There are two types of Controlled Unclassified Information (CUI): CUI Basic and CUI Specified. CUI Basic is CUI whose authorizing law, regulation or government-wide policy sets no special handling rules, so the standard safeguards in 32 CFR Part 2002 apply. CUI Specified is CUI whose authority sets specific handling or dissemination controls that differ from or add to CUI Basic.
CUI Basic is the general category of CUI that requires safeguarding or dissemination controls but does not involve any additional restrictive markings or handling requirements.
CUI Specified is a subset of CUI that has additional handling or dissemination controls specified by law, regulation, or government-wide policy. CUI Specified requirements may include extra requirements such as specific marking, additional encryption, or restricted sharing limitations.
The difference is who sets the handling rules: for CUI Basic it is the CUI program itself, and for CUI Specified it is the underlying law, regulation or Government-wide policy.
| CUI Basic | CUI Specified | |
|---|---|---|
| Handling rules | The uniform safeguarding and dissemination controls of the CUI program (32 CFR Part 2002) | The authorizing law, regulation or Government-wide policy sets specific handling controls that differ from CUI Basic |
| Banner marking | CUI | CUI plus each Specified category marking, for example CUI//SP-XXX |
| Where to check | The CUI Registry category entry | The CUI Registry category entry and its Specified authority |
| NIST SP 800-171 | The baseline for protecting CUI Basic on nonfederal systems | The baseline, unless the authorizing law or regulation prescribes different safeguarding requirements |
The distinction between CUI Basic and CUI Specified helps organizations apply the appropriate level of controls based on the sensitivity and regulatory requirements attached to the information.
Related: Unclassified vs Classified Data: CUI Explained, what CUI Basic covers and CUI examples.
