If your organization works with the U.S. federal government, you may have come across the terms CUI and CUI Basic—but what exactly do they mean?
CUI, or Controlled Unclassified Information, refers to sensitive information that isn’t classified but still requires protection. CUI Basic is a type of CUI that follows the standard rules for handling and protecting information. Most CUI falls under this category, unless a specific law or regulation requires extra protections.
This article discusses everything you need to know about CUI Basic, including what CUI Basic is, the difference between CUI Basic vs. CUI Specified, and how to protect CUI, among others.
What Is CUI?
According to the National Archives, CUI (Controlled Unclassified Information) refers to sensitive information that isn’t classified under Executive Order 13526 or the Atomic Energy Act but still needs to be protected for personal privacy or federal security.
A common example of CUI includes Personally Identifiable Information (PII), like a person’s birthdate, Social Security number, home address, or credit card details. This information may not pose a risk to national security if disclosed, but is still important to protect because it helps safeguard a person’s privacy and prevents identity theft.
To understand what makes CUI different from classified information, it helps to look at Executive Order 13526. This order was issued by former President Barack Obama in 2009 and sets the rules for how the U.S. government classifies national security information.
Information classified under this order could damage national security if released without authorization. Examples of such data include military operations, intelligence activities, vulnerabilities in critical infrastructure, and sensitive communications with foreign governments.
To protect sensitive information that doesn’t meet the threshold for classified information, President Obama introduced the CUI Program in 2010 through Executive Order 13556. This program dictates how the federal government handles sensitive unclassified information and establishes rules regarding how such information is shared and handled.
What Is CUI Basic?
CUI Basic is one of the two main subcategories of CUI, the other being CUI Specified. CUI basic isn’t subject to any special protection requirements beyond baseline protections. It encompasses a wide range of data, including:
- Personally Identifiable Information (PPI): Information that can be used to uncover a person’s identity, such as full name, date of birth, Social Security number, address, credit card information, driver’s license number, IP address, and employment information.
- Law Enforcement Sensitive (LES) Information: Non-classified information specifically intended for law enforcement use only, such as active investigation details (i.e., names of suspects or persons of interest), criminal intelligence reports, and investigative techniques.
- Unclassified Controlled Technical Information (UCTI): Unclassified technical data related to military or defense use, such as technical manuals for a weapon system, engineering drawings for a military vehicle, test data for defense equipment, and CAD files/3D models for fighter jets or submarines.
CUI Basic is protected by the NIST 800-171 (National Institute of Standards and Technology Special Publication 800-171), a set of guidelines that helps keep data safe from hackers, leaks, and misuse, especially when used outside government systems.
NIST 800-171 was published in 2015 to strengthen cybersecurity protections and has received regular updates to fall in line with emerging cyber threats. The latest update was released in 2024 and requires government contractors to develop risk management workflows to further eliminate vulnerabilities.
What Is the Difference Between CUI Basic vs. CUI Specified?
Unlike CUI Basic, which follows a uniform set of protections under the CUI Program and NIST SP 800-171, CUI Specified must be handled according to specific rules provided by the body that governs it (hence the name CUI “Specified”).
Examples of CUI Specific include DoD critical infrastructure security information, naval nuclear propulsion information, and unclassified controlled nuclear information, all of which must be carefully controlled when shared, even with U.S. citizens.
Why Does CUI Basic Matter?
Before the establishment of the CUI program in 2010, federal agencies had a lot of freedom in how they handled sensitive unclassified information.
Many used unofficial labeling systems like “Sensitive But Unclassified” (SBU), “For Official Use Only” (FOUO), or “Law Enforcement Sensitive” (LES), which made the point across but created inconsistency and confusion across agencies. Each label had different meanings depending on who was using it, and there were no uniform rules for how to protect or share the data.
The lack of standardization made it difficult to safeguard sensitive data, especially when shared between agencies or with external partners. The issue became more obvious after the 2009 WikiLeaks incident, which exposed just how much unclassified but sensitive data was circulating without proper protections.
In response to the ever-growing concerns of unprotected unclassified information, the CUI program was established. The goal was to create a consistent framework for safeguarding unclassified information across all federal agencies.
Here are some of the biggest reasons why CUI Basic matters:
Protection of Sensitive Information
Outside personal information, CUI basic covers sensitive information like proprietary business information, trade secrets, research data, and financial data—information that has the potential to upend a business if leaked to an unauthorized third party. CUI keeps such information confidential and helps businesses maintain a competitive edge.
Prevents Espionage
Image source: Google
While not classified, CUI often includes data related to national defense, federal operations, critical infrastructure, and upcoming technologies. If this information falls into the wrong hands, it can jeopardize the interests of U.S. security.
Individuals who access such information go through specific security protocols and vetting procedures to ensure they don’t misuse sensitive information or sell it to third-party organizations.
Protection from Cybersecurity Attacks
With cybersecurity attacks becoming more and more common, the implementation of CUI protocols is more crucial than ever before. CUI is often targeted by malicious third parties and the release of information can lead to disastrous consequences, often resulting in reputational damage, financial losses, and legal repercussions.
Legal and Regulatory Compliance
CUI protects customers, employees, and businesses because contracts are bound by specific compliance requirements mandated by federal regulations. These requirements are mandatory, meaning that any information that qualifies as CUI must be protected even if it isn’t specifically stated in a contract.
Lack of compliance can result in contract termination, hefty fines, and damage to an organization’s legal standing. It also gives those affected a leg to stand on, allowing them to pursue legal action if their data is breached due to an organization’s failure to properly handle CUI.
What Are the Levels of CUI?
CUI follows practices and standards specified by the CMMC 2.0 (Cybersecurity Maturity Model Certification 2.0) program, which categorizes cybersecurity measures into three levels: Level 1 (Foundational), Level 2 (Advanced), and Level 3 (Expert).
The CMMC 2.0 was established by the U.S. Department of Defense (DoD) on July 17, 2021. Each level has varying requirements, with the first level having the fewest requirements and the third level having the most.
Level 1: Foundational
The Foundational level of CMMC requires organizations to establish basic cybersecurity measures as they see fit. These measures are mandatory for organizations that handle Federal Contract Information (FCI), but not CUI. This means that it’s up to the organization’s discretion to determine how they implement the required practices.
Level 1 includes 17 basic cybersecurity practices, which include:
- Using strong passwords
- Installing antivirus software
- Keeping systems up to date
- Limiting who can access the system
Level 2: Advanced
Level 2 CMMC requires organizations to follow more advanced security measures and to document practices used.
Organizations that handle CUI, such as government contractors, research institutions, healthcare and public health organizations, and Cloud Service Providers (CSPs), must meet Level 2 requirements or face legal repercussions.
Level 2 requires organizations to actively manage and monitor their defenses, and go through an annual self-assessment or a third-party assessment every three years.
Alongside Level 1 cybersecurity requirements, Level 2 follows practices based on NIST SP 800-171. These practices include:
- Implementation of role-based access control (e.g., only project managers can access certain design documents)
- Formal security training that covers insider threats, data protection, and how to properly handle CUI
- Detailed audit logging of activities, with real-time monitoring for unauthorized access to CUI
Level 3: Expert
Level 3 is the highest level of CMMC certification. It mandates organizations to follow advanced security measures as dictated by the DFARS (Federal Acquisition Regulation Supplement) clause 252.204-7012, NIST 800-171, and other security frameworks.
Level 3 contains 130 practices and processes across 17 control families, and emphasizes continuous risk management, monitoring, and incident response.
Organizations that fall into this category include federal agencies in areas like healthcare, infrastructure, and law enforcement, research institutions involved in federally funded research projects (especially in defense or scientific research), and cloud services that host CUI for government agencies (i.e., Google Cloud Government Solutions)
Image source: Google
How to Protect CUI?
The best way to protect CUI is to follow the practices and standards listed in the CMMC 2.0. Determine the level of security you want to reach and follow the procedures outlined in it.
Generally, though, here are the best practices to follow regardless of the level of security required:
- Your organization must have a comprehensive policy in place about how to store, share, and secure CUI. These policies must adhere to the level of CMMC 2.0 you’re trying to achieve and include any additional safeguards you deem necessary.
- Limit access to sensitive data. Only authorized users within your organization should have access to stored documents.
- Regularly train your employees about cybersecurity practices as well as the emerging threats the organization may face in the future.
- Regularly conduct security assessments to evaluate the effectiveness of your cybersecurity controls and identify potential vulnerabilities that may have emerged due to software updates or evolving threats.
