Information May Be Cui In Accordance With

When Information Qualifies as Controlled Unclassified Information (CUI)

Not all sensitive government-related information is classified. In fact, a vast and critical category of protected data exists in the space between public information and top-secret classification: Controlled Unclassified Information, or CUI. Understanding when information may be CUI is fundamental for any individual or organization working with the U.S. federal government or its data. It is not a label applied casually; it is a formal designation rooted in law, policy, and a specific national need to safeguard information that, while not meeting the stringent criteria for classification, still requires consistent, mandatory protection. This article provides a definitive guide to the criteria, frameworks, and practical implications that determine when information is officially considered CUI in accordance with federal regulations.

The Core Concept: What is CUI and Why Does It Exist?

CUI is defined by 32 CFR Part 2002 as "information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to safeguard or control." The key phrase is "requires or permits." This means CUI is not simply any sensitive data; it is information whose protection is mandated by a specific legal or regulatory authority.

The existence of the CUI framework, established by Presidential Memorandum M-13-13 and codified in the regulations, solves a historic problem: inconsistent handling. Before CUI, agencies had dozens of their own categories for sensitive but unclassified information (like "Sensitive But Unclassified" or SBU), leading to a patchwork of rules. CUI creates a single, government-wide program with standardized markings, safeguarding, and dissemination rules. Its purpose is to protect information vital to national security, economic interests, privacy, and other critical government functions that does not rise to the level of requiring classification under Executive Order 13526.

The Legal and Regulatory Foundation: "In Accordance With" What?

The phrase "in accordance with" is crucial. Information is designated as CUI only in accordance with an authoritative source. These sources form a hierarchy:

1. The CUI Registry: This is the official, centralized list maintained by the National Archives and Records Administration (NARA). It is the primary reference. The Registry categorizes CUI into 22 Disciplines (e.g., Critical Infrastructure, Export Control, Privacy, Proprietary Business Information) and numerous subcategories. If your data fits a category listed here, and its safeguarding is required by the underlying law or regulation cited in the Registry, it is CUI.
2. Authorizing Statutes and Regulations: Each CUI category in the Registry is backed by a specific "authority." For example:
   • CUI//PRIVACY is authorized by the Privacy Act of 1974 and other laws protecting personally identifiable information (PII).
   • CUI//PROPRIETARY is authorized by procurement laws and the Freedom of Information Act (FOIA) exemptions.
   • CUI//CRITICAL INFRASTRUCTURE is authorized by the Patriot Act and Homeland Security directives.
   • CUI//EXPORT CONTROL is authorized by the International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR).
3. Government-Wide Policies: Agency-specific policies cannot create new CUI categories. They can only implement the rules for categories already in the Registry. The baseline safeguarding requirements are found in NIST SP 800-171 Rev. 3, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," which is mandated for all non-federal contractors.

In summary: Information is CUI if it is specifically identified in the CUI Registry and its protection is required by the law, regulation, or government-wide policy cited for that category.

Key Criteria: How to Determine if Your Information is CUI

To assess if information may be CUI, you must apply a three-part test in accordance with the framework:

1. Is the Information Created or Possessed by or for the Federal Government? CUI status is tied to government ownership or stewardship. A private company's purely internal trade secrets, with no government contract or grant involving that data, are not CUI. However, that same trade secret submitted in a government proposal or under a contract becomes CUI//PROPRIETARY.
2. Does it Fit a Category in the CUI Registry? You must be able to point to a specific category (e.g., CUI//FINANCIAL, CUI//LAW ENFORCEMENT SENSITIVE, CUI//GEOSPATIAL). The Registry descriptions provide the defining characteristics.
3. Is there a Mandatory Safeguarding Requirement? The underlying authority for that category must require the agency to control the information. Merely being "sensitive" is insufficient. For instance, while all Personally Identifiable Information (PII) is sensitive, only PII that meets the specific criteria for CUI//PRIVACY (e.g., PII collected under a government program where the Privacy Act applies) is designated as CUI. General business contact information is not CUI.

Common Examples of CUI Categories:

• CUI//PRIVACY: PII covered by the Privacy Act, medical records (HIPAA-protected when held by the government), student records (FERPA).
• CUI//PROPRIETARY: Source selection information, contractor trade secrets, confidential commercial or financial data obtained in a government procurement.
• CUI//CRITICAL INFRASTRUCTORY: Information about vulnerabilities in power grids, water systems, or financial networks.
• CUI//EXPORT CONTROL: Technical data subject to

Common Examples of CUI Categories (Continued)

...CUI//EXPORT CONTROL: Technical data subject to restrictions under ITAR and EAR, including schematics, manufacturing processes, and software code. CUI//LAW ENFORCEMENT SENSITIVE: Information related to law enforcement investigations, including case files, witness statements, and investigative techniques. CUI//NATIONAL SECURITY: Information that could compromise national defense, such as military plans, intelligence assessments, and classified research.

Understanding the Agency's Role

It's crucial to understand that CUI designation isn't solely the responsibility of the information owner. Agencies play a vital role in safeguarding CUI. This involves establishing and enforcing policies, implementing security controls, and providing training to personnel who handle CUI. Agencies must demonstrate a commitment to protecting CUI throughout its lifecycle, from creation to disposal. This commitment is reflected in their CUI safeguarding plans and the resources allocated to implementing them.

Navigating the CUI Landscape

The CUI landscape is complex and constantly evolving. New categories are added to the Registry regularly, and existing categories may be updated with more specific requirements. Staying informed about these changes is essential for ensuring compliance. Resources like the NIST CUI Registry and agency-specific guidance are invaluable tools for navigating this environment. Furthermore, regular reviews of CUI handling practices are necessary to identify and address any gaps in security.

Conclusion

CUI is a critical aspect of government information management, designed to protect sensitive data that is essential for national security, privacy, and economic competitiveness. Understanding the three-part test for determining CUI status, the agency's role in safeguarding it, and staying abreast of evolving regulations are paramount for organizations operating within the federal government ecosystem. By diligently applying these principles, organizations can effectively manage CUI, mitigate risks, and contribute to a more secure and trustworthy information environment. The ongoing commitment to robust CUI management is not just a regulatory requirement; it’s a fundamental principle of responsible government stewardship.

The CUI framework is designed to be flexible and adaptable to the ever-changing landscape of information security threats. As new technologies emerge and adversaries develop more sophisticated tactics, the CUI program must evolve to address these challenges. This ongoing evolution requires a proactive approach from both information owners and agencies, emphasizing continuous improvement in safeguarding practices. The integration of emerging technologies, such as artificial intelligence and machine learning, into CUI protection strategies is becoming increasingly important to enhance detection and response capabilities.

Moreover, the human element remains a critical factor in CUI security. Regular training and awareness programs are essential to ensure that all personnel understand their roles and responsibilities in protecting sensitive information. These programs should cover not only the technical aspects of CUI handling but also the ethical considerations and potential consequences of mishandling such data. By fostering a culture of security awareness, organizations can significantly reduce the risk of insider threats and human error, which are often the weakest links in information security chains.

As the volume of CUI continues to grow, organizations must also focus on developing efficient systems for categorizing, storing, and retrieving this information. This includes implementing robust data management practices and leveraging advanced technologies for automated classification and access control. The goal is to strike a balance between security and accessibility, ensuring that authorized personnel can access the information they need while preventing unauthorized disclosure. By adopting a holistic approach to CUI management that combines technological solutions with human expertise and organizational policies, entities can create a resilient framework for protecting sensitive government information in an increasingly complex digital world.