Reviewed October 6, 2026. Updated to clarify contractor-created information, unmarked data, and context-dependent exclusions.
Where CUI actually comes from
Controlled Unclassified Information is unclassified information that requires safeguarding or dissemination controls under an applicable law, regulation, or government-wide policy. 32 CFR Part 2002 and the NARA CUI Registry define the framework. Sensitivity or a label alone does not establish the applicable category and authority.
For DoD work, DFARS 252.204-7012 includes qualifying contractor-collected or contractor-developed information in covered defense information. Contractors can create, receive, and handle CUI in contract performance and apply markings when instructed by the contract or supporting documentation. The government need not be the original author of every controlled document.
The three tiers contractors mix up
Federal Contract Information (FCI) is nonpublic information provided by or generated for the government under contract, subject to the exclusions in FAR 52.204-21. Some of that information may also qualify as CUI; do not treat the labels as mutually exclusive. CUI Basic uses the standard CUI safeguards. CUI Specified has specific controls established by its governing authority; identify those requirements from the Registry and your contract.
| Tier | What it is | Where the obligation comes from | What protects it |
|---|---|---|---|
| FCI | Non-public info provided by or generated for the government under contract | FAR 52.204-21 | 15 basic requirements (CMMC Level 1) |
| CUI Basic | Information within an authorized CUI category without category-specific safeguards | 32 CFR Part 2002 · NARA CUI Registry | Standard CUI baseline (NIST SP 800-171) |
| CUI Specified | CUI whose governing law or regulation imposes its own handling rules | The specific law/regulation cited in the Registry | Controls specified by the governing authority; standard CUI rules where applicable |
What CUI looks like in a defense shop
In the DIB, the categories you'll actually encounter are a short list:
- Controlled Technical Information: drawings, specifications, technical manuals — the engineering data behind the part you build.
- Export-controlled information: qualifying information controlled under ITAR or EAR in the relevant government/contract context; export restrictions alone do not establish CMMC scope.
- Certain procurement and program information: qualifying acquisition and program data received or created in contract performance.
Ordinary internal HR records, marketing material, company financials, and public product documentation are not automatically CUI merely because they are sensitive. Context matters: government-related personnel, financial, proprietary, or technical information may fall within an authorized category. Verify the governing authority and contract before excluding it. Lawfully public information is different from a restricted copy that happens to have been exposed.
Why this distinction is worth real money
Overmarking is rampant. Primes stamp entire transmittal packages "CUI" to be safe, and the marks propagate downstream unchallenged. Meanwhile, on your side, unknown scope defaults to "everything is in scope" — every mailbox, every file share, every user gets pulled into the assessment boundary, and every control has to be implemented and evidenced everywhere. That's the single biggest driver of CMMC cost we see.
The fix is discovery and contract review. Map where CUI is received, created, stored, processed, transmitted, and protected, then document the boundary. The amount of scope reduction varies and is not guaranteed. Our CUI Scope Reduction Field Guide explains the method; a gap assessment can validate the implementation and evidence.
A practical test you can run this week
For each information type, ask: what authority and Registry category apply? What does the contract require, including for information we create? Which systems store, process, transmit, or protect it? Do not exclude information solely because it lacks a CUI marking. Resolve uncertain status with the originator or government contracting activity; NARA's FAQs explain the contract and marking responsibilities.
Document the answers and unresolved questions across active contracts. Keep required safeguards in place while seeking clarification, and retain the contracting activity's determination in the scoping record. Map both government-provided information and qualifying contractor-created information into the boundary.
The takeaway: trace authority and contract requirements, resolve ambiguous or missing markings through the appropriate government channel, and design the boundary around both the controlled information and its security dependencies.
Want to find out where CUI actually lives in your environment?
A practitioner will trace your contracts, separate designated CUI from overmarked noise, and hand you a defensible boundary — usually a fraction of what you feared. Or email rj@indirectit.com directly.