CUI Basic is Controlled Unclassified Information (CUI) where its authorizing law, regulation or government-wide policy does not set specific handling controls. It is protected with the uniform safeguards in 32 CFR Part 2002 and, for nonfederal systems, NIST SP 800-171. CUI Specified is the subset where the authority adds its own handling rules.
CUI Basic covers information that, while unclassified, requires safeguarding per NIST SP 800-171 controls.
Understanding CUI Basic helps organizations standardize protection without over-engineering controls where not needed. To contrast CUI Basic with CUI Specified, CUI Specified demands unique additional controls (e.g., special markings or enhanced physical security) based on a specific law, regulation or government-wide policy.
Related: CUI Basic vs CUI Specified: the two types of CUI and examples of CUI.
