The purpose of the ISOO CUI Registry is to serve as the federal government’s single authoritative source for every approved category of Controlled Unclassified Information and the specific rules that govern how each category must be marked, safeguarded, shared, and decontrolled. Managed by the Information Security Oversight Office within the National Archives and Records Administration, the Registry is what replaced dozens of agency-specific labels with one standardized system. If your work touches sensitive-but-unclassified federal information, the Registry is where the binding answers live.
Why the Registry Exists
Executive Order 13556 created the CUI Program in 2010 to fix what the order itself called an “inefficient, confusing patchwork” of ad hoc markings and inconsistent handling across the executive branch.1The White House. Executive Order 13556 — Controlled Unclassified Information Before the program, agencies used labels like “For Official Use Only” and “Sensitive But Unclassified,” each with its own rules and none of them coordinated. The order designated NARA as the CUI Executive Agent, and NARA delegated the day-to-day work to the Director of ISOO, whose staff maintain the Registry and run the federal program.2eCFR. 32 CFR 2002.6 – CUI Executive Agent (EA)
The Registry is publicly accessible online, and its authority is not advisory. It draws its force from 32 CFR Part 2002, the binding regulation that governs how every executive branch agency and every non-federal entity handling CUI on the government’s behalf must designate, mark, safeguard, disseminate, and decontrol that information.
What the Registry Actually Contains
The Registry’s core function is holding the exclusive list of approved CUI categories and subcategories. The regulation is explicit: agencies may use only the categories or subcategories approved by the CUI Executive Agent and published in the Registry to designate information as CUI, and they may not invent their own safeguarding controls for unclassified information outside this system.3eCFR. 32 CFR 2002.12 – CUI Registry That closed list is the whole point. If a category isn’t in the Registry, an agency cannot control information under it.
Categories are organized into index groups that span federal operations: Critical Infrastructure, Defense, Export Control, Financial, Immigration, Intelligence, Law Enforcement, Legal, Nuclear, Patent, Privacy, Procurement and Acquisition, Proprietary Business Information, Tax, Transportation, and others. Each group contains one or more categories, and some categories have subcategories reflecting narrower legal authorities. For every entry, the Registry identifies the specific law, regulation, or government-wide policy that authorizes protection. That linkage matters. Without a citable authority in the Registry, the CUI designation has no legal foundation.
CUI Basic and CUI Specified
One of the Registry’s most useful jobs is telling you which control tier applies to a given category. Every CUI category falls into one of two tiers.
CUI Basic applies when the authorizing law or regulation requires safeguarding but does not spell out specific handling controls. In that case, you follow the uniform baseline controls in 32 CFR Part 2002 and the Registry itself.4eCFR. 32 CFR 2002.4 – Definitions Basic is the default: if the underlying authority is silent on specifics, the program’s standard requirements apply.
CUI Specified applies when the authorizing law or regulation mandates particular controls that differ from or go beyond CUI Basic. The underlying authority itself spells out what those controls are, and Basic controls still fill any gaps the specified authority doesn’t address.4eCFR. 32 CFR 2002.4 – Definitions The Registry flags which authorities carry specified controls and states what those controls require, so holders don’t need to reconstruct the answer from the underlying statutes.
A single category can contain both tiers depending on the specific legal authority involved. Export Control is a good example: some authorities within it, like certain provisions of the International Traffic in Arms Regulations, are Specified, while others are Basic. The Registry’s table for each category maps each authority to its tier and to the correct banner marking.5National Archives. CUI Category: Export Controlled
Limited Dissemination Controls
The Registry also holds the approved list of Limited Dissemination Controls (LDCs). The CUI Program’s default posture favors sharing. Agencies should disseminate CUI and allow access to it as long as the sharing complies with governing law, furthers a lawful government purpose, and is not restricted by an approved LDC. When a designating agency needs tighter restrictions, it can apply an LDC, but only one that has been approved by the CUI Executive Agent and published in the Registry. The regulation cautions against using LDCs to unnecessarily restrict access.6eCFR. 32 CFR 2002.16 – Accessing and Disseminating
The Registry currently lists seven approved LDCs:7National Archives. CUI Registry: Limited Dissemination Controls
- NOFORN: no dissemination to foreign governments, foreign nationals, or international organizations.
- FED ONLY: limited to federal executive branch employees and armed forces personnel.
- FEDCON: limited to federal employees and contractors working in furtherance of their contract.
- NOCON: no dissemination to contractors, though sharing with state, local, or tribal employees is permitted.
- DL ONLY: limited to individuals or entities on an accompanying dissemination list.
- RELIDO: releasable by an information disclosure official for further foreign sharing decisions.
- Display Only: authorized for display to specified foreign nationals with no further release.
Only the designating agency may apply LDCs. Other recipients who want additional restrictions must request permission from that agency.
How the Registry Drives Marking, Safeguarding, and Decontrol
The Registry doesn’t just list categories. It functions as the operational reference for the three things holders actually do with CUI.
On marking, every CUI document must carry a banner marking, and the Registry defines what goes in it. The banner uses either “CONTROLLED” or the acronym “CUI,” at the designator’s discretion, though agencies can require one form through internal policy.8eCFR. 32 CFR 2002.20 – Marking For CUI Specified, the banner must include the applicable category or subcategory markings (for example, “CUI//SP-EXPT” for specified export control information). For CUI Basic, category markings in the banner are optional unless agency policy requires them. Any applicable LDC also goes in the banner. Every document must also carry a designation indicator identifying, at minimum, the designating agency.
On safeguarding, the Registry entry for each category points to the specific controls that apply. Baseline requirements come from 32 CFR Part 2002 for physical protection and from FIPS PUB 199, FIPS PUB 200, and NIST SP 800-53 for federal information systems.9eCFR. 32 CFR 2002.14 – Safeguarding For non-federal systems handling CUI, NIST SP 800-171 supplies the recommended security requirements, with Revision 3 as the current version.10NIST Computer Security Resource Center. NIST SP 800-171 Rev. 3 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations When CUI reaches end of life, destruction must render it unreadable, indecipherable, and irrecoverable, using methods from the underlying authority if specified or from NIST SP 800-88 otherwise.11NIST Computer Security Resource Center. NIST SP 800-88 Rev. 1 – Guidelines for Media Sanitization
On decontrol, the Registry backs a program-wide rule that CUI status is not permanent. Agencies should decontrol information as soon as it no longer requires safeguarding or dissemination controls, unless doing so conflicts with governing law.12eCFR. 32 CFR 2002.18 – Decontrolling Decontrol can happen automatically, including when the governing law no longer requires controls, when the agency proactively releases the information to the public, when it is disclosed under FOIA or the Privacy Act as part of the agency’s public release process, or when a pre-set date or event occurs. One boundary matters here: decontrolling CUI relieves holders from CUI Program handling requirements, but it does not by itself authorize public release. Public release still requires compliance with applicable law and agency policy.
Who Has to Follow It
The Registry binds executive branch agencies through 32 CFR Part 2002, and it binds non-federal entities that handle CUI on the government’s behalf through their contracts and agreements. For defense contractors, the practical stakes have risen with the Cybersecurity Maturity Model Certification (CMMC) program.
CMMC Level 2, which targets the broad protection of CUI, requires compliance with all 110 security requirements in NIST SP 800-171 Revision 2. Depending on the sensitivity of the information involved, contractors either self-assess or undergo an independent assessment every three years, with annual affirmations of continued compliance.13Department of Defense CIO. About CMMC Level 3 adds protections against advanced persistent threats, requires government-led assessments, and adds 24 requirements from NIST SP 800-172.
The rollout matters for planning. Phase 1 runs from November 2025 through November 2026 and focuses on Level 1 and Level 2 self-assessments. Starting in Phase 2 in November 2026, solicitations will begin requiring Level 2 certification from independent assessors where applicable, and Level 3 requirements phase in starting November 2027.13Department of Defense CIO. About CMMC Beyond CMMC, contractors face real enforcement exposure. The government has pursued liability under the False Claims Act for inaccurate cybersecurity representations, even where no data breach occurred, and a single compliance failure can trigger an FCA investigation, an inspector general inquiry, and suspension or debarment consideration in parallel.
All of this circles back to the Registry. The categories that trigger CUI obligations, the tier that dictates which controls apply, the markings that must appear on documents, and the LDCs that limit sharing all come from one place. That is the purpose of the ISOO CUI Registry: to make the rules for sensitive-but-unclassified federal information findable, uniform, and enforceable in a single reference.