CUI Basic
CUI Basic is the subset of Controlled Unclassified Information whose underlying law, regulation, or government-wide policy requires protection but does not prescribe specific handling controls. It is safeguarded at the uniform baseline set by 32 CFR Part 2002, which for contractors maps to the NIST SP 800-171 requirements.
In more detail
Every CUI category in the NARA CUI Registry is either Basic or Specified. Basic is the default: the authority behind the information says protect this, but leaves the how to the government-wide CUI program rules.
In markings, CUI Basic documents carry the banner CUI (or CONTROLLED) with optional category and dissemination markings. Information may be designated CUI only in accordance with an authority listed in the CUI Registry, an agency cannot invent new categories.
For a small contractor the practical takeaway is scoping: receiving any CUI, Basic or Specified, moves you beyond CMMC Level 1. If your contracts only involve Federal Contract Information, none of the CUI handling rules apply to you.
Related terms
- Controlled Unclassified Information
Controlled Unclassified Information (CUI) is unclassified information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. It is explicitly marked CUI by the originating agency and triggers NIST SP 800-171 protections, and at the contractual level, CMMC Level 2.
- CUI Specified
CUI Specified is the subset of Controlled Unclassified Information whose underlying law, regulation, or government-wide policy prescribes its own specific safeguarding or dissemination controls, which apply in addition to or instead of the CUI Basic baseline. Export-controlled technical data under ITAR is a common example.
- NARA CUI Registry
The NARA CUI Registry is the official, public list of every category and subcategory of information that qualifies as Controlled Unclassified Information across the federal government. It is the authoritative source for determining whether a given type of information is CUI.
- 32 CFR Part 2002
32 CFR Part 2002 is the National Archives final rule that implemented Executive Order 13556 across the federal government, defining how agencies designate, mark, safeguard, and disseminate CUI. It is the source of the marking requirements that distinguish CUI from FCI.
- Federal Contract Information
Federal Contract Information (FCI) is non-public information provided by or generated for the federal government under a contract to develop or deliver a product or service. It is the information type protected under FAR 52.204-21 and is the trigger for CMMC Level 1.