Controlled Unclassified Information, or CUI, is government information that is not classified but still needs safeguarding or dissemination controls. You handle it only if a contract, agreement or marking says so. Software teams usually find out through a contract clause, so read the clauses before you assume either way.
What the definition says
The National Archives states that CUI is information that requires safeguarding or dissemination controls and is not classified under Executive Order 13526 or the Atomic Energy Act. Executive Order 13556 set up the program and named the National Archives as Executive Agent. The Information Security Oversight Office carries out that role and issued 32 CFR Part 2002, which covers how agencies designate, safeguard, disseminate, mark and decontrol CUI.
Two things follow from that. CUI is a legal category, not a sensitivity feeling. And the government decides what it is, not the supplier.
Why software teams care
Most of the security rules in this area attach to CUI. NIST SP 800-171 exists to protect the confidentiality of CUI on systems that belong to contractors rather than agencies. The CMMC program and the DFARS clause on safeguarding covered defense information both build on it. If you hold no CUI, those requirements generally do not reach you. If you do, they arrive through your contract.
A software vendor can end up holding CUI without meaning to. Examples to watch for: a customer sends you design files for a defense program, your support team receives logs from a government system, or a pilot environment is loaded with real agency data.
A practical way to check
Work through these steps in order.
- Read the contract and any flow-down clauses for words such as CUI, covered defense information or NIST SP 800-171.
- Ask your contracting officer or prime contractor in writing whether the work involves CUI. If the answer is yes, ask which categories.
- Look for markings on documents and email you already hold.
- Search your own systems, tickets and shared drives for the same markings.
- Record the answer and who gave it.
Do not mark things CUI yourself to be safe. Over-marking widens your assessment scope and your cost, and the designating authority is the agency.
What to do if the answer is yes
Draw a boundary around the systems that process, store or transmit it, and keep an inventory of them. Smaller scope means fewer systems to protect and assess. Plan for NIST SP 800-171 controls on those systems, and check what your contract says about incident reporting and cloud providers.
What to do if the answer is no
Write down how you know. Keep the contract language and the written confirmation. Then keep CUI out: tell sales and support teams not to accept government files outside an approved channel.
Safeguard can help with the inventory side. Its asset discovery and SBOM and dependency scanning show what runs in the systems you plan to scope, and compliance and evidence automation keeps the records in one place. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Who decides whether information is CUI?
The government agency that designates it, under the National Archives program. A contractor should not self-designate.
Is CUI the same as classified information?
No. CUI is defined as information that is not classified under Executive Order 13526 or the Atomic Energy Act.
Sources
Last reviewed: 19 October 2026.
