What Is CUI? Controlled Unclassified Information for Machine Shops

What is CUI?

CUI is government information that has to be protected but isn’t classified. The federal rule at 32 CFR 2002.4 defines it as information the government “creates or possesses, or that an entity creates or possesses for or on behalf of the Government,” that a law, regulation, or government-wide policy “requires or permits an agency to handle using safeguarding or dissemination controls.”

Two parts of that definition matter to a shop owner. First, CUI includes what you create for the government, not only what it sends you. Second, the definition leaves out information you hold on your own systems that never came from the government and wasn’t created for it. Your own commercial product drawings aren’t CUI just because you also do defense work.

The program comes from Executive Order 13556. The National Archives (NARA) is the CUI Executive Agent, and it keeps the CUI Registry. The Registry lists every approved category, the law behind it, and how it gets marked. If a type of information isn’t in the Registry, it isn’t CUI.

What's the difference between CUI Basic and CUI Specified?

CUI Basic gets one standard set of handling rules. CUI Specified has its own extra rules, written into the law or regulation that created it. Under 32 CFR 2002.4, CUI Basic is the subset where the authority “does not set out specific handling or dissemination controls,” so the standard rules apply. CUI Specified is where the authority “contains specific handling controls” that differ from Basic. Those can be stricter, or just different.

The practical difference for you shows up in the marking. Category markings are optional on CUI Basic. On CUI Specified, the banner has to name the category, with an “SP-” in front of it.

For safeguarding on your own systems, the rule points the same direction either way. Section 2002.14(h) says agencies “must use NIST SP 800-171” to set the requirements for protecting CUI on non-federal systems, unless the law behind a category sets its own.

DoD adds a wrinkle. DoDI 5200.48, DoD’s CUI instruction (effective March 6, 2020), says that during the department’s phased rollout, “there is no required distinction” between Basic and Specified. DoD information gets Basic protection unless a law or policy says otherwise. Don’t be surprised if markings on DoD paper vary.

How is CUI marked?

CUI gets a banner marking at the top of the page and a designation indicator that says who controls it. Under 32 CFR 2002.20, the banner must include the control marking, which is either “CUI” or the word “CONTROLLED.” It must also list any CUI Specified categories, plus any limited dissemination controls. The banner has to be the same on every page that has CUI.

The designation indicator is mandatory too. It names the agency that designated the information, either through letterhead or a “Controlled by” line, and it can sit on the first page or cover only.

DoD goes further. DoDI 5200.48 calls for a “CUI” marking at the top and bottom of each page. Its designation block has five lines:

• Controlled by: the DoD component (if it’s not already on the letterhead)
• Controlled by: the office
• CUI Category
• Distribution/Dissemination Control
• POC: a phone number or email

You might also see portion markings like “(CUI)” in front of a paragraph. The rule permits and encourages them, but it doesn’t require them. Older DoD documents may still carry the “old FOUO marking,” as DoDI 5200.48 calls it. Part 2002 calls anything marked before the CUI program legacy material, and expects agencies to re-mark it when it qualifies as CUI.

What CUI does a machine shop actually touch?

Usually controlled technical information (CTI), and sometimes export-controlled data. The CUI Registry entry for CTI defines it as “technical information with military or space application” that’s subject to controls on its use, release, or dissemination. Its examples read like a job folder: “engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports,” plus software source code.

The Registry lists CTI as CUI Specified, authorized under DFARS 252.204-7012, with the banner CUI//SP-CTI. It also says CTI is marked with one of the distribution statements B through F under DoDI 5230.24. So a DoD part drawing that came down from a prime with a CUI//SP-CTI banner and a Distribution D statement in the title block is CUI. That’s true whether it came as a PDF, a STEP file, or a printout on the shop floor.

The Export Control category (marking EXPT) covers information whose export could hurt national security, including items under the EAR and ITAR. Depending on the authority behind it, the banner is CUI, CUI//EXPT, or CUI//SP-EXPT. If your work involves ITAR parts, expect this one.

Don’t rely only on the stamp. The DFARS 252.204-7012 clause protects “covered defense information.” That means CTI or other Registry information that’s “marked or otherwise identified in the contract” and provided to you, or that’s “collected, developed, received, transmitted, used, or stored” by you in support of the contract. Read the contract and the flow-down from your prime. If you aren’t sure whether something is CUI, ask the prime in writing.

How is CUI different from FCI?

FCI is the broader, lower tier. The FAR defines Federal Contract Information as information “not intended for public release” that’s provided by or generated for the government under a contract. Purchase orders, delivery schedules, and contract emails are typical. CUI is the narrower set that a specific law or policy says needs protection, and it’s listed in the Registry. All CUI on a contract is also FCI, but most FCI isn’t CUI. We break FCI down in what is FCI.

The tier you’re in changes what you owe. FCI alone puts you at CMMC Level 1, which is 15 basic safeguards. CUI puts you at Level 2.

Why does having CUI pull you into NIST 800-171 and CMMC Level 2?

Because the rules say CUI on a contractor’s systems gets NIST SP 800-171 protection, and CMMC Level 2 is how DoD checks it. Section 2002.14(h) makes NIST SP 800-171 the standard for CUI on non-federal systems. DFARS 252.204-7012 requires it on any contractor system that “processes, stores, or transmits covered defense information.” The CMMC rule at 32 CFR 170 ties Level 2 to the 110 requirements in NIST SP 800-171 Revision 2.

That’s a real project: MFA for every user, FIPS-validated encryption, logging, a system security plan, and a score in SPRS. We walk through it in CMMC Level 2 requirements, including where the program’s rollout stands after the July 2026 Phase 2 suspension.

The cheapest move is to shrink where CUI lives. Every PC, server, and cloud folder that touches a CUI drawing is in scope. If CUI drawings land in a shared inbox and get copied to six workstations and a USB stick for the CNC, all of that is in scope. On a plant floor, that scope question is most of the work. We cover how we handle it on our manufacturing IT page.

Key takeaways

What this looks like when we do it

We’re not a C3PAO, a Registered Practitioner Organization, or an assessor, and we don’t decide what’s CUI. Your prime and your contract do that. Our part is the IT.

For a manufacturer, we start by finding where CUI actually goes. Which inbox gets the drawing packages? Where do they get saved? Which machines open them, and how do they get to the shop floor? Then we pull that path into as small a footprint as we can, put MFA and encryption on it, and segment it from the plant floor and the rest of the office. Legacy Windows boxes running machines get documented and walled off instead of being torn out. More on that on our manufacturing IT support page.

Got a drawing package with a CUI banner and no plan for where it should live? Book a call and we’ll map it with you.