlled Unclassified Information (CUI) Assets means assets that can process, store, or transmit CUI.
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
A CUI asset is assessed against every Level 2 requirement, so count them carefully.
This is the most expensive category in table 3 to 170.19(c)(1). Each of these assets is documented in your asset inventory, described in your system security plan, drawn on your network diagram, and assessed against all 110 requirements. The number of CUI assets is the single biggest driver of how long an assessment takes.
Process, store, and transmit each mean something specific, and the rule defines them.
Process means the information can be used by the asset: accessed, entered, edited, generated, manipulated, or printed. Store means the information is at rest on it, including on paper. Transmit means the information moves through it. An asset that does any one of the three is a CUI asset. That third one catches network equipment and mail services people forget.
A printer is a CUI asset, and so is the phone that opens the mailbox.
The category follows the information rather than the importance of the device. A multifunction printer that prints a controlled drawing processes and often stores it. A personal phone with the work mailbox on it transmits and stores. Walk the actual path your information takes and write down every device it touches, including the ones nobody thinks of as computers. SC.L2-3.13.16 asks you to protect the information wherever it rests.
An asset that only could touch the information belongs in a different category.
If an asset can but is not intended to handle controlled information, and your policies and practices keep it away, it is a contractor risk managed asset instead. The distinction is intent plus documented practice. Use it honestly. An assessor who doubts the documentation may run limited checks on those assets anyway.
What falls short
- An inventory that lists servers and laptops but no printers, scanners, or mobile devices. The definition turns on the information, and those devices handle it.
- A claim that a mail service is out of scope because nothing is stored there. Transmitting is enough on its own.
- A backup service left off the list. Backups store the information, so the service holding them is in scope.
Edge cases
- A device can reach the information but policy forbids it, and the policy is written and followed. That is the contractor risk managed category, not this one.
- An asset can handle the information but cannot be fully secured, such as a machine tool controller. That is a specialized asset, which is documented rather than fully assessed.
- A cloud service holds the information. The service is delivered by an external service provider, and its treatment follows table 4 to 170.19(c)(2)(i).
Over-engineering
- Replacing working equipment because it is old. The requirements ask you to secure the asset, not to modernize it.
- Treating every asset as a CUI asset to be safe. That is the most expensive scoping decision available, and the categories exist to prevent it.