Exercise
Identify CUI Examples
Practice separating CUI from FCI and from ordinary business information.
Advanced
15 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Guide
Understanding Controlled Unclassified Information (CUI)
How to recognize CUI, why marking matters, and what changes the moment you handle it.
- Intended audience
- Anyone working on federal contracts
- Difficulty
- Intermediate
- Estimated time
- 12 minutes
- Access
- Free
NIST SP 800-171
DFARS
CMMC
Government contracting
Version v1.0.0 · Last reviewed 2026-08-01 · Document owner: ComplianceAnvil Content Team
What you will be able to do
- Recognize the characteristics that indicate information is CUI.
- Explain how CUI status can arise even without formal markings.
- List the operational changes that apply once CUI is handled.
- Describe the reporting obligations that attach to CUI-related incidents.
- Identify the correct action to take when CUI status is unclear.
Recognizing it
- It is unclassified information that still requires safeguarding under law, regulation, or government-wide policy.
- It usually arrives with markings or with contract language identifying it.
- If you generate information on behalf of the government about controlled subjects, it can be CUI too.
What changes
- Storage and sharing become restricted to approved systems.
- Encryption expectations apply in transit and at rest.
- Access is limited to people with a need to know.
- Incidents involving it carry reporting obligations and timelines.
If you are not sure
Ask your contracting officer or prime in writing. Guessing in either direction is expensive.
Key takeaways
- CUI is unclassified information that still requires safeguarding under law, regulation, or government-wide policy.
- CUI often arrives with explicit markings or contract language, but information generated on behalf of the government about controlled subjects can also qualify.
- Handling CUI restricts storage and sharing to approved systems and imposes encryption expectations in transit and at rest.
- Access to CUI must be limited to people with a demonstrated need to know.
- Incidents involving CUI carry specific reporting obligations and timelines that must be met.
Sources
Written from these public, authoritative publications. ComplianceAnvil paraphrases and summarizes them; it does not reproduce copyrighted control text.
National Archives (ISOO)
Controlled Unclassified Information (CUI) Registry(opens in a new tab)Link last confirmed 2026-02-01
NIST · Revision 3
SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems(opens in a new tab)Link last confirmed 2026-02-01
Acquisition.gov
DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting(opens in a new tab)Link last confirmed 2026-02-01
Acquisition.gov
FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems(opens in a new tab)Link last confirmed 2026-02-01
Earn a Certificate of Training Completion
Complete every section, acknowledge, and pass the knowledge check.
Sections opened0 of 3
This certificate recognizes completion of educational training material only. It is not a professional certification, accreditation, license, compliance assessment, audit result, or attestation of compliance with any law, regulation, or contract requirement. ComplianceAnvil is not a certification authority, accreditation body, assessor, or law firm.
How this was written and reviewed
Published
- Author
- ComplianceAnvil Editorial Team
- Technical reviewer
- ComplianceAnvil Technical Review Board
- Jurisdiction
- United States (federal); DoD supply chain
- First published
- 2026-08-01
- Last reviewed
- 2026-08-01
- Next review due
- 2027-08-01
Version v1.0.0 · Document owner: ComplianceAnvil Content Team
Important
This resource is educational readiness material. ComplianceAnvil is not a certification authority, assessor, or law firm, and this content is not legal advice or a compliance assessment.
Related resources
Matched on shared frameworks, topics, and program packs.
Checklist
Government Contractor Startup Checklist
What to put in place before your first federal award creates security obligations you cannot meet.
Intermediate
40 min
Free
FAR
DFARS
Published · v1.0.0 · 2026-08-01
Checklist
CMMC Readiness Checklist
Work through the preparation steps most small contractors miss before a CMMC assessment: scope, system boundary, documentation, and evidence.
Intermediate
45 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Checklist
NIST SP 800-171 Preparation Checklist
A plain-language preparation pass across the requirement families, focused on what a small business must produce and prove.
Advanced
60 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Guide
What is NIST SP 800-171?
The requirement set that governs protecting Controlled Unclassified Information in non-federal systems, explained without the jargon.
Intermediate
14 min
Free
NIST SP 800-171
CMMC
Published · v1.0.0 · 2026-08-01
Guide
What is CMMC?
A plain-language explanation of the Cybersecurity Maturity Model Certification program, who it applies to, and what preparation actually involves.
Beginner
12 min
Free
CMMC
NIST SP 800-171
Published · v1.0.0 · 2026-08-01
Put this into practice
Resources tell you what good looks like. A Program Pack does the work with you — generated documentation, tracked controls, training, and evidence in one workspace.