It’s Monday of your first week at Odapeeka Precision Works. Renee Ruiz, who runs operations and compliance, hands you a badge and says, “Before you touch anything with a Harrow & Vale part number on it, you need to know what CUI is.” This is that conversation.
By the end of this lesson you will be able to: explain what CUI is, where the rules come from, and why it is different from classified information and ordinary company data.
The Short Version
Controlled Unclassified Information (CUI) is information the U.S. government creates or owns, or that someone creates or holds for the government. It isn’t classified, but a law, regulation or government-wide policy says it still has to be protected. It covers things like technical drawings for defense parts, export-controlled data, certain research results, and some privacy and law-enforcement information.
If you work for a company that does government work, you may handle CUI every day without anyone calling it that. Knowing what it looks like and how to handle it is part of doing the job, the same as reading a drawing or following a safety procedure.
Where the Rules Come From
Before 2010, agencies protected sensitive-but-unclassified information with dozens of their own labels, such as “For Official Use Only” and “Sensitive But Unclassified.” Each agency’s rules were different, which made sharing information messy and protecting it inconsistent.
- Executive Order 13556 (2010) created one program for the whole executive branch.
- 32 CFR Part 2002 (2016) is the rule that tells agencies how to run it: how to mark, store, share and destroy CUI.
- The National Archives (NARA), through its Information Security Oversight Office, runs the program. Its CUI Registry (archives.gov/cui) lists every category of CUI and the law behind each one.
- The Department of Defense (which now also goes by the Department of War) applies the program through its own instruction, DoDI 5200.48. Defense contractors get their requirements through contract clauses, most importantly DFARS 252.204-7012, which requires protecting CUI on company systems under NIST SP 800-171.
CUI Is Not Classified, and It’s Not Just “Company Confidential”
| Classified | CUI | Company confidential | |
|---|---|---|---|
| Who decides | The government, under the classification system | The government, under the CUI program | Your company |
| Examples | Secret or Top Secret material | Defense technical drawings, export-controlled data | Pricing, payroll, business plans |
| Needs a clearance? | Yes | No, but you need a lawful reason and a need to know | No |
| Rules come from | Classification law and policy | EO 13556, 32 CFR 2002, your contract | Company policy |
At OPW, the Harrow & Vale Aerospace (HVA) drawings are CUI. OPW’s own pricing and payroll are sensitive, but they’re not CUI. Both need protecting, under different rules. Mixing them up causes real problems in both directions: under-protecting CUI, or stamping “CUI” on things that aren’t and burying the real CUI in noise.
Basic and Specified
Every CUI category is either CUI Basic or CUI Specified.
- Basic means the standard CUI handling rules apply.
- Specified means the law behind that category adds its own rules on top, for example extra limits on who may receive it. Controlled technical information (
CTI) is Specified, and so is export-controlled information (EXPT) governed by the export laws. Both show up on defense drawings.
You’ll learn to read the markings in the next lesson. For now, remember that “SP” on a marking means extra rules apply, so slow down.
Lawful Government Purpose and Need to Know
CUI isn’t secret from everyone. It’s meant to be shared, but only for a lawful government purpose (a reason consistent with the law and the contract behind it) and only with people who need it to do their part of the work. At OPW, Tasha Greene needs the HV-7 drawings to program the machines. Alex Moreno in commercial sales doesn’t, so he doesn’t get them, even for a harmless-sounding slide.
Why It Matters
The drawings on OPW’s floor describe parts that end up in aircraft that people fly. Technical data that leaks can help an adversary copy a design, find a weakness or undercut the companies that built it. For OPW, mishandling CUI can also cost the company its contracts, and with them, jobs. The rules aren’t there to catch you out. They’re there so the people who depend on the work can keep depending on it.
A note on timing: the rules keep changing, and CMMC, DoD’s program for checking contractors, is under review as of this writing (September 2026). But the obligation to protect CUI under DFARS 252.204-7012 and NIST SP 800-171 has not paused. A broader rule that would extend CUI requirements to other agencies’ contractors has also been proposed but isn’t final. For current status, check the DoD CIO’s CMMC page and the Federal Register.
The One Habit That Covers Most of This Course
When in doubt, stop and ask. If something looks like it might be CUI, or you’re not sure a system, person or place is approved for it, pause and ask your supervisor or your company’s CUI contact. At OPW, that’s Renee Ruiz. Nobody at a well-run company gets in trouble for asking first. Guessing is where mistakes happen.
Try This
Sort each item at OPW into CUI, company confidential or public. About five minutes.
- HVA’s 3D model of the HV-7 bracket assembly
- OPW’s quote to a medical-device customer
- OPW’s trade-show brochure
- Inspection results Jordan Pike produced from the HV-7 drawings
- Next quarter’s payroll report
Check your answer
- CUI. Controlled technical information from HVA, and export controlled.
- Company confidential. Sensitive to OPW, but no government law or contract makes it CUI.
- Public. It’s meant to be handed out.
- CUI. Information derived from CUI is still CUI, and it has to be marked (you’ll learn how in the Handler module).
- Company confidential. Sensitive, but not CUI.
What This Covers
This module supports NIST SP 800-171 requirement 3.2.1 (Rev 3: 03.02.01): making everyone who uses company systems aware of the security risks of their work and of the policies, standards and procedures that apply. Your company’s own rules come in Module 5.
Key Takeaways
- CUI is government-related information that a law, regulation or policy says must be protected. It isn’t classified, and it isn’t the same as company confidential.
- The rules come from EO 13556 and 32 CFR Part 2002, and reach contractors through contract clauses such as DFARS 252.204-7012 and NIST SP 800-171.
- “SP” (Specified) categories carry extra rules. Defense drawings are often CTI and export controlled.
- Share CUI only for a lawful government purpose and only with people who need it.
- When in doubt, stop and ask.