Understanding Unclassified vs Classified Data Types

This page clarifies the data classification spectrum from Public Information through CUI, Confidential, Secret, and Top Secret and what triggers the requirement to protect each category.

Key Takeaways - Understanding Unclassified vs Classified Data Types

US Government data falls on a spectrum: Uncontrolled Unclassified (UUI), Controlled Unclassified (CUI), Confidential, Secret, Top Secret.
CUI is NOT classified, but it still requires safeguarding under NIST SP 800-171 and federal regulations.
For most businesses dealing with NIST 800-171 / CMMC, the focus is on a subset of CUI called Controlled Technical Information (CTI). Technical data, engineering drawings, source code, and related materials.
Legacy terms FOUO (For Official Use Only) and SBU (Sensitive But Unclassified) are being phased out and replaced by CUI designations.
Not all ITAR data is CUI. ITAR compliance involves additional export control requirements beyond CUI protections.

Unclassified vs Classified Data Types

Data Classification Spectrum

Executive Orders (EO) 12356 and EO 13526 established the foundation for what "classified" data is. EO 13556 established the foundation for Controlled Unclassified Information (CUI).

Data Categorization Classified vs Unclassified Spectrum

Unclassified Data Types

Two Types

There are two (2) types of Unclassified data from the US Government's perspective:

Controlled Unclassified Information (CUI)

CUI Basic
CUI Specified

Uncontrolled Unclassified Information (UUI)

General UUI (not publicly released or FCI)
Federal Contract Information (FCI)
Information that has been cleared for public release

*note: Per NARA, Uncontrolled Unclassified Information (UUI), as described in 32 CFR Part 2002, refers to information that is neither CUI nor classified, but is still subject to agency public release policies.

Classified Data Types

Three Types

There are three (3) types of Classified data from the US Government's perspective, each with progressively more stringent handling, storage and access requirements:

Confidential

Damage to national security.

Secret

Serious damage to national security.

Top Secret

Exceptionally grave damage to national security.

What Is CUI?

What is Controlled Unclassified Information (CUI)?

Controlled Unclassified Information (CUI) is difficult to provide a simple answer to. The authoritative source that defines CUI is the US National Archives with the CUI Registry. However, for most businesses that have to address NIST 800-171 and/or Cybersecurity Maturity Model Certification (CMMC), the focus is on a subset of CUI, Controlled Technical Information (CTI). "Technical Information" means technical data or computer software. Examples of technical information include:

Research and engineering data;
Engineering drawings;
Associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information; and
Computer software executable code and source code.

The concept behind Controlled Unclassified Information (CUI) is that it is meant to foster consistency and accountability across the federal ecosystem:

Origins

Established under and overseen by NARA/ISOO, replacing agency-specific terms like FOUO or SBU.

Scope

Encompasses “unclassified but sensitive” content, such as export-controlled data, proprietary technical info, contracts and FOUO material.

Protection

Requires standardized handling, marking, storage, dissemination limits, governed by baseline policies (e.g., NIST SP 800-171).

Understanding Requirements For CUI

The best place to start is with understanding Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, since that establishes the definitions and need to protect CUI.

DFARS 252.204-7012 Defines A Requirement To Provide "Adequate Security"

This refers to protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Defined by the security requirements in the contract for services or systems operated on behalf of the US Government.
Further defined by NIST 800-171 for all other “Covered Contractor Information Systems.”

Covered Contractor Information System (CCIS)

This refers to an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits “Covered Defense Information.”

Covered Defense Information (CDI)

This refers to unclassified "Controlled Technical Information" or other information, as described in the Controlled Unclassified Information (CUI) Registry.

Controlled Technical Information (CTI)

When you read through the CUI Registry and find Controlled Technical Information (CTI), it refers to technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination.

CTI is to be marked in accordance with Department of Defense Instruction 5230.24, "Distribution Statements of Technical Documents."
The term does not include information that is lawfully publicly available without restrictions.

Common Questions

Frequently Asked Questions (FAQ)

Here is some commonly asked questions regarding CUI:

What are the three levels of classified information?

The three levels of classified national security information are Top Secret, Secret and Confidential, as defined in Executive Order 13526. Top Secret applies when unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to national security, Secret applies to serious damage, and Confidential applies to damage. The order states that no other terms may be used to identify classified information unless a statute provides otherwise, so CUI is not a classification level.

Which information is not considered controlled unclassified information?

Classified information is not CUI, and neither is information a non-executive branch entity creates and keeps in its own systems that did not come from, or was not created for, an executive branch agency. Under 32 CFR 2002.4, CUI covers information the government creates or possesses, or that an entity creates or possesses on its behalf, when a law, regulation or government-wide policy requires or permits safeguarding or dissemination controls.

What is uncontrolled unclassified information?

Uncontrolled unclassified information (UUI) is information that is neither classified nor covered as CUI. Under 32 CFR 2002.4, UUI is not controlled or classified, but federal agencies must still handle it in line with FISMA requirements. Federal Contract Information (FCI) and publicly cleared information both fall under UUI, and FCI still carries its own protection requirements for contractors under FAR 52.204-21.

Who can decontrol CUI?

Decontrol is generally the decision of the agency that designated the CUI. Under 32 CFR 2002.18, agencies should decontrol CUI as soon as practicable once it no longer needs safeguarding or dissemination controls, and authorized holders such as contractors may ask the designating agency to decontrol specific information. Decontrol removes CUI handling requirements, but it does not by itself authorize public release of that information.

Is Sensitive But Unclassified (SBU) the same as CUI?

No, Sensitive But Unclassified (SBU) and For Official Use Only (FOUO) are legacy markings that the CUI program is replacing with one standard set of categories and markings. Under 32 CFR 2002.36, agencies must re-mark legacy material that qualifies as CUI, and information reused from legacy documents must be designated and marked as CUI. Treat an old SBU or FOUO marking as a signal to check the CUI Registry rather than as a CUI category.