Personally identifiable information is considered CUI only when two things are true at once: the federal government creates it, holds it, or has someone handle it on its behalf, and it fits within a category listed in the National Archives’ CUI Registry. PII that a private company collects for its own business, with no federal nexus, is not CUI even when the underlying data points are identical to what a federal agency would protect. The label depends on the relationship to government operations, not on the sensitivity of the data in the abstract.
The Two Conditions That Turn PII Into CUI
The first condition is the government-nexus test. Controlled Unclassified Information is a federal designation, so the information has to be created by, held by, or handled for a federal agency. A contractor processing veterans’ medical records under a VA contract is inside that perimeter. A private hospital treating the same veteran as a self-pay patient is not.
The second condition is that the information has to fall within a category the CUI Registry recognizes. The National Archives and Records Administration serves as the CUI Executive Agent, with its Information Security Oversight Office maintaining the Registry as the single authoritative list of approved categories, required markings, the laws or regulations that make each category CUI, and handling and decontrol instructions.1eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI)
The Registry’s “Sensitive Personally Identifiable Information” entry defines this class of PII as information that, if lost or disclosed without authorization, could cause substantial harm, embarrassment, or unfairness to the individual it describes. Some data elements meet that bar on their own: Social Security numbers, driver’s license numbers, Alien Registration numbers, financial account numbers, and biometric identifiers like fingerprints or iris scans. Other elements become sensitive only when paired with a name or unique identifier, including a truncated Social Security number, date of birth, citizenship or immigration status, religious or ethnic affiliation, sexual orientation, criminal history, medical information, or authentication details like passwords.2National Archives. CUI Category: Sensitive Personally Identifiable Information
Context still matters after both conditions are met. A public federal staff directory listing names and office phone numbers contains PII but is not sensitive enough to warrant CUI protection. Take those same names, attach performance ratings, and the document is CUI. The same field can be CUI in one record and unremarkable in another.
Where Personal Data Actually Sits in the Registry
PII does not live in a single “Privacy” bucket. Under the Privacy grouping alone, the Registry lists subcategories including General Privacy, Health Information, Personnel Records, Student Records, Genetic Information, Death Records, and Protected Military Personnel Records.3National Archives. CUI Registry
Personal data also shows up across other groupings. Criminal History Records Information sits under Law Enforcement, Child Victim/Witness information under Legal, and Personnel Security Information under the Provisional grouping. Each category can carry its own handling requirements tied to the specific law that established it, so a contractor managing health records for a military hospital may face different controls than one managing personnel security investigations, even though both handle personal information designated as CUI.3National Archives. CUI Registry
CUI Basic and CUI Specified
Once PII is CUI, the Registry entry tells you which handling tier applies. CUI Basic is the default: the underlying law requires protection but does not spell out how, so agencies apply a uniform baseline. CUI Specified applies when the authorizing law, regulation, or policy prescribes particular procedures that differ from or add to the baseline. Where a Specified authority is silent on a specific control, Basic standards fill the gap.4eCFR. 32 CFR 2002.14 – Safeguarding
For information systems, CUI Basic must be protected at no less than a moderate confidentiality impact level under FIPS 199. An agency can raise that internally, but it cannot impose higher-than-moderate requirements when sharing CUI Basic with an outside organization unless a written agreement permits it.4eCFR. 32 CFR 2002.14 – Safeguarding
What Changes Once PII Is CUI
The designation is not a label; it triggers a concrete set of obligations for anyone handling the information.
Security Controls
For nonfederal organizations, including defense contractors, universities receiving federal grants, and IT providers operating federal systems, the baseline compliance standard is NIST Special Publication 800-171. Revision 3, published in May 2024, superseded Revision 2 and now provides the current security requirements for protecting CUI confidentiality in nonfederal systems.5National Institute of Standards and Technology. SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
Agencies embed these controls into contracts. For Department of Defense contracts, DFARS clause 252.204-7012 requires contractors who store, process, or transmit covered defense information, which includes CUI, to implement NIST SP 800-171.6eCFR. 48 CFR 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting The Cybersecurity Maturity Model Certification program adds a verification layer: contractors handling CUI fall under Level 2 or Level 3, both requiring NIST SP 800-171 compliance, and Level 2 may require third-party assessment every three years plus annual affirmations. Phased implementation began November 10, 2025.7DoD CIO. About CMMC
Marking
Every CUI document must carry markings that identify its status before anyone reads the content:
- The acronym “CUI” in bold, capitalized text at the top and bottom of every page. If even one page contains CUI, the whole document is marked.
- A CUI Designation Indicator block on the first page or cover, identifying the originator, the CUI category, and any limited dissemination controls. This block is mandatory.
- Portion markings on paragraphs, figures, or tables that contain CUI. Within DoD, portion marking is optional but recommended on fully unclassified documents; when used, it must be applied to every portion.
These standards come from the DoD CUI program guidance.8DoD CUI Program. Controlled Unclassified Information Markings Limited dissemination controls narrow the audience further. “NOFORN” blocks sharing with non-U.S. citizens; “REL TO” markings permit sharing with named foreign partners. With no such control on the document, anyone with a lawful government purpose may access it, but that access does not authorize public release.9CDSE. CUI Quick Marking Tips
Training
DoD requires its civilian workforce and contractors to complete annual CUI training covering access, marking, safeguarding, decontrol, destruction, and incident reporting. A separate annual training covers the Privacy Act and PII handling, and a third annual training covers preventing unauthorized disclosure of classified information and CUI.10DCPAS. DoD Civilian Mandatory Training Requirements List Organizations may combine overlapping modules, but the underlying obligations remain distinct. Failure to comply has been cited as grounds for contract termination.11NAVFAC Pacific. CUI/OPSEC Guidance
Breach Reporting
When a cyber incident compromises CUI, defense contractors must report to the Department of Defense Cyber Crime Center within 72 hours of discovery.12Department of Defense Cyber Crime Center. DIB Cybersecurity DCISE The clock starts at discovery, not at the end of the internal investigation. Reporting requires a DoD-approved medium assurance certificate, and if the breach involved malicious software, DFARS 252.204-7012 requires isolating the malware and submitting it through DC3’s Electronic Malware Submission portal. When the compromised CUI includes PII, the Privacy Act and agency-specific breach response policies may add their own notification duties.
Disposal
Deleting a file or dropping a printout in a recycling bin does not meet CUI disposal requirements. NIST Special Publication 800-88 sets three methods:13NIST Publications. Guidelines for Media Sanitization
- Clear: overwrites user-accessible storage or resets the device to factory state, appropriate for media reused inside the organization but not for media leaving your control.
- Purge: uses techniques such as cryptographic erase, block erase, and degaussing to make recovery infeasible even with laboratory equipment, while preserving the media for reuse. Degaussing does not work on flash-based storage like SSDs.
- Destroy: renders the media permanently unusable through shredding, incineration, pulverizing, disintegration, or melting. This is the only acceptable method for paper printouts, and it covers most electronic storage aside from logical or virtual environments like the cloud.
For paper documents containing CUI-PII, cross-cut shredding is standard practice. Organizations should keep documented sanitization procedures and verify destruction, especially when using third-party services.
What Happens If You Get It Wrong
A knowing, willful, or negligent failure to implement the required security controls, including NIST SP 800-171, can result in contract termination.11NAVFAC Pacific. CUI/OPSEC Guidance Beyond termination, the Department of Justice has been using the False Claims Act to pursue contractors who misrepresent their cybersecurity compliance. Its Civil Cyber-Fraud Initiative, launched in 2021, targets companies that falsely certify they meet federal cybersecurity requirements. False Claims Act liability includes treble damages plus per-claim civil penalties, and courts have recognized “implied false certification” theories where a contractor did not explicitly claim compliance but failed to disclose a shortfall.
With CMMC now tying cybersecurity requirements directly to contract eligibility, a contractor that overstates its posture on a self-assessment is making exactly the kind of representation the False Claims Act was written to police. For any organization handling PII on behalf of a federal agency, that raises the practical stakes of correctly identifying which of that PII is CUI, and treating it accordingly.
PII That Is Not CUI
One boundary is worth stating directly, because the assumption runs the other way. PII a private business collects and holds for its own purposes, without a federal contract, grant, or delegated function behind it, is not CUI. It may still be regulated by other laws, including sector-specific privacy statutes, but the CUI framework does not reach it. The Privacy Act of 1974 separately governs how federal agencies collect, maintain, use, and share records about individuals, and prohibits disclosing a record from a system of records without written consent, subject to twelve statutory exceptions.14U.S. Department of Justice. Privacy Act of 1974 The CUI program layers on top of those existing privacy protections rather than replacing them.