Terms / What you protect
CUI Registry
The National Archives list of every approved CUI category, its marking, and the law behind it. It is the authoritative list, and it is public.
Also called the Registry, NARA CUI Registry.
Official Source Material
CUI Registry is the online repository for all information, guidance, policy, and requirements on handling CUI, including everything issued by the CUI EA other than this part. Among other information, the CUI Registry identifies all approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, establishes markings, and includes guidance on handling procedures.
Source: 32 CFR 2002.4(p), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
The Registry is the list that settles arguments about what counts.
The National Archives runs the CUI Program for the executive branch and publishes the Registry at archives.gov. Every approved category appears there with a description, a marking such as EXPT for Export Controlled, and the laws or regulations that authorize the control. If a category is not in the Registry, it is not a CUI category. Read it once for the categories your work touches. It takes an afternoon and it is free.
Read the authorities at the bottom of a category page, not only the description at the top.
The Registry lists the kinds of information that can be CUI. A category is not a checklist that makes a match CUI on its own. The laws and regulations cited on the page decide whether the category reaches your information. A report that mentions a vulnerability is not controlled just because a category title uses that word.
A category in the Registry tells you what kind of information is controlled, not that yours is.
This is the distinction small companies miss most often. The Registry lists Export Controlled as a category. That does not make every export-controlled document in your building Controlled Unclassified Information. The definition in 32 CFR 2002.4(h) turns on provenance: the Government created or possessed the information, or you created or possessed it for or on behalf of the Government. Confirm the provenance first. Then check whether a category's authority actually reaches the information.
Look at the Basic and Specified column, because it changes what you must do.
CUI Basic follows the uniform controls in 32 CFR Part 2002. CUI Specified carries handling controls written into the underlying authority, and those controls can be stricter. The Registry shows which authorities make a category Specified and what banner marking it carries. Export Controlled appears both ways depending on the authority, which is why two export-controlled documents can demand different handling.
What falls short
- A category name a prime used in an email, with no Registry entry behind it. Categories are approved and listed, so the entry is the thing to cite.
- A scoping list built from markings alone. The Registry describes the information, and agencies mark inconsistently.
- Treating every Registry category as relevant to you. Your contract and the work you perform narrow the list to a handful.
Edge cases
- A document carries a marking you cannot find in the Registry. Legacy markings are void under 32 CFR 2002.20(a)(2), so judge the content and ask the originator what authority applies.
- Your contract names a category that seems unrelated to your deliverable. Ask the contracting officer in writing which data set it attaches to. Contract templates carry categories forward from other programs.
- The Registry entry lists several authorities with different banner markings. Use the marking the designating agency applied, and ask when the document carries none.
Over-engineering
- A tool that scans your files against every Registry category. The categories your contract names are the ones that matter, and a written list of what you receive does the work.
- A copy of the Registry maintained in your own documentation. It changes without notice, so cite the category and link to the live page instead.