Controlled Unclassified Information is government-related information requiring safeguarding or dissemination controls under an applicable law, regulation, or government-wide policy. It is not classified information, and a private organization’s preference to call material sensitive does not alone establish federal CUI status. [4]
Confirm the category and authority
Start with the CUI Registry and the originating agency’s applicable instructions. NARA’s registry lists approved categories and subcategories, including certain privacy, procurement, and proprietary information categories. A category name is a starting point for identifying the underlying authority, not permission to mark every document containing similar words. [3]
Determine whether the material is CUI Basic or subject to specified requirements. When a contractor receives CUI, the applicable agreement and agency directions can determine the handling obligations. Do not substitute an improvised internal label for the governing requirements. [4]
Use the required markings and safeguards
Section 2002.20 governs CUI markings and the authorized system for applying them. An agency or holder should not invent additional federal CUI markings or assume a legacy label always provides the complete current instruction. Verify the category, any authorized dissemination control, and the applicable implementation guidance. [2]
Section 2002.14 requires safeguarding that minimizes unauthorized access and disclosure. Use approved physical and electronic environments, limit access appropriately, and follow the applicable system and agency requirements. Sending a document through a convenient personal account is not justified simply because the information is unclassified. [1]
Share for an authorized purpose
Under § 2002.16, access or dissemination must comply with the category’s governing authority, further a lawful government purpose, respect authorized limited dissemination controls, and not otherwise be prohibited by law. Before sharing outside the executive branch, the holder must have the specified reasonable expectation that recipients are authorized and understand handling requirements. [5]
Confirm the recipient, purpose, markings, transmission method, and any agreement requirements. A CUI marking is neither a blanket ban on all sharing nor a blanket permission to share with anyone who has a work-related interest.
Destroy only when retention rules allow
Section 2002.14 permits destruction when the agency no longer needs the information and the applicable records-disposition schedule allows it. Destruction must make the information unreadable, indecipherable, and irrecoverable through the applicable authorized method. Deleting a working copy is not automatically an adequate disposition process. [1]
If a file appears mislabeled or arrives through an unapproved route, preserve the facts and contact the responsible agency or CUI official. Privacy, health, or education information may also carry separate legal restrictions; identify each applicable rule rather than assuming the CUI label replaces them.
Related information protections
CUI categories can overlap independent privacy and procurement restrictions. See Privacy Act access and correction of federal agency records and Procurement Integrity Act protections for bid, proposal, and source-selection information.
Primary sources
- 32 CFR 2002.14 — 2025 CFR edition
- 32 CFR 2002.20 — 2025 CFR edition
- CUI Registry | National Archives
- 32 CFR 2002.4 — 2025 CFR edition
- 32 CFR 2002.16 — 2025 CFR edition
Sources checked: October 31, 2026.