CUI Basic and CUI Specified are the two tiers of Controlled Unclassified Information. The difference is where the handling rules come from: CUI Basic follows the standard government-wide rules set by the CUI program, while CUI Specified follows unique or additional rules written into the specific law, regulation, or government-wide policy that protects that particular information.1NARA. CUI Glossary
What Separates the Two
CUI Basic is the default. If the underlying authority protecting the information does not spell out any special handling requirements, the standard rules in the CUI Registry and federal regulations govern.1NARA. CUI Glossary
CUI Specified is the exception. Here, the law or policy behind the information imposes its own requirements, which can differ from the Basic rules or add to them. Where the specific authority is silent, the Basic rules still fill in the gaps.1NARA. CUI Glossary Export-controlled data is one example that may fall under CUI Specified, depending on the legal authority involved.2NARA. CUI Registry: Export Control
How to Tell Which One You Have
The CUI Registry, maintained by the National Archives and Records Administration, is the authoritative list. It identifies each approved category, notes whether the category is Basic or Specified, and points to the underlying law or policy. When a category carries additional statutory requirements, the Registry flags it so handlers know exactly what applies.1NARA. CUI Glossary
What Changes in Handling
Because CUI Specified is tied to a specific legal authority, its handling rules vary by category. Dissemination is a common area of difference. A NOFORN restriction, for instance, prohibits sharing the information with foreign governments, foreign citizens, or anyone who is not a U.S. citizen.3NARA. CUI Registry: Limited Dissemination Controls
Storage, disposal, and other security measures for CUI Specified also trace back to the underlying authority. The CUI program itself generally does not override existing records retention timelines, so the specific law or policy is where any unique physical or digital safeguards will be found.4National Archives. CUI Marking Questions and Answers
How Each Is Marked
Both types carry the banner CUI or CONTROLLED, which mean the same thing under the program.5NARA. CUI Frequently Asked Questions CUI Specified goes further by adding the category to the marking so the reader knows which specific rules apply. Controlled Technical Information, for example, is marked CUI//SP-CTI, where the SP- prefix signals a Specified category.6NARA. CUI Registry: Controlled Technical Information
When marking every page is impractical, an official CUI coversheet can be used. The coversheet should list the applicable categories and any dissemination restrictions inside.4National Archives. CUI Marking Questions and Answers
Who Has to Comply
Federal agencies must identify and protect CUI in both forms. Private companies working for the government are bound by the same rules when the requirements are written into their contracts. The obligations do not reach the general public unless a specific legal agreement or contract puts them there.5NARA. CUI Frequently Asked Questions A defense contractor handling technical data under the Defense Federal Acquisition Regulation Supplement, for instance, is following the specific authority that makes Controlled Technical Information a Specified category.6NARA. CUI Registry: Controlled Technical Information Any party creating or possessing CUI on the government’s behalf needs to know which categories it handles so it can apply the right standard.1NARA. CUI Glossary