CUI Specified
CUI Specified is the subset of Controlled Unclassified Information whose underlying law, regulation, or government-wide policy prescribes its own specific safeguarding or dissemination controls, which apply in addition to or instead of the CUI Basic baseline. Export-controlled technical data under ITAR is a common example.
In more detail
The difference between CUI Basic and CUI Specified is who sets the handling rules. For Basic, the government-wide CUI program (32 CFR Part 2002) supplies the controls. For Specified, the authority that created the category spells out its own, and those controls take precedence where they differ.
Specified categories are marked with an SP- prefix in the banner, for example CUI//SP-CTI for controlled technical information. The NARA CUI Registry lists every category and identifies which are Specified.
Contractors encounter CUI Specified most often as export-controlled data on defense programs. Handling it means CMMC Level 2 territory plus the underlying regime itself, such as ITAR. FCI-only contractors at CMMC Level 1 do not handle CUI Specified by definition.
Related terms
- Controlled Unclassified Information
Controlled Unclassified Information (CUI) is unclassified information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. It is explicitly marked CUI by the originating agency and triggers NIST SP 800-171 protections, and at the contractual level, CMMC Level 2.
- CUI Basic
CUI Basic is the subset of Controlled Unclassified Information whose underlying law, regulation, or government-wide policy requires protection but does not prescribe specific handling controls. It is safeguarded at the uniform baseline set by 32 CFR Part 2002, which for contractors maps to the NIST SP 800-171 requirements.
- NARA CUI Registry
The NARA CUI Registry is the official, public list of every category and subcategory of information that qualifies as Controlled Unclassified Information across the federal government. It is the authoritative source for determining whether a given type of information is CUI.
- Controlled Technical Information
Controlled Technical Information (CTI) is technical data or computer software with military or space application that has been marked with one of the DoD distribution statements (B through F). It is a specific category of CUI and a specific category of Covered Defense Information under DFARS 252.204-7012.
- 32 CFR Part 2002
32 CFR Part 2002 is the National Archives final rule that implemented Executive Order 13556 across the federal government, defining how agencies designate, mark, safeguard, and disseminate CUI. It is the source of the marking requirements that distinguish CUI from FCI.