Definition
CUI stands for Controlled Unclassified Information. In federal law and regulatory practice, CUI designates information the U.S. government creates or possesses that requires safeguarding or dissemination controls pursuant to law, regulation, or government-wide policy, but that does not meet the threshold for national security classification under Executive Order 13526 or its predecessors. CUI is not classified information — it is a distinct, lower tier of sensitive information that nonetheless carries legal handling obligations.
The CUI framework was established by Executive Order 13556 (2010) and is administered by the National Archives and Records Administration (NARA) through the CUI Program. The program replaced a fragmented system of agency-specific designations — including Sensitive But Unclassified (SBU), For Official Use Only (FOUO), Law Enforcement Sensitive (LES), and dozens of others — with a single, standardized taxonomy. Implementing regulations appear at 32 C.F.R. Part 2002.
CUI is organized into categories and subcategories. Some CUI is designated "CUI Basic," meaning standard handling controls apply. Other CUI is designated "CUI Specified," meaning the authorizing law, regulation, or policy imposes handling requirements that differ from or exceed the baseline. Examples of CUI categories include: Privacy, Legal, Law Enforcement, Financial, Health Information, and Critical Infrastructure.
For government contractors and non-federal entities, CUI handling obligations are increasingly incorporated into contracts, grants, and agreements — most notably through NIST Special Publication 800-171, which sets cybersecurity requirements for protecting CUI in non-federal systems.
---
Common Language
Modern common usage (Wiktionary): CUI is an abbreviation for multiple technical terms, including "command user interface," "character-based user interface," and "controlled unclassified information."
The overlap in abbreviation is a genuine research trap. In information technology literature, CUI refers to interface design concepts entirely unrelated to information security law. In federal contracting, procurement, and national security law, CUI means controlled unclassified information exclusively. Context almost always disambiguates, but researchers working across technical and legal source sets should confirm which usage is operative.
---
Common Confusion
CUI is frequently confused with classified information. The distinction is legally significant: classified information (Confidential, Secret, Top Secret) is controlled under Executive Order 13526 and the National Security Act framework. CUI is controlled under separate statutory and regulatory authority — the sources of obligation differ, the handling requirements differ, and the consequences of mishandling differ. CUI may not be marked or treated as classified, and classified information is not CUI.
CUI is also frequently confused with its predecessor designations (FOUO, SBU, LES). These legacy markings are being phased out across federal agencies and replaced by CUI markings. Researchers working with documents predating full agency transition may encounter legacy markings where CUI markings would appear today.
---
Why It Matters in Research
The CUI framework is relatively recent — Executive Order 13556 dates to 2010, and full regulatory implementation through 32 C.F.R. Part 2002 was completed in 2016 — meaning historical legal sources, including all nineteenth- and early twentieth-century legal dictionaries, will not contain any entry for this term. Burrill's Law Dictionary, the sole historical dictionary source available for this entry, contains no relevant material; the excerpt provided concerns cross remainders in property law and is entirely unrelated to CUI.
Researchers should be aware of several practical issues:
First, agency transition timelines vary. Not all federal agencies fully transitioned from legacy markings to CUI markings on the same schedule. Documents from 2010 to the present may carry either legacy or CUI markings depending on the issuing agency and date.
Second, the CUI Registry is the authoritative source for categories, subcategories, and associated handling requirements. The Registry is maintained online by NARA and should be consulted when researching specific CUI categories, as the taxonomy is updated periodically.
Third, for federal contractors, CUI obligations have migrated into the Defense Federal Acquisition Regulation Supplement (DFARS), particularly DFARS 252.204-7012, which incorporates NIST SP 800-171 compliance requirements. Researchers working on government contracting, cybersecurity law, or defense procurement will encounter CUI as a threshold compliance concept.
Fourth, CUI intersects with privacy law. Certain CUI categories — particularly those covering personally identifiable information (PII) and health information — overlap with obligations under the Privacy Act of 1974, HIPAA, and other privacy frameworks. The CUI designation does not displace those independent legal requirements; it operates alongside them.
---
Historical Dictionary Support
No historical legal dictionary support is available for this term. CUI, in its controlled unclassified information sense, is a product of twenty-first-century federal administrative law. Burrill's Law Dictionary (mid-nineteenth century) contains no relevant entry, and the source material provided under this heading concerns an unrelated area of property law. Researchers should not expect historical dictionary support for this term and should rely on primary regulatory sources: Executive Order 13556, 32 C.F.R. Part 2002, NARA's CUI Registry, and relevant agency implementation guidance.
---
Jurisdictional Note
CUI is a federal framework. State governments, foreign governments, and purely private actors are not directly bound by the CUI program unless they handle federal information under contract or agreement. Several states have adopted parallel sensitive-but-unclassified frameworks for state government information, but these are independent programs and should not be assumed to track federal CUI definitions or handling requirements.
---
Encyclopedia Cross-Reference
See Law Mind Encyclopedia: Controlled Unclassified Information; Information Security Law; Federal Contracting and Cybersecurity Compliance.
---