The two types of Controlled Unclassified Information (CUI) are:
CUI Basic is the general category of CUI that requires safeguarding or dissemination controls but does not involve any additional restrictive markings or handling requirements.
CUI Specified is a subset of CUI that has additional handling or dissemination controls specified by law, regulation, or government-wide policy. CUI Specified requirements may include extra requirements such as specific marking, additional encryption, or restricted sharing limitations.
The difference is who sets the handling rules: for CUI Basic it is the CUI program itself, and for CUI Specified it is the underlying law, regulation or Government-wide policy.
| CUI Basic | CUI Specified | |
|---|---|---|
| Handling rules | The uniform safeguarding and dissemination controls of the CUI program (32 CFR Part 2002) | The authorizing law, regulation or Government-wide policy sets specific handling controls that differ from CUI Basic |
| Banner marking | CUI | CUI plus each Specified category marking, for example CUI//SP-XXX |
| Where to check | The CUI Registry category entry | The CUI Registry category entry and its Specified authority |
| NIST SP 800-171 | The baseline for protecting CUI Basic on nonfederal systems | The baseline, unless the authorizing law or regulation prescribes different safeguarding requirements |
The distinction between CUI Basic and CUI Specified helps organizations apply the appropriate level of controls based on the sensitivity and regulatory requirements attached to the information.
