What is CUI?

Controlled Unclassified Information (CUI) is unclassified information that a law, regulation, or government-wide policy requires or permits the executive branch to safeguard or disseminate under controls. A document that carries CUI markings is handled under those controls, so a program office, a contractor, or an operator who receives one needs to know what its banner and designation indicator say. The program comes from Executive Order 13556, signed on November 4, 2010, and from the implementing regulation at Part 2002 of Title 32 of the Code of Federal Regulations (CFR).

The executive order and the regulation

Executive Order 13556 sets out an open and uniform program for managing information that needs safeguarding or dissemination controls. It excludes information classified under Executive Order 13526 or the Atomic Energy Act, and it aims to replace the inconsistent, agency-specific markings and policies that existed before. Section 2(a) makes the CUI categories and subcategories the exclusive designations for such information in the executive branch. Section 2(c) names the National Archives and Records Administration (NARA) as Executive Agent.

NARA's About CUI page adds that the Archivist delegated the Executive Agent duties to the Information Security Oversight Office (ISOO), which issued 32 CFR Part 2002. The regulation sets agency policy on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI. It applies to executive branch agencies and to organizations that handle CUI or operate information systems for an agency.

The Registry, its categories, and the Basic and Specified split

The regulation's definitions section, 32 CFR 2002.4, defines the CUI Registry in paragraph (p) as the online repository for all information, guidance, policy, and requirements on handling CUI. Paragraph (k) defines categories and subcategories as the types of information for which laws, regulations, or government-wide policies require or permit agencies to apply controls. The Executive Agent approves them and lists them in the Registry.

The Registry's Export Controlled category is one example. NARA describes it as covering information about items, technology, software, and other information whose export could harm national security and nonproliferation goals, including items under the Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR). The category lists many legal authorities, from statutes to sections of 15 CFR, 22 CFR, and 32 CFR.

Section 2002.4 splits CUI into two subsets. Paragraph (j) defines CUI Basic as the subset for which the authorizing law, regulation, or government-wide policy does not set out specific handling controls. Paragraph (r) defines CUI Specified as the subset where the authority does contain specific handling controls, which may be more stringent than the Basic controls or simply different from them. The Export Controlled page shows the split in the banner: CUI//SP-EXPT for information under specified authorities and CUI for information under basic authorities, with CUI//EXPT as an alternative basic banner.

What the banner contains

Paragraph (b) of 32 CFR 2002.20 lists three elements:

• The CUI control marking. Paragraph (b)(1) makes this mandatory and says it may be either the word CONTROLLED or the acronym CUI, at the designator's discretion.
• Category or subcategory markings. Paragraph (b)(2) makes these mandatory for CUI Specified. Paragraph (b)(2)(ii) notes that the program does not require them on CUI Basic.
• Limited dissemination control markings. Paragraph (b)(3) covers these. Section 2002.4(dd) defines a limited dissemination control as any control approved by the Executive Agent that agencies may use to limit or specify dissemination.

Paragraph (f)(1) of the same section says agencies are permitted and encouraged to portion mark all CUI.

What the designation indicator contains

The designation indicator identifies who designated the information. Paragraph (d)(1) of 2002.20 says every document containing CUI must carry one. At a minimum it names the designator's agency, and it may take any form that identifies that agency, including letterhead, other standard agency indicators, or a Controlled by line. Paragraph (d)(2) says the indicator must be readily apparent to authorized holders and may appear only on the first page or cover.

A separate paragraph, (e)(1), says that where feasible, designating agencies must include a specific decontrolling date or event with all CUI.

How DoD instructions tie to CUI

The Defense Technical Information Center (DTIC) points to Department of Defense (DoD) Instruction (DoDI) 5200.48, titled "Controlled Unclassified Information (CUI)," on its Marking Documents page. The same page says the revision of DoDI 5230.24 effective 10 January 2023, the instruction behind DoD distribution statements, aligns the marking of controlled technical information with DoDI 5200.48.

What to check

• Does the banner carry the CUI control marking, either the word CONTROLLED or the acronym CUI?
• For CUI Specified, does the banner carry a category or subcategory marking, such as SP-EXPT?
• Does the first page or cover carry a designation indicator that names the designating agency?
• Does the document show a decontrolling date or event, which the regulation says designating agencies must include where feasible?
• Are portions of the document marked? The regulation permits and encourages it.

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1Executive Order 13556: Controlled Unclassified Information · The White House (National Archives archive of the Obama White House site)
2. 2About CUI · National Archives and Records Administration
3. 332 CFR 2002.4 Definitions · Electronic Code of Federal Regulations (Office of the Federal Register and GPO)
4. 432 CFR 2002.20 Marking · Electronic Code of Federal Regulations (Office of the Federal Register and GPO)
5. 5Export Controlled (CUI Registry category) · National Archives and Records Administration
6. 6Marking Documents · Defense Technical Information Center