CUI is unclassified information a law, regulation, or Government-wide policy requires you to protect. Handling it puts you at CMMC Level 2.
Also called CUI, Controlled Unclassified Information.
Official Source Material
Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information (see paragraph (e) of this section) or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify.
Source: 32 CFR 2002.4(h), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
Your contract decides whether you have CUI, not your own reading of the data.
Controlled Unclassified Information (CUI) is a handling category, not a classification. The CMMC rule does not define it. 32 CFR 170.4 points to 32 CFR 2002.4(h), which is the definition this page quotes. A law, regulation, or Government-wide policy assigns CUI to specific kinds of information, and the CUI Registry kept by the National Archives lists those categories. CUI is narrower than Federal Contract Information, the contract information that is not for public release. Holding CUI is what raises a contract to Level 2. The safeguarding clause DFARS 252.204-7012 tells you that you must protect CUI, but it does not list categories. Your contract's statement of work, its data deliverables, and your customer's markings tell you what will arrive.
Settle ownership before you look at what the information says.
Start with who owns it. Information your company created and keeps in its own systems is not CUI to you. Next, read the data rights clauses in your contract. Under DFARS 252.227-7013 or 252.227-7014, the Government gets a license and you keep ownership, so the copy you keep stays yours. Under a clause that transfers ownership, such as DFARS 252.227-7020 or FAR 52.227-17, the deliverable belongs to the Government. Only then look for a law or regulation that controls the information, using the authorities listed for its category in the CUI Registry.
You are an authorized holder, not the designator.
Deciding that information is CUI is the Government's call. You cannot compare a file to the Registry and declare it CUI yourself. When something arrives unmarked, or marked in a way you cannot read, ask the sender in writing to name the category and its legal authority. Carry the CUI markings on what you receive forward unchanged. Mark your own output as CUI only when the contract directs you to.
Ask the contracting officer in writing when you cannot tell.
An email that asks whether a named deliverable or data set is CUI, and the written reply, settle a question your own judgement cannot. Keep both with your System Security Plan (CA.L2-3.12.4), the document that describes how your system meets each requirement. The exchange becomes the evidence for what you brought into scope and what you left out.
What falls short
A statement that you hold no CUI because nothing you received carried a marking, with no written question to the sender. A missing banner calls for a question, not a conclusion.
A banner your company stamped on its own documents with no contract direction. That claims a designating authority a contractor does not hold.
A scoping decision that rests on an employee's memory of what the prime said on a call. Nothing in writing supports it, and the assessor cannot verify it.
A scope built by matching CUI Registry category names against your files. A category names a kind of information, and the definition still requires that the information came from, or was created for, the Government.
Edge cases
You create test results for a deliverable built from CUI drawings. A report that repeats the drawing's requirements carries that CUI forward, so protect it the same way.
You deliver a design you own to the Government. The delivered copy becomes CUI in the Government's hands. The copy you keep stays yours, unless a clause in the contract transferred ownership.
A prime applies flow-down for the safeguarding clause but sends you nothing that is CUI. The clause text still flows to you. The certification requirement applies only when CUI actually reaches your systems. Ask the prime in writing what CUI the subcontract will involve, and keep the answer.
Your own export-controlled drawings, developed independently and never delivered to the Government. They are not CUI to you, because the definition above excludes information you hold in your own systems that never came from an agency. They are still export-controlled information, and those rules apply in full. Deliver a copy to the Government and that copy is CUI.
You hold older documents marked FOUO, For Official Use Only. That marking predates the CUI program and does not make a document CUI on its own. Judge the content against the categories your contract names, and ask the contracting officer when it matches one.
Over-engineering
A company-wide Level 2 build when CUI touches three people and one project. Scope the system to the assets that store, process, or transmit CUI, and separate the rest with documented network and access boundaries.
A paid classification and labeling suite bought to discover CUI. The contract and the CUI Registry tell you what is CUI. A written list of what you receive, from whom, and where it lives is enough for scoping.
Safes, vaults, and clearance checks for CUI. CUI is not classified. A locked office, an encrypted laptop, and access limited to the people working the contract meet the physical and access requirements.