CUI Specified is the subset of Controlled Unclassified Information for which the authorizing law, regulation, or government-wide policy sets out its own handling controls, rather than leaving safeguarding and dissemination to the standard CUI baseline. When information falls into a Specified category, you follow the rules written into that source authority first, and you fall back on the general CUI framework only where the authority is silent.
How CUI Specified Differs From CUI Basic
The Controlled Unclassified Information program splits every category into one of two buckets. CUI Basic covers information where the authorizing law requires protection but says nothing specific about how to handle it. Agencies protect Basic information using the uniform controls in 32 CFR Part 2002 and the CUI Registry.
CUI Specified works differently. The statute, regulation, or policy that authorizes protection also prescribes specific handling requirements. Those requirements might be stricter than the CUI baseline, or simply different. What matters is that the source authority itself, not the general CUI framework, tells you what to do. Where the authority is silent on a particular question, the Basic controls fill the gap.
The practical effect: you can’t apply a single handling checklist across every piece of CUI you encounter. Specified information sends you back to its governing law to find out who may access it, how it must be transmitted, how long it must be kept, and what dissemination limits apply.
Common Examples of CUI Specified
Several categories that federal workers and contractors run into regularly fall on the Specified side of the line:
- Export-controlled technical data governed by the International Traffic in Arms Regulations and the Export Administration Regulations, which restrict who may access the information and under what conditions.
- Health information protected under HIPAA.
- Federal taxpayer information governed by the Internal Revenue Code.
- Patent applications.
- NATO Restricted data.
Each of these carries handling obligations that come from its own governing law. If you work with export-controlled data, the export control regulations tell you what to do. If you work with federal tax return information, Title 26 tells you what to do. The CUI Specified label is a signal to look past the general rules and find the specific authority.
Where the Rules Come From: The CUI Registry
The CUI Registry, maintained by the National Archives and Records Administration, is the authoritative list of every approved CUI category and subcategory. It marks each category as Basic or Specified and, for Specified categories, links to the law, regulation, or policy that governs handling. If you’re trying to figure out which rules apply to information in front of you, the Registry is the starting point.
Information becomes CUI when an authorized holder, usually a federal employee, determines at the time of creation that a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. This is a judgment call anchored in the Registry’s categories, not a classification decision. The designating agency keeps authority over whether and when to remove the CUI designation later.
NARA serves as the CUI Executive Agent, and the Information Security Oversight Office runs day-to-day oversight. Executive Order 13556 created the framework to replace the tangle of agency-specific labels like “For Official Use Only” and “Sensitive But Unclassified” that had built up across the federal government.
How to Recognize CUI Specified on a Document
The Basic and Specified distinction shows up in the banner marking. A CUI Basic document carries “CUI” at the top and bottom of each page in bold, centered, capitalized text, sometimes with a category abbreviation added for clarity such as “CUI//CRIT.”
A CUI Specified document adds the “SP-” prefix in front of the category abbreviation. Export-controlled information, for example, is marked “CUI//SP-EXPT.” When a document holds more than one Specified category, all abbreviations appear in alphabetical order separated by slashes. The prefix is a visual cue that the document carries handling requirements beyond the standard baseline, and that you need to look up the governing authority.
Every CUI document also carries a CUI Designation Indicator block on the first page. The block identifies the controlling organization, the CUI categories in the document, any limited dissemination controls, and a point of contact. That block gives every handler enough information to track down the correct procedures for that specific document.
One boundary worth flagging: the Department of Defense has chosen not to use the Basic/Specified marking distinction within its components, though other executive branch agencies may. DoD treats all its CUI under a unified approach. Contractors working across multiple agencies should expect to see both schemes.
Dissemination Rules for CUI Specified
The regulation draws a clear line for sharing. Authorized holders should broadly share CUI Basic with anyone who has a lawful government purpose. CUI Specified, by contrast, may only be shared as the authorizing law requires or permits. If the authorizing law imposes no specific dissemination limit, agencies may share the Specified information under the same rules that apply to Basic.
That framing puts the burden on the holder to check the source authority before passing information along. A lawful government purpose alone doesn’t authorize the sharing of Specified information if the governing statute says otherwise.
Who Has to Follow These Rules
Federal executive branch agencies carry primary responsibility for designating and managing CUI. Each agency must establish internal policies and procedures that comply with 32 CFR Part 2002.
The obligation reaches well past the federal workforce. Any non-federal organization that creates, receives, possesses, or transmits CUI on behalf of the government falls under CUI requirements. That includes defense contractors, universities running federally funded research, state and local government partners, and other entities that touch federal information. These organizations become bound through contracts, grants, or other agreements that incorporate CUI protection requirements.
For defense contractors specifically, the Defense Federal Acquisition Regulation Supplement requires implementation of the 110 security controls in NIST Special Publication 800-171 to protect CUI in non-federal information systems. Contractors who handle CUI without meeting those controls risk losing contracts, facing suspension or debarment, and potentially facing False Claims Act liability if they misrepresent their compliance status.
Every individual with access carries personal accountability too. That means recognizing which information qualifies as CUI, handling it according to the applicable controls, marking documents properly, and reporting unauthorized disclosure or security incidents. Someone handling CUI Specified export-controlled data needs different training than someone handling CUI Basic privacy information, because the governing authorities set different rules.
Consequences of Mishandling CUI Specified
Mishandling CUI can trigger administrative or disciplinary action under agency policy. What sets Specified apart is that the governing law often establishes its own sanctions, and agencies must follow those sanctions when they exist. In serious cases involving willful mishandling, criminal penalties under the governing statute may apply. That’s why mishandling Specified information can carry stiffer consequences than mishandling ordinary CUI: you’re not just violating an agency policy, you’re potentially violating the export control regime, the tax code, or another statute with its own enforcement teeth.
For contractors, exposure compounds. Failing to implement required security controls can lead to negative past performance ratings, contract termination, suspension, and debarment. Contractors who misrepresent their compliance posture also face liability under the False Claims Act, which allows the government to recover treble damages plus a per-claim civil penalty for each false statement. None of these consequences require a data breach to trigger; an audit or self-assessment showing inadequate controls is enough.
Decontrolling CUI
CUI doesn’t necessarily carry its designation forever. Agencies should remove the CUI designation as soon as the information no longer requires safeguarding or dissemination controls, provided that removal doesn’t conflict with the governing law or policy. The designating agency keeps authority to decontrol what it designated.
Decontrol can happen automatically when the authorizing law no longer requires CUI controls, when the agency affirmatively releases the information to the public, when the information is disclosed under an access statute like FOIA, or when a predetermined event or date occurs. For CUI Specified, the governing authority may set its own rules for when decontrol is permitted, and those rules govern.
One point worth understanding: decontrolling CUI removes the handling requirements under the CUI program, but it doesn’t by itself authorize public release. The information may still be subject to other restrictions. When restating or releasing decontrolled information, authorized holders must clearly indicate that the CUI designation no longer applies and remove all CUI markings from any newly created documents.