Controlled Unclassified Information

Definition

Information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

Defense Federal Acquisition Regulation Supplement DFARS Clause 252.204-7012

CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with laws, regulations, and government-wide policies, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or Atomic Energy Act of 1954, as amended.

Required Protection

• NIST 800-171
• 130 Practices
• CMMC Equivalency: Level 3 or higher