Insights · Question
What is CUI?
Controlled Unclassified Information is information that the US federal government creates or possesses, or that a contractor creates or handles on its behalf, that law, regulation or government policy requires to be safeguarded or dissemination-controlled, but that is not classified. The categories are defined in the CUI Registry maintained by the National Archives. Contractors that receive CUI under defense contracts must protect it according to NIST SP 800-171 and, increasingly, demonstrate CMMC Level 2. Where CUI enters, is stored and is transmitted determines the assessment scope, which is why identifying it precisely is the first step of any readiness work.
In more detail
The reasoning.
CUI is often marked, but not always, and contractors sometimes handle it without realizing: technical drawings, specifications, export-controlled data, certain personnel and procurement information. A CUI flow analysis traces where it comes from, where it goes and who touches it.
Confining CUI to a secure enclave keeps the strictest requirements and the assessment scope to a defined environment rather than the whole enterprise, which for most contractors is the single decision that makes Level 2 achievable.
See the glossary entry for CUI, secure enclave design, NIST SP 800-171 gap assessment and do we need CMMC.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days