CUI
Controlled Unclassified Information — unclassified but protected government data.
CUI is information the US government creates or possesses, or that a non-federal organization possesses on behalf of the government, that requires safeguarding under law, regulation, or government-wide policy.
Handling CUI triggers DFARS 252.204-7012 and NIST 800-171 obligations. Most CMMC Level 2 contracts exist because CUI is in play.
Identify the information before selecting controls
Start with the information source, applicable CUI category, markings, and contractual handling instructions. Sensitive business information is not automatically CUI. If the designation is unclear, ask the responsible government or contracting contact rather than making the classification solely from a filename or a customer’s industry.
Map where it travels
Trace covered information through email, file storage, support tickets, endpoints, backups, and external providers. Include people who can access it and integrations that can copy it. This helps define a defensible security boundary and prevents an apparently small workflow from creating an unmanaged data path.
Document uncertainty and decisions
Record the basis for the designation, approved storage locations, access responsibilities, and unresolved questions. Do not move information into a new tool simply because that tool advertises security features. The relevant contract, authorized handling arrangements, and implemented safeguards determine whether the workflow is appropriate.
Related terms
See how Scarlet Risk covers CUI.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo