Glossary term
Controlled Unclassified Information (CUI)
Government information that requires safeguarding but is not classified.
CUI is unclassified information that laws, regulations, or policy require to be protected — including export-controlled technical data, procurement-sensitive information, and personally identifiable information. Handling CUI triggers safeguarding obligations under NIST SP 800-171 and, for DoD work, CMMC. Whether a contract involves CUI materially changes what your IT environment must look like.
Categories
- compliance
- cybersecurity
Related terms
- NIST SP 800-171The security standard for protecting Controlled Unclassified Information in non-federal systems.
- CMMCCybersecurity Maturity Model Certification — DoD's tiered cybersecurity verification program for the defense industrial base.
- ITARInternational Traffic in Arms Regulations — export controls governing defense articles, services, and technical data.