CUI category: General Procurement and Acquisition

General Procurement and Acquisition, marked PROCURE, is the Controlled Unclassified Information (CUI) category for the sensitive parts of a Federal contract competition. The CUI Registry page for General Procurement and Acquisition, last reviewed July 30, 2025, describes the category as material and information relating to, or associated with, the acquisition and procurement of goods and services, including but not limited to cost or pricing data, contract information, indirect costs, and direct labor rates. The Registry's category list puts PROCURE in the Procurement and Acquisition index grouping with Source Selection and Small Business Research and Technology. This page covers the three authorities, the statute behind two of them, how PROCURE differs from the Source Selection and Proprietary Business Information categories, who marks it and how, and what happens at award. For the program as a whole, see What is CUI?.

What the Registry lists for PROCURE

The Registry page gives one banner marking, CUI//SP-PROCURE, and the category marking PROCURE. The page lists no separate Basic banner, although one of its three authorities is Basic. The authority table reads:

Two of the three are Federal Acquisition Regulation (FAR) provisions that implement the Procurement Integrity Act, and both carry that Act's penalty section as the sanction. The third is a Department of Defense (DoD) statute about research agreements that are not contracts. Under 32 CFR 2002.20, paragraph (b)(2), category markings are mandatory for CUI Specified, so information designated under either FAR authority must carry SP-PROCURE in the banner; information designated under 10 U.S.C. 4021 alone may carry a plain CUI banner.

The statute: 41 U.S.C. 2101, 2102, and 2105

The Procurement Integrity Act is codified at 41 U.S.C. chapter 21. 41 U.S.C. 2101 defines the two kinds of protected information. Contractor bid or proposal information is information submitted to a Federal agency with or in connection with a bid or proposal for a Federal agency procurement contract, if not previously made public, in four kinds: cost or pricing data as defined in 10 U.S.C. 3701 or 41 U.S.C. 3501(a); indirect costs and direct labor rates; proprietary information about manufacturing processes, operations, or techniques that the contractor has marked under applicable law or regulation; and information the contractor has marked contractor bid or proposal information under applicable law or regulation. Source selection information is information prepared for use by an agency to evaluate a bid or proposal, if not previously made public, in ten kinds: sealed bid prices before bid opening; proposed costs or prices; source selection plans; technical evaluation plans; technical evaluations; cost or price evaluations; competitive range determinations; rankings; reports of source selection panels, boards, or advisory councils; and other information marked source selection information on a case-by-case determination by the agency head, the head's designee, or the contracting officer, where disclosure would jeopardize the procurement.

41 U.S.C. 2102 contains the prohibitions. Subsection (a)(1) says a covered person shall not, other than as provided by law, knowingly disclose contractor bid or proposal information or source selection information "before the award of a Federal agency procurement contract to which the information relates." Subsection (a)(3) defines the covered persons as present or former Federal officials, and anyone acting or advising on behalf of the Government on the procurement, who had access through that role. Subsection (b) is the mirror image: no person shall, other than as provided by law, knowingly obtain the same information before award.

41 U.S.C. 2105 is the sanction the Registry lists. Subsection (a) makes it a crime, punishable by a fine under Title 18, imprisonment for not more than 5 years, or both, to violate section 2102 in exchange for anything of value or to obtain or give a competitive advantage. Subsection (b) lets the Attorney General sue for a civil penalty of up to $50,000 per violation for an individual and $500,000 for an organization, plus twice the compensation received or offered. The Department of Justice adjusts those two caps for inflation in 28 CFR 85.5; for penalties assessed after July 3, 2025 they are $131,308 and $1,313,069. Subsection (c) lists the administrative actions the agency must consider: cancelling the procurement if no award has been made, rescinding the contract and recovering amounts spent, suspension or debarment, and adverse personnel action. FAR 3.104-8 carries the same remedies into the regulation.

The FAR authorities: 3.104-4 and 52.215-1(e)

FAR 3.104-3 restates the prohibitions in paragraphs (a) and (b) with the "other than as provided by law" exception, and FAR 3.104-1 restates the definitions, adding a fifth kind of contractor bid or proposal information that the statute lacks: information marked in accordance with 52.215-1(e). Acquisition.gov shows these sections under FAC 2026-01, effective March 13, 2026. For DoD, Class Deviation 2026-O0031, effective February 1, 2026, has contracting officers use the Revolutionary FAR Overhaul text of Part 3 in lieu of the codified text; that version keeps 3.104-1 through 3.104-4 with the same numbering, definitions, and legend, and Class Deviation 2026-O0038 of January 20, 2026 does the same for Part 52, where 52.215-1(e) keeps its title page and sheet legends.

FAR 3.104-4, Disclosure, protection, and marking of contractor bid or proposal information and source selection information, is the first Specified authority. Paragraph (a) says that, except as the subsection provides, no person or other entity may disclose contractor bid or proposal information or source selection information to anyone other than a person authorized by the agency head or the contracting officer to receive it. Paragraph (b) requires protection from unauthorized disclosure under FAR 14.401, FAR 15.207, applicable law, and agency regulations. Paragraph (c) is the marking rule, discussed below. Paragraph (d) requires the contracting officer to notify a contractor in writing when proprietary information, bid or proposal information, or information marked under 52.215-1(e) appears to be improperly marked, and gives the contractor an opportunity to justify the marking before the officer removes it. Paragraph (e) lists what the section does not prohibit, including a contractor disclosing or receiving its own information and the Government's use of technical data consistent with its rights. Paragraph (f) lists what the section does not authorize: withholding information from Congress, a Federal agency, the Comptroller General, or an Inspector General on a proper request, releasing information after award or cancellation if it pertains to another procurement, and disclosing protected information after award where another law prohibits it.

FAR 52.215-1, Instructions to Offerors-Competitive Acquisition, is the second. Paragraph (e), Restriction on disclosure and use of data, dated November 2021, tells offerors who include data they do not want disclosed or used except for evaluation to mark the title page with a legend stating that the proposal includes data that shall not be disclosed outside the Government or used for any purpose other than to evaluate the proposal, that if a contract is awarded the Government may use the data to the extent the contract provides, that the restriction does not limit use of information obtained from another source, and which sheets contain the restricted data. Each restricted sheet then gets a legend saying that use or disclosure of the data on the sheet is subject to the restriction on the title page. FAR 15.609(a) gives an unsolicited proposal the same title page legend under the heading Use and Disclosure of Data.

The DoD authority: 10 U.S.C. 4021(i)

10 U.S.C. 4021, Research projects: transactions other than contracts and grants, is the Basic authority. The section was originally enacted as 10 U.S.C. 2371 by Public Law 101-189 and renumbered by Public Law 116-283 in 2021. Subsection (i), Protection of Certain Information From Disclosure, says that disclosure of the information described in paragraph (2) is not required, and may not be compelled under the Freedom of Information Act (FOIA), for five years after the date DoD receives it. Paragraph (2)(A) limits that to information submitted in a process that could lead to a cooperative agreement for research under section 4001 or another transaction under subsection (a). Paragraph (2)(B) lists the information: a proposal, proposal abstract, and supporting documents; a business plan submitted on a confidential basis; and technical information submitted on a confidential basis. The Registry cites items (i) and (ii). The Registry lists it as Basic, and the statute sets a disclosure exemption and a five-year clock but no handling controls. Other transaction proposals do not go through FAR Part 15, so FAR 3.104-4 and 52.215-1(e) do not reach them, and section 4021(i) is what makes them CUI.

PROCURE versus SSEL versus PROPIN

The Registry splits the procurement record across three categories, and two of the three PROCURE authorities appear on a neighboring page as well.

The Source Selection category, marked SSEL, describes itself by reference to FAR 2.101: any of the ten listed types of information prepared for use by an agency to evaluate a bid or proposal, if not previously made public. The page, also last reviewed July 30, 2025, lists 17 authorities. Six are Specified with banner CUI//SP-SSEL: FAR 14.303, 14.401(a), 14.402-1(a), 15.609(a), 3.104-4, and 52.215-1(e). The other 11 are Basic with banner CUI or the alternative CUI//SSEL: FAR 14.211, 15.207(b), 15.505(f), 3.104-3(a), 42.1503(b), 5.401(a), 4.802(e), and 9.105-3(a), 48 CFR 603.104-4 and 836.203, and 41 U.S.C. 2102(a). FAR 14.401(a) is a good example of a Specified SSEL authority: bids received before opening are kept in a locked bid box, a safe, or a secured electronic bid box. FAR 15.207(b) is a Basic one: proposals shall be safeguarded from unauthorized disclosure throughout the source selection process. The Registry cites the codified numbers. In the Revolutionary FAR Overhaul text that DoD Class Deviations 2026-O0012 and 2026-O0048, Revision 1, put in place, the bid box rule is at 14.303(a), the proposal safeguarding rule is at 15.108(b) and says should rather than shall, and the unsolicited proposal legend is at 15.503-3(a).

The General Proprietary Business Information category, marked PROPIN, covers material and information relating to, or associated with, a company's products, business, or activities, with examples of financial information, trade secrets, product research and development, and product designs and performance specifications. The page lists 83 authorities, most of them trade, environmental, and transportation statutes, including 18 U.S.C. 1905, the Trade Secrets Act, and does not mention bid or proposal information at all.

Read against the Registry's descriptions, the division looks like this. SSEL is the Government's side of the competition: the bids and proposals it holds and the evaluations it writes. PROCURE is the contractor's submission as the Procurement Integrity Act protects it, which is why FAR 52.215-1(e), the offeror's own marking, is a PROCURE authority, and why the Registry's description leads with cost or pricing data, indirect costs, and direct labor rates. PROPIN is the company's confidential business information whether or not a procurement is under way. Because FAR 3.104-4 and 52.215-1(e) appear under both PROCURE and SSEL, a technical evaluation that quotes a contractor's labor rates can carry both markings in one designation indicator.

Who designates PROCURE information and how it is marked

The designator depends on who created the information. For source selection information, FAR 2.101 paragraph (10) puts the case-by-case determination with the head of the agency or the contracting officer, and FAR 3.104-4(c) puts the marking duty on the individuals preparing the material. For contractor bid or proposal information, FAR 3.104-1 says the contractor marks it, under 52.215-1(e) or other applicable law, and the contracting officer under 3.104-4(d) may challenge the marking. FAR 3.104-4(a) says only the agency head or the contracting officer may authorize someone to receive either kind of information. In DoD, DoDI 5200.48, Controlled Unclassified Information, effective March 6, 2020, assigns the Under Secretary of Defense for Acquisition and Sustainment the contracting processes for safeguarding DoD CUI in procurement, and requires every DoD CUI document to carry a five-line designation indicator naming the Component, the office, the CUI category, the dissemination control, and a point of contact. The documents that carry the category follow from the definitions: proposals and cost volumes, source selection plans, evaluation reports, competitive range determinations, rankings, and the source selection decision itself, and for other transactions the proposals and business plans that 10 U.S.C. 4021(i) names. For what the decision document must contain, see the source selection decision.

FAR 3.104-4(c) supplies the legend. Individuals preparing material that may be source selection information under paragraph (10) of the FAR 2.101 definition must mark the cover page and each page they believe contains it with "Source Selection Information-See FAR 2.101 and 3.104." The same paragraph says the information in paragraphs (1) through (9) of the definition is source selection information whether or not marked, but all reasonable efforts must be made to mark it with the same legend, and individuals unsure whether something qualifies are told to consult agency officials. That legend is not a CUI marking. Paragraph (b)(2)(iii) of 32 CFR 2002.20 says that where law or regulation requires specific marking or warning statements, agencies use them as the authority requires but must not include them in the CUI banner or portion markings. So a source selection evaluation in a DoD office carries the FAR legend on the cover and each page, the CUI banner, which for a FAR 3.104-4 designation reads CUI//SP-PROCURE or CUI//SP-SSEL, and the designation indicator on the first page. DoDI 5200.48 paragraph 3.4.g notes that DoD made no required Basic or Specified distinction during initial implementation, so DoD documents may show CUI Category: PROCURE without the SP- prefix. The contractor's marks follow 52.215-1(e), and FAR 3.104-4(d) is the check on over-marking.

Portion marking is optional. Paragraph (f) of 32 CFR 2002.20 says agencies are permitted and encouraged to portion mark all CUI, with the acronym CUI, any category marking, and any limited dissemination control as the elements. The CUI Marking Handbook, Version 1.1 of December 6, 2016, gives the format: parentheses at the start of the portion, a double forward slash between CUI and the category, a single forward slash between two categories, and (U) on a portion with no CUI. A paragraph of a technical evaluation that quotes an offeror's labor rates could be marked (CUI//SP-PROCURE/SP-SSEL); boilerplate would be marked (U); and any category in a portion mark must also appear in the banner. DoDI 5200.48 paragraph 3.4.b narrows DoD practice to (CUI) and (U). The FAR legend never appears inside a portion mark.

Decontrol after award

The Procurement Integrity Act's prohibition is tied to award. 41 U.S.C. 2102(a) and (b) apply "before the award" of the contract to which the information relates, and FAR 3.104-3(a) and (b) repeat the phrase. FAR 3.104-4(f)(3) and (f)(4) say what award does not do: it does not authorize release of information that pertains to another procurement, and it does not authorize disclosure of protected information where another law prohibits it, with cross-references to FAR 3.104-2(b)(5) and subpart 24.2. The 52.215-1(e) legend tells the offeror that after award the Government may use the data to the extent the resulting contract provides.

32 CFR 2002.18 turns that into decontrol. Paragraph (b)(1) says CUI may be decontrolled when the law, regulation, or Government-wide policy no longer requires its control and the holder has the authority, and paragraph (b)(4) when a pre-determined event occurs. Paragraph (e)(3) of 32 CFR 2002.20 says a decontrol event must be foreseeable and verifiable by any authorized holder, and contract award is both. But paragraph (e) of 2002.18 says decontrol relieves holders of CUI handling and is not authorization for public release, and paragraph (g) says any public release of former CUI must follow applicable law and agency policy. Source selection information prepared for one competition can be CUI for the next one. A contractor's labor rates may stay protected after award, because FAR 3.104-2(b)(5) says the Privacy Act, the Trade Secrets Act, and other laws may prohibit release both before and after award, which is why the same data may be PROPIN after it stops being PROCURE. And 10 U.S.C. 4021(i) runs its own five-year clock with no award trigger at all. DoDI 5200.48 paragraph 3.7.d adds that the CUI category or treatment of information may change as a program moves through the acquisition life cycle.

Common confusions

"Procurement sensitive" is not a Registry term. A document labeled procurement sensitive with no CUI banner carries a legacy marking, and 32 CFR 2002.20 says legacy markings are void and do not indicate that information qualifies as CUI.

The FAR legend is not the CUI banner. The legend comes from FAR 3.104-4(c); the banner comes from 32 CFR 2002.20 and the Registry. Both go on the document, and 2002.20(b)(2)(iii) keeps them apart.

PROCURE is not only source selection. The Registry's description leads with cost or pricing data, indirect costs, and direct labor rates, which are the contractor's submission, and 52.215-1(e), the offeror's own marking, is a PROCURE authority.

Award is not public release. The statutory prohibition ends, the CUI control may end, and the information may still be protected by other law. And a marked proposal is not automatically protected: FAR 3.104-4(d) lets the contracting officer challenge and remove improper markings, with notice to the contractor.

What to check

• Which definition does the information meet, contractor bid or proposal information under 41 U.S.C. 2101(2) and FAR 3.104-1, or source selection information under 2101(7) and FAR 2.101, and which Registry category and authority does the designation indicator cite?
• Does case-by-case source selection information carry the Source Selection Information-See FAR 2.101 and 3.104 legend on the cover and each page, and does the CUI banner carry SP-PROCURE or SP-SSEL as the Specified authority requires?
• Has the agency head or contracting officer authorized each recipient under FAR 3.104-4(a), and is the recipient a person with a lawful government purpose under DoDI 5200.48?
• Has the contract to which the information relates been awarded, and does the information pertain only to that procurement, so that FAR 3.104-4(f)(3) does not keep it controlled?
• If a contractor's data is marked under 52.215-1(e), is the title page legend present with the list of restricted sheets, and has any challenge under FAR 3.104-4(d) been resolved in writing?
• For an other transaction proposal, has five years passed since DoD received it under 10 U.S.C. 4021(i), the only clock the Basic authority sets?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Questions people ask

What is CUI PROCURE?

General Procurement and Acquisition, marked PROCURE, is the CUI Registry category for material and information relating to the acquisition and procurement of goods and services, including cost or pricing data, contract information, indirect costs, and direct labor rates. The Registry page, last reviewed July 30, 2025, gives the banner CUI//SP-PROCURE and lists FAR 3.104-4 and FAR 52.215-1(e) as Specified authorities and 10 U.S.C. 4021(i)(2)(B)(i) and (ii) as a Basic authority.

What is procurement sensitive information?

Procurement sensitive is an informal label, not a Registry marking. The information people mean by it is defined in 41 U.S.C. 2101 and FAR 3.104-1 as two things: contractor bid or proposal information, which includes cost or pricing data, indirect costs and direct labor rates, and marked proprietary or proposal information, and source selection information, which includes bid prices before opening, proposed prices, evaluation plans, evaluations, competitive range determinations, rankings, and panel reports. Under the Registry those map to the PROCURE and SSEL categories.

What is source selection information CUI?

Source Selection, marked SSEL, is a separate Registry category whose description repeats the FAR 2.101 definition: information prepared for use by an agency to evaluate a bid or proposal, if not previously made public, in ten listed types. The page lists 17 authorities; FAR 14.303, 14.401(a), 14.402-1(a), 15.609(a), 3.104-4, and 52.215-1(e) are Specified with banner CUI//SP-SSEL, and the rest, including 41 U.S.C. 2102(a) and FAR 15.207(b), are Basic with banner CUI or CUI//SSEL.

What is the difference between PROCURE, SSEL, and PROPIN?

PROCURE covers the Government's procurement record and the contractor's bid or proposal information under FAR 3.104-4 and 52.215-1(e). SSEL covers the Government's own evaluation material under FAR 2.101 and the sealed bid and proposal handling rules in FAR Parts 14 and 15. PROPIN, General Proprietary Business Information, covers a company's financial information, trade secrets, research, and product designs under 83 authorities such as 18 U.S.C. 1905. FAR 3.104-4 and 52.215-1(e) appear under both PROCURE and SSEL.

Who marks source selection information?

FAR 3.104-4(c) puts the duty on the individuals preparing the material. Anyone preparing material that may be source selection information under paragraph (10) of the FAR 2.101 definition must mark the cover page and each page they believe contains it with the legend Source Selection Information-See FAR 2.101 and 3.104, and must make all reasonable efforts to mark items 1 through 9 the same way. Under FAR 2.101 paragraph (10), the head of the agency or the contracting officer makes the case-by-case determination.

How does a contractor mark proposal information?

FAR 52.215-1(e), dated November 2021, tells an offeror that wants to restrict data to mark the title page with a legend saying the proposal includes data that shall not be disclosed outside the Government or used except to evaluate the proposal, to list the restricted sheets, and to mark each restricted sheet with a legend referring to the title page. FAR 3.104-1 counts information marked under 52.215-1(e) as contractor bid or proposal information, and the Registry lists the paragraph as a Specified PROCURE authority.

What are the penalties under the Procurement Integrity Act?

41 U.S.C. 2105(a) makes it a crime, punishable by a fine under Title 18, up to 5 years imprisonment, or both, to violate section 2102 in exchange for anything of value or to obtain or give a competitive advantage. Subsection (b) allows civil penalties of up to $50,000 per violation for an individual and $500,000 for an organization, plus twice the compensation received or offered; 28 CFR 85.5 now adjusts those caps to $131,308 and $1,313,069. Subsection (c) lets the agency cancel the procurement, rescind the contract, and pursue suspension or debarment.

Is procurement information still CUI after contract award?

The statutory prohibition ends at award: 41 U.S.C. 2102 applies before the award of the contract to which the information relates. FAR 3.104-4(f)(3) adds that the section does not authorize release after award of information that pertains to another procurement, and 52.215-1(e) lets the Government use restricted data to the extent the contract provides. Under 32 CFR 2002.18, decontrol follows when the governing authority no longer requires control, but other laws, such as those behind PROPIN, may still protect the same data.

What is 10 USC 4021(i)?

10 U.S.C. 4021, formerly section 2371, authorizes DoD research transactions other than contracts and grants. Subsection (i) says that for five years after DoD receives it, disclosure of a proposal, proposal abstract and supporting documents, a business plan submitted on a confidential basis, or technical information submitted on a confidential basis in a competitive or noncompetitive process that could lead to a cooperative agreement or other transaction is not required and may not be compelled under FOIA. The Registry lists it as the Basic PROCURE authority.

Sources

1. 1General Procurement and Acquisition (CUI Registry category) · National Archives, Information Security Oversight Office
2. 2Source Selection (CUI Registry category) · National Archives, Information Security Oversight Office
3. 3General Proprietary Business Information (CUI Registry category) · National Archives, Information Security Oversight Office
4. 4CUI Registry: Category List · National Archives, Information Security Oversight Office
5. 5CUI Marking Handbook, Version 1.1, December 6, 2016 · National Archives, Information Security Oversight Office
6. 632 CFR 2002.18 Decontrolling · GovInfo, U.S. Government Publishing Office
7. 732 CFR 2002.20 Marking · GovInfo, U.S. Government Publishing Office
8. 841 U.S.C. 2101 Definitions · GovInfo, U.S. Government Publishing Office
9. 941 U.S.C. 2102 Prohibitions on disclosing and obtaining procurement information · GovInfo, U.S. Government Publishing Office
10. 1041 U.S.C. 2105 Penalties and administrative actions · GovInfo, U.S. Government Publishing Office
11. 1110 U.S.C. 4021 Research projects: transactions other than contracts and grants · GovInfo, U.S. Government Publishing Office
12. 12FAR 2.101 Definitions · Acquisition.gov, General Services Administration
13. 13FAR 3.104-1 Definitions · Acquisition.gov, General Services Administration
14. 14FAR 3.104-2 General · Acquisition.gov, General Services Administration
15. 15FAR 3.104-3 Statutory and related prohibitions, restrictions, and requirements · Acquisition.gov, General Services Administration
16. 16FAR 3.104-4 Disclosure, protection, and marking of contractor bid or proposal information and source selection information · Acquisition.gov, General Services Administration
17. 1748 CFR 3.104-8 Criminal and civil penalties, and further administrative remedies · GovInfo, U.S. Government Publishing Office
18. 18FAR 14.401 Receipt and safeguarding of bids · Acquisition.gov, General Services Administration
19. 19FAR 15.207 Handling proposals and information · Acquisition.gov, General Services Administration
20. 20FAR 15.609 Limited use of data · Acquisition.gov, General Services Administration
21. 21FAR 52.215-1 Instructions to Offerors-Competitive Acquisition · Acquisition.gov, General Services Administration
22. 2228 CFR 85.5 Adjustments to penalties for violations occurring after November 2, 2015 · Electronic Code of Federal Regulations
23. 23DFARS Revolutionary FAR Overhaul Class Deviations · Defense Pricing, Contracting, and Acquisition Policy, Defense Acquisition Regulations System
24. 24Revolutionary FAR Overhaul, Part 3 · Acquisition.gov, General Services Administration
25. 25Revolutionary FAR Overhaul, Part 14 · Acquisition.gov, General Services Administration
26. 26Revolutionary FAR Overhaul, Part 15 · Acquisition.gov, General Services Administration
27. 27DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 · Department of Defense, Directives Division

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.