Sensitive unclassified information is government or government-related data that doesn’t meet the threshold for national security classification but still needs protection from public release. It sits in the wide space between fully public records and classified material, and unauthorized disclosure can cause real harm, from identity theft to compromised investigations. Most of it is now handled under a single federal framework called Controlled Unclassified Information, or CUI, codified at 32 CFR Part 2002.
How It Differs From Classified Information
Classified information is restricted specifically because its disclosure could damage national defense or foreign relations. Executive Order 13526 sets the uniform system for classifying and protecting that national security information, and it explicitly does not reach information that requires protection for other reasons.
The State Department’s Foreign Affairs Manual draws the line plainly: Executive Order 13526 covers classified national security information but “does not apply to information that is not classified but that may require protection,” including information tied to law enforcement, privacy, confidential commercial data, and sensitive deliberative processes. That non-classified-but-still-sensitive material carries administrative designations like Personally Identifiable Information, Critical Infrastructure Information, or Controlled Unclassified Information.
The two categories follow entirely different rule sets. Classified information requires security clearances, secure facilities, and government-controlled access. Sensitive unclassified information operates under a broader mix of protections driven by specific statutes, regulations, and government-wide policies rather than a single classification authority.
Common Categories You’ll Encounter
The National Archives maintains a CUI Registry that organizes sensitive unclassified information into roughly 20 category groupings covering defense, immigration, tax, patents, transportation, and more. A handful come up far more often than the rest.
Personally Identifiable Information
PII is any data that can distinguish or trace someone’s identity, either on its own or combined with other linked information. NIST’s definition includes names, Social Security numbers, biometric records, and other details like date of birth or financial and employment records. Lost PII is the most common trigger for the data breaches you see in the news and the category most likely to affect ordinary people directly through identity theft or fraud.
Protected Health Information
Protected Health Information is individually identifiable health information covered by the HIPAA Privacy Rule. It covers information about a person’s past, present, or future health condition, the care they received, or payment for that care, combined with identifiers like name, address, birth date, or Social Security number. PHI encompasses 18 specific identifier types, from medical record numbers to IP addresses to full-face photographs. What sets it apart from general PII is the link between an identifier and health information.
Law Enforcement Sensitive Information
Law enforcement agencies generate large volumes of unclassified information that would compromise investigations or endanger people if released, including details about ongoing cases, the identities of informants, and sensitive investigative techniques. Agencies designate this as Law Enforcement Sensitive to restrict access to authorized personnel.
Critical Infrastructure and Proprietary Business Information
Critical infrastructure information covers the systems, networks, and physical assets that keep society functioning. Disclosing vulnerabilities in power grids, water systems, or telecommunications networks could enable attacks with serious consequences for public safety and the economy. Proprietary business information, including trade secrets and confidential commercial data, is protected because disclosure could unfairly damage a company’s competitive position. Both categories show up constantly in government contracting, where private companies share sensitive operational details with agencies.
Why the CUI Program Exists
Before 2010, federal agencies invented their own labels for sensitive unclassified information. One stamped documents “For Official Use Only,” another used “Sensitive But Unclassified,” a third had its own scheme entirely. Executive Order 13556, signed in November 2010, called this out as “an inefficient, confusing patchwork” that produced “inconsistent marking and safeguarding of documents” and “unclear or unnecessarily restrictive dissemination policies.” The order established the CUI program to replace all of it with a single, uniform system.
The framework at 32 CFR Part 2002 defines CUI as information the government creates or possesses, or that an entity creates or possesses on behalf of the government, where a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. The regulation covers the full lifecycle: designating, marking, safeguarding, sharing, decontrolling, and destroying.
CUI Basic vs. CUI Specified
Not all CUI follows the same handling rules. The split between CUI Basic and CUI Specified trips people up because it sounds like a security-level hierarchy. It isn’t. The difference is about where the handling instructions come from.
CUI Basic applies when the underlying law or regulation says the information needs protection but doesn’t spell out specific controls. Agencies then follow the uniform safeguarding standards in 32 CFR Part 2002. CUI Specified applies when the underlying authority does prescribe particular handling requirements. Tax return information is a good example: it carries specific statutory controls over who can see it and when. Where a CUI Specified authority is silent on a particular aspect, CUI Basic fills the gap.
Marking Requirements
Every document containing CUI must carry a banner marking at the top of each page. The banner appears as bold, capitalized text, centered when feasible, and stays consistent across all pages. At minimum, it includes either the word “CONTROLLED” or the acronym “CUI.” For CUI Specified material, the banner adds category or subcategory markings and may include limited dissemination controls. These markings aren’t decoration. They tell everyone who touches the document exactly what protections apply.
Safeguarding Rules
The baseline safeguarding rules under 32 CFR 2002.14 come down to reasonable precautions against unauthorized access. In practice that means four things. You must establish controlled environments where CUI stays protected from people who shouldn’t see it. You must make sure unauthorized individuals can’t observe CUI or overhear conversations about it. CUI must stay under your direct control or behind at least one physical barrier when you’re outside a controlled environment. And any federal information systems processing CUI must meet the security controls in NIST Special Publication 800-53.
Shipping has its own rules. You can use the U.S. Postal Service or commercial carriers, but you should use tracking tools and must mark packages according to CUI requirements. Copying or scanning CUI requires equipment that doesn’t retain the data afterward, or the equipment must be sanitized.
What Federal Contractors Owe
If you’re a federal contractor or subcontractor handling CUI, the requirements go well beyond the baseline. Two overlapping frameworks apply, and both are tightening.
NIST SP 800-171
NIST Special Publication 800-171 sets the security requirements that nonfederal organizations must meet when they store, process, or transmit CUI. The current version, Revision 3, organizes requirements across 17 security families including access control, incident response, risk assessment, and supply chain risk management. These requirements are written into federal contracts, so they’re legally binding rather than advisory.
CMMC for Defense Contractors
The Cybersecurity Maturity Model Certification program takes NIST 800-171 compliance and adds verification. Instead of contractors simply attesting that they meet the requirements, CMMC requires proof through assessments at three levels:
- Level 1 covers basic safeguarding of Federal Contract Information and requires an annual self-assessment against 15 security requirements.
- Level 2 covers CUI protection and requires either a self-assessment or an independent third-party assessment every three years against 110 security requirements from NIST SP 800-171 Revision 2, plus annual affirmation of compliance.
- Level 3 addresses advanced threats to CUI. Contractors must achieve Level 2 first, then pass a government-led assessment every three years against 24 additional requirements from NIST SP 800-172.
The rollout is phased. Phase 1 began in November 2025 and allows solicitations to require Level 1 or Level 2 self-assessments. Phase 2 begins in November 2026 and introduces Level 2 third-party certification requirements. Phases 3 and 4 follow in November 2027, adding Level 3 certification.
The DFARS 72-Hour Reporting Clause
Defense contractors must also comply with DFARS 252.204-7012, which requires “adequate security” on all systems handling covered defense information. Beyond implementing NIST 800-171, this clause imposes a strict reporting obligation: contractors must report any incident affecting their systems or the CUI on them within 72 hours of discovery. They must also preserve images of affected systems and relevant monitoring data for at least 90 days so the Department of Defense can request forensic access.
Consequences of Mishandling
Penalties scale with the severity and intent behind the violation. Federal employees who fail to follow CUI handling rules face disciplinary actions ranging from verbal counseling to suspension without pay to termination and loss of CUI access. For contractor employees, mishandling is referred to the contracting officer, who can impose contract remedies. Criminal conduct gets referred to the Inspector General and the Department of Justice.
The specific penalties turn on what type of information was compromised. Wrongful disclosure of individually identifiable health information under HIPAA carries criminal penalties of up to $50,000 and one year in prison for a basic violation. If false pretenses are involved, that rises to $100,000 and five years. If someone disclosed health information for commercial advantage, personal gain, or to cause harm, the maximum reaches $250,000 and 10 years in prison. Civil HIPAA penalties are assessed per violation on a tiered scale, with annual caps that can exceed $2 million in the most serious cases.
How CUI Must Be Destroyed
CUI needs protection at the end of its life too. When an agency or authorized holder no longer needs the information and records disposition schedules allow, destruction must render it unreadable, indecipherable, and irrecoverable. If the underlying authority specifies a destruction method, you must use it. Otherwise, the regulation points to NIST SP 800-53 for system-level guidance and NIST SP 800-88 for media sanitization.
NIST SP 800-88 covers wiping data from hard drives, solid-state drives, mobile devices, and other storage media. The core principle is that sanitization must make the target data infeasible to recover for a given level of effort. For paper documents and other physical media, agencies typically require cross-cut shredding or burning. The method matters less than the outcome. If someone could reconstruct the information, you haven’t destroyed it properly. Copiers, scanners, and similar equipment that temporarily store data during processing also have to be sanitized after handling CUI, a step that’s easy to forget and often missed in audits.