Sensitive information that could affect the safety and security of U.S. citizens is often classified by the federal government. However, not all important data meets the criteria for formal classification. This type of information is known as Controlled Unclassified Information (CUI), and it falls into two categories: CUI Basic and CUI Specified.

CUI Basic refers to unclassified data that still requires safeguarding and handling practices, even though it is not protected by specific laws or regulations.

What is CUI Basic? A Beginner’s Guide

CUI Basic is a subset of Controlled Unclassified Information that does not have special handling requirements beyond the standard safeguards required for all CUI. It applies across many industries and to any organization that works closely with federal agencies or contractors.

To understand CUI Basic, keep these key points in mind:

• What CUI means overall: Controlled Unclassified Information covers sensitive but unclassified data that must be protected.
• Which subsets qualify : These are categories not tied to specific laws, regulations, or government-wide policies.
• How to safeguard : Organizations must follow baseline security practices, including proper marking, storage, and restricted access.
• Why compliance matters: Understanding CUI Basic is essential for regulatory requirements, especially in industries connected to the U.S. military or defense supply chain.
  

In short, CUI Basic sets the foundation for handling sensitive information responsibly, even when it is not legally classified.

 

What is Controlled Unclassified Information?

Controlled Unclassified Information (CUI) is data the U.S. government considers sensitive but not formally classified. While it does not meet the standards for “classified” status, CUI still requires strict safeguarding, marking, and dissemination rules to control who can access it and under what conditions.

Several authorities govern how CUI must be handled, with the most critical including:

• National Archives and Records Administration (NARA): Oversees all federal agency compliance with CUI requirements, as directed by Executive Order 13556.
  
• Information Security Oversight Office (ISOO): A subdivision of NARA that sets detailed requirements for safeguarding, disseminating, marking, and decontrolling CUI.
• 32 CFR Part 2002: The legal framework outlining the specific controls and practices that organizations must implement.
  

It is important to note that certain categories of CUI may carry additional requirements beyond these baseline rules. For example, while CUI Basic follows the standard safeguards established by ISOO, CUI Specified is subject to enhanced protections under specific laws or regulations.

Request a Free Consultation

Which Categories of CUI are Basic?

Understanding which types of information fall under CUI Basic is essential for compliance. By definition, CUI Basic includes all Controlled Unclassified Information that is not classified as CUI Specified. In other words, if a CUI category does not have unique safeguarding laws or regulations tied to it, it is considered Basic.

CUI Specified, on the other hand, refers to any CUI category that carries additional legal or regulatory requirements beyond the baseline rules for all CUI.

According to the National Archives and Records Administration (NARA), there are 125 total CUI categories, organized into 21 groupings. Out of these, 93 are CUI Basic categories, spanning industries such as:

• Critical Infrastructure: 11 categories, including information on chemical terrorism vulnerabilities, energy infrastructure, and water assessments.
• Defense: 3 categories, such as Controlled Technical Information (CTI) and Naval Nuclear Propulsion Information (NNPI).
• Financial: 10 categories, covering banking secrecy, mergers, and retirement data.
• Law Enforcement: 12 categories, including investigations, informants, and terrorist screening data.
• Privacy: 8 categories, such as health information, personnel records, and student records.
• Legal, Nuclear, Export Control, Immigration, Intelligence, and others: Each with multiple CUI Basic subcategories.
  

Note: Of the 93 CUI Basic categories, 27 are also designated as Specified in certain contexts. This means the same type of information may fall under CUI Basic or CUI Specified, depending on how the data is used and what regulations apply.

For organizations, knowing whether you handle CUI Basic vs. CUI Specified directly impacts the level of security controls and systems you must implement to remain compliant.

 

How to Ensure the Security of CUI Basic

All CUI Basic must be safeguarded according to federal requirements outlined in 32 CFR Part 2002, which governs how CUI is stored, processed, transmitted, and shared. These requirements are built on widely recognized security frameworks such as NIST SP 800-53 and FIPS PUB 200.

To stay compliant, organizations should take the following steps to protect CUI Basic throughout its entire lifecycle:

1. Plan and Implement Cybersecurity Controls
   Develop a comprehensive cybersecurity program that addresses every stage of CUI handling—from creation to disposal. Even destroying CUI files should be guided by clear policies and documented procedures.
2. Apply Proper Markings
   • All CUI documents must be clearly labeled as “Controlled” or “CUI.”
   • For CUI Basic, additional category codes are not required.
   • However, optional markings may apply, such as:
     • “AC” for Attorney-Client Privilege
     • “DISPLAY ONLY” followed by authorized countries for restricted disclosures
       
3. Control Access and Dissemination
   Limit access to CUI Basic strictly to authorized personnel and apply technical safeguards to prevent unauthorized sharing or transmission.
   
   
4. Decontrol When No Longer Needed
   Once CUI Basic no longer requires protection, it must be decontrolled as soon as possible. This process should be documented, and documents should carry the “Decontrolled” label alongside prior designations.
   

Key Difference: Unlike CUI Specified, which often carries additional legal requirements, CUI Basic follows only the baseline safeguarding rules. However, failure to apply these correctly can still lead to noncompliance and security risks.

Compliance Considerations for CUI Basic

Certain categories of CUI Basic carry heightened compliance obligations. One example is DCRIT (DoD Critical Infrastructure Security Information), which directly impacts contractors in the Defense Industrial Base (DIB).

Under DoD Instruction (DoDI) 5200.48, the Department of Defense established the official CUI program and registry. As a result, DCRIT—and similar sensitive categories—may fall under stricter requirements than those outlined in 32 CFR Part 2002.

For organizations that regularly handle this type of information, compliance often involves:

• Cybersecurity Maturity Model Certification (CMMC): Contractors may need to meet CMMC Level 1, 2, or 3 depending on the sensitivity of the data they access.
• NIST Frameworks: Implementation of NIST SP 800-171 (for protecting Controlled Unclassified Information) and, in some cases, NIST SP 800-172 for advanced protections.
• Internal Readiness: Building a compliance program that includes risk assessments, remediation planning, employee training, and third-party audits.
  

Pro Tip: Working with a certified CMMC advisor can help your organization close compliance gaps, train employees effectively, and prepare for official assessments.

Secure CUI Basic with RSI Security

If your organization works with federal agencies or their contractors, safeguarding CUI Basic must be part of your cybersecurity strategy. This starts with identifying where CUI resides, understanding the threats that could compromise it, and implementing proactive measures to reduce risk.

At RSI Security, we help organizations design and implement end-to-end compliance and security programs for CUI Basic and CUI Specified. Our experts guide you through every step of safeguarding, access control, marking, and decontrolling, ensuring full alignment with federal requirements.

Whether you need help understanding “What is CUI Basic?” or preparing for frameworks like CMMC and NIST SP 800–171, our team provides the tools and expertise to keep your organization secure and compliant.

Contact RSI Security today to protect your sensitive data, strengthen your compliance posture, and gain peace of mind when working with government partners.

Download Our CMMC Checklist