CUI is sensitive government information that requires protection under federal law even though it's not classified as secret. If your DoD contract involves technical specifications, export-controlled data, or other government-designated sensitive information, you're handling CUI and need CMMC Level 2 certification. I explain what CUI is, how to identify it in your systems, what marking requirements apply, and how NIST SP 800-171's 110 security controls protect this information from unauthorized disclosure.
Controlled Unclassified Information is any information the government creates or designates for protection under federal law, regulation, or policy, but it's not classified as secret. CUI sits between public information and classified data. Examples include technical drawings protected by export control laws, critical infrastructure data, proprietary business information shared with the government, and personal privacy information. The key identifier is federal law requiring protection. It's not CUI just because someone stamps it confidential or sensitive. The government maintains an official CUI Registry listing 24 authorized categories. If your information falls into one of those categories and your DoD contract requires protection, you're handling CUI.
The DoD created the CUI program because too many contractors were claiming they protected sensitive data without actually implementing security controls. Before CMMC, contractors self certified compliance with NIST SP 800-171 requirements. Some contractors checked the box without building real protections, which led to data breaches exposing defense information to foreign adversaries. CMMC Level 2 fixes this problem by requiring third party C3PAO assessment that verifies you actually implemented the 110 security practices. About 90 percent of defense contractors handle CUI and need Level 2. Only contractors working exclusively with Federal Contract Information like delivery schedules and invoices can use Level 1's simpler 17 practice requirement.
I help contractors understand what information qualifies as CUI in their organization, implement proper marking procedures that satisfy auditors, and build protection systems using the full NIST SP 800-171 control set. The goal isn't compliance documentation that looks good on paper. It's preventing unauthorized CUI disclosure that could cost you contracts, trigger federal penalties, or compromise national security. Most contractors struggle with CUI identification because the categories are broad and the regulations reference multiple authorities. I map CUI flows through your systems, implement controls at every touchpoint where CUI exists, and build evidence that proves your protections work during C3PAO assessment.
All CUI is FCI, but not all FCI is CUI—this determines whether you need CMMC Level 1 or Level 2
CMMC Level 1 Required
Non-public contract administration data provided by or generated for the government. Basic business information.
Examples:
Note: Very few contractors handle only FCI. Most defense work involves at least some CUI, requiring Level 2.
CMMC Level 2 Required
Sensitive government information requiring safeguarding under federal law, regulation, or policy. Marked with CUI banners.
Examples:
Critical: About 90% of defense contractors handle CUI. If unsure, assume Level 2 applies to your contract.
Four-step framework for determining if your contract data is CUI
Documents containing CUI must be marked. Look for these indicators:
Your contract clauses specify CUI requirements:
The National Archives maintains the authoritative CUI Registry with 24 categories:
Only the government can designate information as CUI:
Seven common CUI types in DoD contracts with practical examples
CUI//EXPT
CUI//CRIT
CUI//PROPIN
CUI//OPSEC
CUI//NUCL
CUI//PRVCY
CUI//PROAC
These 7 categories cover most defense contractor work. The full NARA CUI Registry lists all 24 authorized categories across government.
Proper marking is mandatory for CUI protection and CMMC compliance
Every CUI document must have banners at the top and bottom of each page:
(CUI) TECHNICAL SPECIFICATION - AIRCRAFT GUIDANCE SYSTEM
This document contains controlled technical information for defense systems...
Controlled by: DFARS 252.204-7012
Category: Export Control (CUI//EXPT)
Distribution: U.S. contractors only - no foreign disclosure
Add category codes and distribution controls after the CUI banner:
CUI//EXPT
Export Control - ITAR/EAR data
CUI//PRVCY
Privacy - PII or PHI data
CUI//SP-CRIT//NOFORN
Critical Infrastructure - no foreign disclosure
CUI//SP-PROPIN
Proprietary Business Information
Subject line:
CUI - Technical review meeting agenda
Message body:
CUI
Attached are the technical specifications for review...
CUI
Essential practices and critical mistakes to avoid
Follow these practices to properly safeguard Controlled Unclassified Information
Avoid these common violations that risk compliance failures and contract loss
No CMMC certification means no contract award. DoD requires Level 2 for any contract involving CUI.
CUI disclosure can compromise defense programs, expose vulnerabilities, or help foreign adversaries.
Export control violations carry civil and criminal penalties. CUI spillage can mean contract termination.
CMMC exists specifically to verify CUI protection. Before CMMC, contractors self-certified compliance with NIST SP 800-171 requirements. Some claimed they implemented security controls without actually doing the work. This led to data breaches where CUI was stolen from contractor networks and used by foreign intelligence services. The DoD created CMMC to stop self-certification fraud by requiring independent third-party assessment.
CMMC Level 2 requires all 110 practices from NIST SP 800-171. C3PAO assessors verify each control actually works. They don't accept documentation claiming compliance. They test your access controls by attempting unauthorized access. They review your incident response procedures and verify you can detect CUI theft. They examine your encryption implementation and confirm CUI is protected at rest and in transit. Failed assessments mean no certification and no contract award.
About 90 percent of defense contractors handle CUI and need Level 2. Only contractors working exclusively with Federal Contract Information like delivery schedules can use Level 1. If your contract involves technical data, export-controlled information, critical infrastructure data, or anything marked with a CUI banner, you need Level 2. Understanding what CUI is and where it exists in your organization is the first step toward CMMC certification.
14 control families with 110 security practices protecting CUI from unauthorized disclosure
All 110 practices work together as a complete security framework. You can't pick which controls to implement—C3PAO assessors verify every requirement. Missing access controls makes audit logs useless. Skipping incident response means you can't detect CUI theft. Ignoring physical security lets adversaries bypass your technical protections. View my CMMC 2.0 Overview Guide for complete coverage of all 14 families.
Your required level depends on whether you handle FCI or CUI
Rare. Most contractors handle at least some CUI.
Most common. About 90% of defense contractors need Level 2.
Very rare. Only 1% of contractors. DoD specifies when Level 3 is required.
Whether you're just learning your contract involves CUI or preparing for CMMC Level 2 certification, I help defense contractors implement practical controls that protect sensitive government data and satisfy C3PAO assessors. Let's discuss your contract requirements, map CUI flows through your systems, and build protection that works.