What Are the Two Types of Controlled Unclassified Information?

The two types of Controlled Unclassified Information are CUI Basic and CUI Specified. CUI Basic is the default: information that a law, regulation, or government-wide policy requires be safeguarded, handled under the uniform controls that apply to all CUI. CUI Specified is information whose authorizing law or regulation prescribes its own specific handling controls that differ from that baseline. Which type applies decides how you mark, store, share, and protect the information.

CUI Basic

CUI Basic is what you get when a law, regulation, or government-wide policy says information needs safeguarding or controlled dissemination but does not spell out exactly how. The information falls under the uniform controls in 32 CFR Part 2002 and the CUI Registry rather than any procedures unique to the information type.1eCFR. 32 CFR 2002.4 – Definitions

The baseline requires authorized holders to take reasonable precautions against unauthorized disclosure. That means establishing controlled environments, keeping CUI under direct control or behind at least one physical barrier, and making sure unauthorized individuals cannot access or observe the information. On federal information systems, CUI Basic must be protected at no less than a moderate confidentiality impact level under FIPS Publication 199. On nonfederal systems, NIST Special Publication 800-171 defines the security requirements.2eCFR. 32 CFR 2002.14 – Safeguarding

Most CUI you will encounter is Basic. If nobody has told you there are special handling instructions tied to the specific authorizing law, you are almost certainly working with CUI Basic.

CUI Specified

CUI Specified exists because some laws and regulations do not just say “protect this information.” They say exactly how to protect it. When the authorizing authority prescribes specific handling controls that differ from the CUI Basic rules, that information is CUI Specified.1eCFR. 32 CFR 2002.4 – Definitions

Specified controls are not necessarily stricter than Basic controls. They may be more stringent, or they may simply be different. The defining feature is that the underlying law or regulation dictates specific controls rather than leaving handling to the general CUI framework. Where those specific authorities are silent on a particular aspect of handling, the CUI Basic controls fill the gap.1eCFR. 32 CFR 2002.4 – Definitions

Export-controlled information is a concrete example. The CUI Registry designates export-controlled items, dual-use technology, ITAR munitions list data, and sensitive nuclear technology information as CUI Specified under multiple regulatory authorities, including provisions of the Export Administration Regulations and the International Traffic in Arms Regulations.3National Archives. CUI Category: Export Controlled Each of those underlying regulations dictates controls that go beyond the CUI Basic baseline, which is why the information carries the Specified designation.

How to Tell Them Apart on a Document

Every CUI document must carry a banner marking on each page that contains CUI. The banner can include up to three elements: a control marking, category or subcategory markings, and limited dissemination controls.4eCFR. 32 CFR 2002.20 – Marking The two types look different at a glance.

Basic Markings

For CUI Basic, the banner is simply “CONTROLLED” or “CUI” at the designator’s choice. Agencies can require one form or the other in internal policy. Category or subcategory markings are not required for CUI Basic, though an agency’s senior agency official may mandate them.4eCFR. 32 CFR 2002.20 – Marking

Specified Markings

CUI Specified documents must include category or subcategory markings in the banner, and the marking adds “SP-” before the category abbreviation to make the Specified designation obvious. Export-controlled CUI Specified information, for example, carries the banner “CUI//SP-EXPT.” A double forward slash separates the control marking from the category markings, and when multiple CUI Specified categories appear in one document, a single forward slash separates them from each other.5National Archives. CUI Marking Handbook

Limited Dissemination Controls Are Separate

Either type of CUI can also carry limited dissemination control markings that restrict who may receive the information, appended to the banner after a double forward slash. Common examples include NOFORN (no dissemination to foreign governments, foreign nationals, or international organizations), FED ONLY (federal executive branch employees and armed forces personnel only), FEDCON (federal employees and contractors supporting a related contract), NOCON (no dissemination to contractors, though state, local, or tribal employees may receive it), and DL ONLY (restricted to entities on an accompanying distribution list).6National Archives. CUI Registry: Limited Dissemination Controls These controls sit on top of whichever type applies; they do not change whether the information is Basic or Specified.

How to Find Out Which Type Applies

The CUI Registry is the authoritative reference for whether a particular type of information qualifies as CUI, whether it is Basic or Specified, and which law or regulation authorizes its protection. NARA maintains the registry and organizes categories alphabetically within broad groupings such as Critical Infrastructure, Defense, Export Control, Financial, Immigration, Intelligence, Law Enforcement, Legal, and Natural and Cultural Resources.7National Archives. CUI Registry

Each registry entry identifies the authorizing law or regulation, states whether the category is Basic or Specified, and for Specified categories lists the specific handling requirements that differ from the Basic baseline. If you are unsure how to handle a piece of CUI, start there. The registry is publicly available on the National Archives website.

Practical Differences Side by Side

The core difference is where the handling rules come from. Here is how that plays out day to day:

  • Source of controls: CUI Basic uses a single, standardized set of protections in 32 CFR Part 2002. CUI Specified pulls its requirements from the specific authorizing law or regulation.
  • Marking: CUI Basic needs only “CUI” or “CONTROLLED” in the banner. CUI Specified must include the SP- category abbreviation.
  • Handling flexibility: CUI Basic gives you one playbook. CUI Specified may impose different or additional steps depending on the governing law, and those specific controls override the baseline wherever they apply.
  • Gap-filling: Where the authorizing law for CUI Specified does not address a particular aspect of handling, the CUI Basic rules apply as a fallback.1eCFR. 32 CFR 2002.4 – Definitions
  • Frequency: Most people working with CUI encounter CUI Basic far more often. Specified tends to appear in specialized areas such as export-controlled technology and information governed by statutes written with specific protection mandates built in.

One boundary worth flagging: neither type of CUI is classified information, and neither requires a security clearance to access. What both require is a lawful government purpose and compliance with whichever set of handling controls applies.1eCFR. 32 CFR 2002.4 – Definitions