CUI

Controlled Unclassified Information is government-created or owned information that requires safeguarding but does not meet the criteria for classification. CUI includes sensitive information like export-controlled data, privacy information, and proprietary business information requiring protection.

Contractors handling CUI must implement security controls specified in NIST SP 800-171 and comply with DFARS clause 252.204-7012. This includes cybersecurity incident reporting, flow-down requirements to subcontractors, and documentation of system security. CUI protection requirements significantly impact IT infrastructure and security investments for defense contractors.