What is CUI Basic?

Sensitive information that could impact the safety of US citizens is often classified by the US government. But beyond formally classified documents, there are other kinds of data that are similarly sensitive and need to be protected. These are grouped under the term Controlled Unclassified Information (CUI), which can be Basic or Specified. So, what is CUI Basic?

 

What is CUI Basic? A Beginner’s Guide

CUI Basic is a subset of CUI that is not directly subject to any special requirements, beyond the baseline protections for all CUI. There are many categories of CUI Basic, relevant to several industries and any organizations that work closely with governmental entities.

The most critical things to understand about CUI Basic include:

• What CUI is as a general category
• Which subsets of CUI are Basic
• How to protect all kinds of CUI

Beyond these, other considerations include how CUI Basic relates to regulatory compliance for specific industries and niches, such as organizations that work with the US Military.

 

What is Controlled Unclassified Information?

Controlled Unclassified Information is data that the US government has deemed sensitive and in need of protection, despite not carrying formal “classified” status. All CUI is subject to safeguarding, dissemination, marking, and other requirements. These govern who has access to the CUI, what they are able or required to do with it, and under what circumstances.

Many authorities intersect to govern CUI. However, a select few are the most important.

Namely, per Executive Order 13566, the National Archives and Records Administration (NARA) oversees all agency matters related to compliance. NARA delegates certain responsibilities to the Information Security Oversight Office (ISOO).

The ISOO has established requirements for all agencies and private organizations to safeguard, disseminate, decontrol, and mark CUI. The legal document 32 CFR Part 2002 prescribes controls all impacted parties need to implement and other rules they need to follow.

Certain categories of CUI are also subject to other controls, beyond what the ISOO has deemed necessary for all CUI.

 

Request a Free Consultation

 

Which Categories of CUI are Basic?

From a definition perspective, there’s a bit of circular reasoning with CUI Basic and CUI Specified. CUI Basic comprises all CUI that is not Specified. This begs the question: What is CUI Specified? It’s defined as any CUI that is directly beholden to additional requirements beyond those placed on CUI Basic. 

In total, there are 125 categories of CUI. These fall into 21 Organizational Index Groupings. And there are 93 CUI Basic categories, which are distributed across 17 of these niches:

• Critical Infrastructure – 11 Basic categories:

1. Ammonium Nitrate (CRITAN)
2. Chemical-terrorism Vulnerability Information (CVI)
3. Critical Energy Infrastructure Information (CEII)
4. Emergency Management (EMGT)
5. General Critical Infrastructure Information (CRIT)
6. Information Systems Vulnerability Information (ISVI)
7. Physical Security (PHYS)
8. Protected Critical Infrastructure Information (PCII)
9. SAFETY Act Information (SAFE)
10. Toxic Substances (TSCA)
11. Water Assessments (WATER)

• Defense – Three Basic categories:

1. Controlled Technical Information (CTI)
2. Naval Nuclear Propulsion Information (NNPI)
3. Unclassified Controlled Nuclear Information – Defense (DCNI)

• Export Control – Two Basic categories:

1. Export Controlled (EXPT)
2. Export Controlled Research (EXPTR)

• Financial – 10 Basic categories:

1. Bank Secrecy (FSEC)
2. Comptroller General (COMPT)
3. Electronic Funds Transfer (XFER)
4. Federal Housing Finance Non-Public Information (FHFA HPI)
5. Financial Supervision Information (FSI)
6. General Financial Information (FNC)
7. International Financial Institutions (FINT)
8. Mergers (MERG)
9. Net Worth (NETW)
10. Retirement (RTR)

• Immigration – Seven Basic categories:

1. Asylee (ASYL)
2. Battered Spouse or Child (BATT)
3. Permanent Resident Status (RESD)
4. Status Adjustment (ADJ)
5. Temporary Protected Status (PROT)
6. Victims of Human Trafficking (IVIC)
7. Visas (VISA)

• Intelligence – Four Basic categories:

1. Agriculture (AG)
2. General Intelligence (INTEL)
3. Internal Data (ID)
4. Operations Security (OPSEC)

• Law Enforcement – 12 Basic categories:

1. Committed Person (CMPRS)
2. Communications (LCOMM)
3. General Law Enforcement (LEI)
4. Informant (INF)
5. Investigation (INV)
6. Juvenile (JUV)
7. National Security Letter (LNSL)
8. Pen Register/Trap & Trace (TRACE)
9. Reward (RWRD)
10. Sex Crime Victim (SCV)
11. Terrorist Screening (LSCRN)
12. Whistleblower Identity (WHSTL)

• Legal – 11 Basic categories:

1. Administrative Proceedings (ADPO)
2. Child Victims or Witnesses (CVIC)
3. Collective Bargaining (BARG)
4. Federal Grand Jury (JURY)
5. Legal Privilege (PRIVILEGE)
6. Legislative Materials (LMI)
7. Presentence Report (PRE)
8. Prior Arrest (PRIOR)
9. Protective Order (LPROT)
10. Victim (LVIC)
11. Witness Protection (WIT)

• Nuclear – Four Basic categories:

1. General Nuclear (NUC)
2. Nuclear Recommendation Material (RECCOM)
3. Nuclear Security-Related Information (SRI)
4. Unclassified Controlled Nuclear Information – Energy (UCNI)

• Patent – Three Basic categories:

1. Inventions (INVENT)
2. Patent Applications (APP
3. Secrecy Orders (PSEC)

• Privacy – Eight Basic categories:

1. Death Records (DREC)
2. General Privacy (PRVCY)
3. Genetic Information (GENETIC)
4. Health Information (HLTH)
5. Inspector General Protected (PRIIG)
6. Military Personnel Records (MIG)
7. Personnel Records (PERS)
8. Student Records (STUD)

• Procurement and Acquisition – Two Basic categories:

1. Small Business Research and Technology (SBIZ)
2. Source Selection (SSEL)

• Proprietary Business Information – Five Basic categories:

1. Entity Registration Information (CONREG)
2. General Proprietary Business Information (PROPIN)
3. Ocean Common Carrier and Marine Terminal Operator Agreements (OCCMTO)
4. Ocean Common Carrier Service Contracts (SERV)
5. Proprietary Postal (POST)

• Provisional – 8 Basic categories:

1. Homeland Security Agreement Information
2. Homeland Security Enforcement Information
3. Information Systems Vulnerability Information – Homeland
4. International Agreement Information – Homeland
5. Operations Security Information
6. Personnel Security Information
7. Physical Security – Homeland
8. Privacy Information

• Statistical – Three Basic categories:

1. Investment Survey (SURV)
2. Pesticide Producer Survey (PEST)
3. Statistical Information (STAT)

• Tax – Two Basic categories:

1. Tax Convention (CONV)
2. Taxpayer Advocate Information (TAI)

• Transportation – One Basic category:

1. Railroad Safety Analysis Records (RAIL)

• (No Grouping) – One Basic category:

1. DoD Critical Infrastructure Security Information (DCRIT)

Note that, of these 93 CUI Basic categories, 27 also carry the Specified designation. This means that, depending on the contents of the specific document in question, either the Basic or the Specified designation will be appropriate.

Whether you deal primarily in Basic or Specified CUI (or both) will determine what kinds of controls or what level of system is required for CUI at your organization.

How to Ensure the Security of CUI Basic

All CUI is subject to the rules and requirements set out in 32 CFR Part 2022, governing the safeguarding, access, and dissemination of CUI. These include requirements for storage, processing, and transmission, building on frameworks like NIST SP 800-53 and FIPS PUB 200.

In the aggregate, CUI Basic controls require thorough cybersecurity planning to secure CUI throughout its lifecycle. Even processes like discarding CUI files need to be carefully planned; questions like “what is the goal of destroying CUI” should inform every action taken.

One way to safeguard CUI and control its access and dissemination is through marking. Every document, regardless of category, needs to clearly display “Controlled” or “CUI.”

CUI Basic differs from Specified in that Basic marking does not need to include a code for the category. However, CUI Basic documents may need to carry additional marking such as “AC” for Attorney-client privilege or “DISPLAY ONLY” followed by specific countries if it is only authorized for disclosure in those places.

Finally, organizations also need to decontrol CUI at their earliest possible convenience once it has been determined that the data no longer requires protection. And “Decontrolled” status also needs to be marked alongside other designations above.

 

Compliance Considerations for CUI Basic

One particular category of CUI Basic, DCRIT, is directly related to compliance concerns for Defense Industrial Base (DIB) contractors. DoD Instruction 5200.48 implements the DoD CUI program and DoD CUI Registry. Because of that, DCRIT is subject to several regulatory frameworks with controls well above 32 CFR Part 2022’s scope.

If your organization works in any capacity with the US Military or comes into contact with DCRIT information regularly, you may need to achieve Cybersecurity Maturity Model Certification (CMMC). There are multiple CMMC Levels that may be required, entailing implementation of NIST SP 800-171 and potentially SP 800-172 controls.

Working with a CMMC advisor will help you prepare for any remediation, employee training, and assessments needed to secure CUI.

 

Secure CUI Basic with RSI Security

If your organization works with governmental agencies, directly or indirectly, you may need to account for CUI in your cyberdefense program. That means identifying where that information lives and what threats could compromise it, then minimizing and mitigating any risks proactively.

RSI Security will help you rethink your approach to safeguarding, accessing and disseminating, decontrolling, and marking CUI. To dive deeper into questions like what is CUI basic, or how does CUI Basic differ from CUI Specified, contact RSI Security today!