The Department of Defense’s Controlled Unclassified Information program sorts protected information into named categories, each tied to a specific law or regulation, and each grouped under one of nineteen high-level index groupings in the DoD CUI Registry. The DoD CUI categories fall into two protection tiers, carry standardized markings, and often come with limited dissemination controls that decide who can receive the information. Getting the category right is the first step in every other handling decision.
CUI Basic and CUI Specified
Every category sits in one of two tiers established by 32 CFR Part 2002.1eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) The tier decides how restrictive the rules are.
CUI Basic is the default. A law or regulation requires the information to be protected, but it does not spell out handling procedures beyond the baseline safeguards in 32 CFR Part 2002. Most CUI in daily DoD work sits here. Follow the baseline rules on access, marking, storage, and destruction and you have met the requirement.
CUI Specified applies when a statute or government-wide policy demands controls beyond the baseline. The registry flags these categories with a “Specified” label and points to the exact legal authority that imposes the extra requirements. Privacy Act information is one example: the statute itself dictates specific dissemination restrictions, so the category carries Specified status. When a category is Specified, that listed authority controls, not just the general 32 CFR Part 2002 defaults.
The Index Groupings
The DoD organizes categories under high-level index groupings that work like folders. The groupings themselves never appear on document markings. They exist so personnel can navigate the registry and find the right category. DoDI 5200.48 establishes this structure for the Department.2Department of Defense. DoD Instruction 5200.48 – Controlled Unclassified Information (CUI)
The DoD CUI Program lists these groupings: Critical Infrastructure, Defense, Export Control, Financial, Immigration, Intelligence, International Agreements, Law Enforcement, Legal, Natural and Cultural Resources, North Atlantic Treaty Organization, Nuclear, Patent, Privacy, Procurement and Acquisition, Proprietary Business Information, Statistical, Tax, and Transportation.3DoD CUI Program. DoD CUI Program Someone protecting military operational data starts in Defense. Someone handling a contractor’s trade secrets looks under Proprietary Business Information. The grouping narrows the search; the specific category inside it sets the handling rules.
Categories You Will See Most Often
Hundreds of categories exist across those groupings, but a handful appear far more often than the rest in DoD documents and contracts.
Controlled Technical Information
Controlled Technical Information, abbreviated CTI, covers technical data with military or space applications: engineering drawings, test reports, software documentation, and operating manuals for weapons systems. CTI is CUI Specified, and its authority (DoDI 5230.24) imposes handling requirements beyond the baseline. It is one of the largest categories by volume in the defense industrial base and shows up in nearly every major DoD contract.
Export-Controlled Information
Export-Controlled Information protects data regulated under the International Traffic in Arms Regulations or the Export Administration Regulations. The concern is preventing foreign nationals from obtaining sensitive American technology, whether by deliberate transfer or accidental disclosure. Criminal penalties for ITAR violations can reach $1,000,000 per violation and up to 20 years in prison, plus debarment from future defense trade.4Directorate of Defense Trade Controls. DDTC Compliance Actions Even unintentional releases can trigger enforcement, so access controls and situational awareness (who is actually in the room when the data is discussed) matter here.
General Privacy
The General Privacy category (abbreviated PRVCY) protects personally identifiable information held by the DoD. That includes Social Security numbers, financial account numbers, biometric data such as fingerprints and iris scans, dates of birth, citizenship status, criminal history, and system authentication credentials like passwords.5DoD CUI Program. General Privacy Its authority comes from the Privacy Act (5 U.S.C. 552a) and OMB Memorandum M-17-12, among other sources. Documents containing PRVCY data may require a Privacy Act Statement. The category carries Specified status because the Privacy Act itself dictates dissemination restrictions.
Infrastructure Security Information
This category protects details about physical and virtual systems that support national security, including power grids, water treatment facilities, and communication networks. If an adversary learns the specific vulnerabilities or configurations of these systems, they can exploit them. Infrastructure security data appears frequently in DoD contracts involving facility construction, utility management, and cybersecurity assessments of military installations.
Nuclear Categories
Several categories fall under the Nuclear grouping. Naval Nuclear Propulsion Information protects technical data on the design, construction, and operation of nuclear-powered ships, with its authority rooted in the Atomic Energy Act. Separately, 10 CFR Part 810 governs the transfer of unclassified nuclear technology and assistance to foreign atomic energy activities, controlling what nuclear know-how can leave the country and under what conditions.6Department of Energy. 10 CFR Part 810 Mishandling nuclear CUI can result in loss of contracts, administrative sanctions, and referral for criminal investigation.
Legal Privilege
The Legal Privilege category protects attorney-client communications and attorney work product inside the CUI framework. It uses two limited dissemination controls to preserve the privilege: Attorney Client Privilege (marked AC) and Attorney Work Product (marked AWP).7National Archives. CUI Category: Legal Privilege The banner marking is CUI//PRIVILEGE. This is one of the few categories where the dissemination control is inseparable from the category, because sharing the information outside the attorney-client relationship can destroy the legal protection permanently.
Limited Dissemination Controls
On top of the Basic and Specified tiers, dissemination controls decide who can actually receive a piece of CUI. They appear as abbreviations appended to the marking. Using the wrong one means either over-sharing sensitive data or blocking people who need it.
- NOFORN: cannot be shared with foreign governments, foreign nationals, or international organizations under any circumstances.8DoD CUI Program. Limited Dissemination Controls
- FED ONLY: only federal executive branch employees and U.S. armed forces personnel may access the data.
- FEDCON: federal employees and contractors working under a U.S. government contract may access it, as long as the access supports the contract’s purpose.
- NOCON: contractors are excluded, but state, local, and tribal employees may receive the information.
- DL ONLY: only individuals or organizations on an accompanying dissemination list may access the data.
- REL TO USA, [list]: the originating agency has pre-approved release to specific foreign countries or international organizations listed after REL TO. Everyone else is treated as NOFORN.
- DISPLAY ONLY: a foreign recipient may view the information but cannot retain a physical or digital copy.
Two additional controls protect legally privileged communications. ATTORNEY-CLIENT restricts dissemination beyond the attorney, the attorney’s agents, and the client. ATTORNEY-WP does the same for work product prepared in anticipation of litigation.8DoD CUI Program. Limited Dissemination Controls Misapplying either can waive the privilege entirely.
Marking a Document Once You Know the Category
Proper marking is where the CUI program either works or falls apart. Before putting any label on a document, review the content, identify the source of the information, and look up the matching category in the DoD CUI Registry. The registry tells you whether the category is Basic or Specified and which dissemination controls apply. Skipping this step and marking based on instinct is one of the most common compliance failures.
Every CUI document requires a banner marking at the top and bottom of each page. For CUI Basic with no dissemination restrictions, the banner reads simply “CUI.” For CUI Specified, the banner includes the category abbreviation, such as “CUI//SP-CTI” for Specified Controlled Technical Information. Limited dissemination controls are appended after the category designation. Individual paragraphs and sections also receive portion markings so a reader can tell at a glance which parts contain controlled information.2Department of Defense. DoD Instruction 5200.48 – Controlled Unclassified Information (CUI)
The first page must also include a CUI Designation Indicator block. It identifies the agency or office that designated the information, provides a point of contact, and lists the controlling authority. Without it, a recipient has no way to verify the marking or request decontrol. For digital files, agencies may authorize alternate indicators such as splash screens on IT systems, but the visual marking requirements on the document itself do not change with the format.
Access and Training Before You Touch CUI
Access to CUI is not automatic. Before anyone handles controlled information, they must complete CUI awareness training and sign a CUI Non-Disclosure Agreement. The NDA requires the signer to initial each CUI category they will access and to acknowledge training on proper handling.9Defense Counterintelligence and Security Agency. DoD CUI Non-Disclosure Agreement The obligations last as long as the information remains controlled, even after the person changes jobs or leaves government service.
Training is not a one-time event. DoD standards require annual refresher training for anyone who handles CUI, covering identification, marking, storage and sharing rules, and incident reporting. Violating the NDA or failing to complete required training can result in revoked access, denial of access to other controlled information, and administrative, disciplinary, civil, or criminal penalties. The NDA even includes a clause requiring the signer to assign any royalties earned from an unauthorized disclosure back to the U.S. government.
When CUI Spills
A spillage occurs when CUI lands on a system not authorized to hold it, or when someone without proper access views or receives it. The response is time-sensitive. Under DFARS 252.204-7012, contractors must report a cyber incident involving covered defense information within 72 hours of discovering it.10Acquisition.GOV. 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting The clock runs from discovery, not resolution, so waiting until you fully understand the scope before reporting will put you out of compliance.
Remediation follows a predictable sequence. Isolate the affected system and cut off further access. Investigate the root cause and assess how much data was exposed and to whom. Securely delete or retrieve the exposed information and patch whatever vulnerability allowed the spillage. Document the root cause, the remediation steps, and any lessons learned. That documentation matters for internal compliance, for CMMC assessments, and for potential government audits.
For destruction of CUI media that is no longer needed, NIST Special Publication 800-88 provides the approved sanitization methods, including secure erase and cryptographic erasure for digital media.11National Institute of Standards and Technology. NIST SP 800-88 Rev. 1 – Guidelines for Media Sanitization Hard-copy CUI must be destroyed so it cannot be read or reconstructed. Tossing a CUI document into a standard office recycling bin is itself a spillage event.