Reviewed October 6, 2026. Updated to clarify contractor-created information, unmarked data, and context-dependent exclusions.
Where CUI comes from
Controlled Unclassified Information is unclassified information that requires safeguarding or dissemination controls under an applicable law, regulation, or government-wide policy. 32 CFR Part 2002 and the NARA CUI Registry define the framework. Sensitivity or a label alone does not establish the applicable category and authority.
For DoD work, DFARS 252.204-7012 includes qualifying contractor-collected or contractor-developed information in covered defense information. Contractors can create, receive, and handle CUI in contract performance and apply markings when instructed by the contract or supporting documentation. The government need not be the original author of every controlled document.
The three tiers contractors mix up
Federal Contract Information (FCI) is nonpublic information provided by or generated for the government under contract, subject to the exclusions in FAR 52.204-21. Some of that information may also qualify as CUI; do not treat the labels as mutually exclusive. CUI Basic uses the standard CUI safeguards. CUI Specified has specific controls established by its governing authority; identify those requirements from the Registry and your contract.
| Tier | What it is | Where the obligation comes from | What protects it |
|---|---|---|---|
| FCI | Non-public info provided by or generated for the government under contract | FAR 52.204-21 | 15 basic requirements (CMMC Level 1) |
| CUI Basic | Information within an authorized CUI category without category-specific safeguards | 32 CFR Part 2002 · NARA CUI Registry | Standard CUI baseline (NIST SP 800-171) |
| CUI Specified | CUI whose governing law or regulation imposes its own handling rules | The specific law/regulation cited in the Registry | Controls specified by the governing authority; standard CUI rules where applicable |
What CUI looks like in a defense shop
In the DIB, you'll usually run into only a few categories:
- Controlled Technical Information: drawings, specifications, and technical manuals, meaning the engineering data behind the part you build.
- Export-controlled information: qualifying information controlled under ITAR or EAR in the relevant government/contract context; export restrictions alone do not establish CMMC scope.
- Certain procurement and program information: qualifying acquisition and program data received or created in contract performance.
Ordinary internal HR records, marketing material, company financials, and public product documentation are not automatically CUI merely because they are sensitive. Context matters: government-related personnel, financial, proprietary, or technical information may fall within an authorized category. Verify the governing authority and contract before excluding it. Lawfully public information is different from a restricted copy that happens to have been exposed.
Why this distinction is worth real money
Overmarking is rampant. Primes stamp entire transmittal packages "CUI" to be safe, and nobody downstream challenges the marks. On your side, scope you haven't mapped defaults to "everything is in scope": every mailbox, file share, and user gets pulled into the assessment boundary, and every control has to be implemented and evidenced everywhere. Of all the CMMC cost drivers we see, that one is the biggest.
Discovery and contract review fix this. Map where CUI is received, created, stored, processed, transmitted, and protected, then document the boundary. The amount of scope reduction varies and is not guaranteed. Our CUI Scope Reduction Field Guide explains the method; a gap assessment can validate the implementation and evidence.
A practical test you can run this week
For each information type, ask: what authority and Registry category apply? What does the contract require, including for information we create? Which systems store, process, transmit, or protect it? Do not exclude information solely because it lacks a CUI marking. Resolve uncertain status with the originator or government contracting activity; NARA's FAQs explain the contract and marking responsibilities.
Document the answers and unresolved questions across active contracts. Keep required safeguards in place while seeking clarification, and retain the contracting activity's determination in the scoping record. Map both government-provided information and qualifying contractor-created information into the boundary, and design that boundary around the controlled information and the security systems it depends on.
Want to find out where CUI actually lives in your environment?
A practitioner will trace your contracts, separate designated CUI from overmarked noise, and give you a boundary you can defend, usually a fraction of the size you feared. Or email rj@indirectit.com directly.