What is CUI?

CUI stands for Controlled Unclassified Information. It is a federal designation for information that is not classified but still requires safeguards — things like personally identifiable information, export-controlled technical data, law-enforcement records, and certain financial details.

For federal contractors and grantees, CUI handling triggers cybersecurity requirements, particularly the NIST SP 800-171 controls under DFARS for the DoD and the CMMC framework. If your work touches CUI, the rules below apply.