Protecting Controlled Unclassified Information means marking it correctly, limiting access to people with a lawful need, applying the physical and technical safeguards set out in 32 CFR Part 2002 and NIST Special Publication 800-171, destroying it to standard when it is no longer needed, and reporting any incident quickly. If you are a defense contractor, those same obligations flow to you through DFARS 252.204-7012 and, increasingly, through Cybersecurity Maturity Model Certification. How to protect CUI is fundamentally a question of doing each of those steps consistently, because a failure at any one of them can unwind the rest.
Know What You Are Protecting
CUI is information the federal government creates or possesses, or that a contractor creates or possesses on the government’s behalf, where a law, regulation, or government-wide policy requires safeguarding or dissemination controls.1eCFR. 32 CFR 2002.4 – Definitions The program splits into two subcategories, and the difference changes what you actually have to do.
CUI Basic is the default. The underlying authority requires protection but doesn’t spell out how, so you follow the uniform controls in 32 CFR Part 2002 and the CUI Registry. CUI Specified is different: the underlying law or policy prescribes its own controls, which may be stricter than the Basic defaults. Where the Specified authority is silent on some aspect of handling, Basic controls fill the gap. Applying only Basic-level protections to Specified information can violate the underlying statute, so check the CUI Registry, maintained by the National Archives, to see which category you are dealing with and which authority controls.2National Archives. CUI Registry – Controlled Unclassified Information
Mark It So Downstream Handling Works
Marking is where protection begins. Without correct markings, whoever receives the document has no way to know it requires special handling, and every safeguard downstream can fail.
Every CUI document needs a banner marking at the top and bottom of each page and a CUI Designation Indicator block on the first page. The designation block identifies the CUI category or categories, any dissemination controls, and the office responsible for the designation. For CUI Basic, the banner reads “CUI” or “CONTROLLED.” CUI Specified adds the category name or abbreviation.3eCFR. 32 CFR Part 2002 – Controlled Unclassified Information
Emails follow the same logic. Put the banner in the subject line and at the top of the body, and keep it there through replies and forwards. If your organization generates CUI in a digital system, build the markings into templates so they cannot be omitted by accident.
Limit Access to Need-to-Know
Access to CUI requires two things at once: the person must have a lawful government purpose, and the information must be necessary for their specific duties. Clearance or office assignment alone does not qualify someone to see CUI.3eCFR. 32 CFR Part 2002 – Controlled Unclassified Information
In practice, that means tightening folder permissions, keeping distribution lists narrow, and reviewing access rosters when people change roles. The failure mode here is rarely dramatic. It is a shared drive that an entire department can reach when only three people actually need the files. Periodic access reviews catch that drift before it becomes an incident.
Physical Safeguards
Physical CUI, meaning printed documents and portable media, needs protection scaled to the setting. During working hours, keep it in a controlled area where only authorized people can reach it. After hours, lock it in a desk, filing cabinet, or similarly secured container. Facilities that regularly handle CUI should have access control at entry points so entries are logged and verifiable.
The easy-to-overlook cases matter. Whiteboards and flip charts count as CUI once someone writes controlled information on them. Printer output trays in shared spaces are a constant risk. Leaving CUI on a desk during lunch in a building that admits visitors is a safeguarding failure whether or not anyone actually takes the document. The standard is whether the information was protected at every moment, not whether a compromise happened.
Technical Safeguards
Digital CUI lives on networks, endpoints, and cloud systems, and the majority of NIST SP 800-171’s 110 security requirements address that reality. Revision 2 organizes those requirements into 14 families covering access control, audit and accountability, configuration management, incident response, media protection, and related areas. Revision 3 was published in May 2024 and reorganizes the requirements into 17 families, but CMMC Level 2 still references Revision 2 as of 2026.4NIST Computer Security Resource Center. NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations5Department of Defense CIO. About CMMC
Encryption
Any cryptographic module used to protect CUI must be validated under FIPS 140-2 or its successor, FIPS 140-3. That applies to data at rest on drives, data in transit over networks, and data on portable media like USB drives. Consumer-grade tools that have not gone through FIPS validation do not satisfy the requirement even if they use the same underlying algorithms. Check the NIST Cryptographic Module Validation Program database before trusting a product.
Authentication and Network Controls
Role-based access limits who can reach CUI digitally. Pair it with multi-factor authentication, which NIST 800-171 requires for network access to privileged and non-privileged accounts when CUI is involved.6NIST. NIST SP 800-171 Rev 2 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations Firewalls, intrusion detection, and network segmentation keep CUI-bearing systems isolated from less-secure environments. Audit logging across those systems creates the trail you need if something goes wrong. Systems should be hardened to a secure baseline, and changes should move through a controlled process so a routine update does not accidentally expose a CUI repository.
Transmitting CUI
When CUI moves between systems or organizations, use encrypted email, secure file transfer protocols, or VPN tunnels. For physical media, use secure courier services or registered mail. Unencrypted email over the public internet is one of the most common ways CUI gets exposed, and it is never acceptable for controlled information.
Destroy It to Standard
When CUI is no longer needed, destroy it in a way that makes recovery impossible. The standard is not “difficult to recover” but genuinely irrecoverable.
For paper, the ISOO CUI directive requires shredding to a 1mm × 5mm particle size, the same standard used for classified material. Standard strip-cut shredders do not meet that requirement. You need a cross-cut or micro-cut shredder rated to that particle size, or you can use pulverization or incineration.
For digital media, NIST SP 800-88 defines three sanitization levels: clearing (overwriting), purging (techniques that defeat laboratory recovery), and destruction (physically rendering the media unusable).7NIST. NIST SP 800-88 Rev 1 – Guidelines for Media Sanitization Purging or destruction is typically appropriate for CUI. Degaussing works for magnetic media; solid-state drives require physical destruction such as shredding or disintegration because degaussing has no effect. Document the sanitization method used and who performed it before any media that held CUI is reused or disposed of.
Contractor Obligations: DFARS and CMMC
If you handle CUI as a contractor rather than a federal employee, your day-to-day obligations flow from DFARS 252.204-7012, which mandates compliance with NIST SP 800-171 for any covered contractor information system that processes, stores, or transmits covered defense information.8eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting The Cybersecurity Maturity Model Certification program adds verification on top of self-attestation.5Department of Defense CIO. About CMMC
CMMC has three levels:
- Level 1 covers contractors handling Federal Contract Information, not CUI specifically. It requires annual self-assessment against 15 security requirements from FAR 52.204-21, plus an annual affirmation.
- Level 2 is the level most contractors handling CUI will need. It requires compliance with all 110 requirements of NIST SP 800-171 Revision 2 and either a self-assessment or an independent assessment by an authorized C3PAO every three years, depending on the solicitation. Plans of action and milestones are permitted but must be closed within 180 days.
- Level 3 is for the most sensitive CUI environments. It requires Level 2 first, then 24 additional requirements from NIST SP 800-172, assessed every three years by the Defense Contract Management Agency’s DIBCAC.
The rollout is phased. Phase 1 runs from November 2025 through November 2026 and puts Level 1 and Level 2 self-assessments into solicitations. Phase 2 begins in November 2026, when solicitations may start requiring Level 2 certification through third-party assessment. By November 2028, CMMC requirements are expected in all applicable solicitations and contracts.5Department of Defense CIO. About CMMC Gap assessments take time, remediation takes longer, and C3PAO availability is limited, so contractors not already working toward Level 2 are running short on runway.
Report Incidents Fast
A CUI incident is any unauthorized disclosure, access, loss, alteration, or destruction of controlled information. The response has two tracks: containment and reporting.
Containment comes first. Isolate affected systems, revoke compromised credentials, and secure any physical materials involved. Document what happened, when you discovered it, which systems or documents were involved, and who had access. That documentation feeds both the investigation and the required reporting.
Defense contractors operating under DFARS 252.204-7012 must rapidly report cyber incidents affecting covered defense information to the DoD through the DIBNet portal, including details about compromised systems, the covered defense information involved, and an impact assessment.8eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting Federal employees report through channels defined by their agency’s CUI policy, which typically involves notifying the agency’s CUI senior official and the affected information owner. When in doubt about whether something qualifies, report it and let the investigation set the scope; late reporting is a fast way to turn a manageable incident into a compliance crisis.
Once the immediate threat is contained and reports are filed, run a root cause analysis. Determine whether the failure was technical, policy-related, or human, then fix the underlying vulnerability and update training if behavior was a factor.
What Non-Compliance Costs
The consequences depend on whether you are a federal employee or a contractor, and whether the failure was negligent or deliberate.
Agency heads have authority to take administrative action against federal personnel who misuse CUI. Where the law or regulation governing a particular CUI category prescribes specific sanctions, agencies must follow those sanctions.9eCFR. 32 CFR 2002.56 – Sanctions for Misuse of CUI Consequences can range from retraining to termination.
Contractors face a layered set of risks. The most immediate is loss of contract eligibility. Federal debarment, which excludes a company from all government contracting for a period typically lasting three years, can result from willful non-performance, breach of contract terms, or false statements about compliance. Debarment is government-wide, so losing eligibility with one agency means losing it with all of them.
The Department of Justice has also used the False Claims Act against contractors who falsely certify cybersecurity compliance to win defense contracts. Damages under the Act can reach triple the contract payments, with additional per-claim civil penalties ranging from roughly $14,000 to over $28,000. The Act’s whistleblower provisions let employees file suit on the government’s behalf and share in any recovery, which creates an internal enforcement mechanism companies cannot control.
Knowingly misrepresenting cybersecurity compliance can carry criminal liability beyond civil penalties. And depending on the CUI category, unauthorized disclosure may trigger penalties under the statute that designated the information as controlled in the first place. Export-controlled technical data, for instance, can implicate the International Traffic in Arms Regulations, which carry severe criminal penalties of their own.