Controlled Unclassified Information
Controlled Unclassified Information (CUI) refers to data held by US federal agencies that is not classified as a state secret but still requires special protection. Anyone working with such data – for example as a technology vendor or defense supplier to the US – must demonstrably comply with certain security rules.
Not every sensitive piece of information is a state secret. The US federal government therefore distinguishes between data that is officially classified as secret and data that, while it would otherwise be openly accessible, must still not fall into the wrong hands. This second category is called Controlled Unclassified Information, abbreviated CUI. Examples include agency tax records, patient data at federal hospitals, technical plans for defense projects, or FBI investigation files. None of this information is “secret” in the formal sense — it carries no stamp such as “Top Secret.” Nevertheless, the law prescribes how it must be stored, transmitted, and protected from unauthorized access.
Why CUI becomes a business risk for technology companies
Anyone wanting to sell software, cloud services, or hardware to US federal agencies must prove that they can process CUI securely. The responsible agency, the National Institute of Standards and Technology (NIST), has published a catalog of concrete security requirements for this purpose. Companies that fail to meet these requirements simply do not get awarded contracts.
This is especially relevant for the defense and aerospace industries. Since 2020, the US Department of Defense has been progressively requiring its suppliers to undergo an external audit, the so-called CMMC certification (Cybersecurity Maturity Model Certification). Without this certificate, there is no government contract. This means CUI affects not only large corporations but also mid-sized firms somewhere in the supply chain.
A common misconception: many companies believe they are not affected because they don’t build weapons. In fact, it is enough to supply accounting software to a federal agency or maintain network components that carry CUI. The definition is deliberately kept broad.
What protecting CUI looks like in practice
The requirements mainly stem from the NIST document SP 800-171. It lists 110 security controls, organized into 14 areas — ranging from access controls and encryption to logging all system access. Put simply: every person must authenticate before accessing CUI. All data must be stored and transmitted in encrypted form. Every access is logged. Systems that hold CUI must be regularly checked for vulnerabilities.
Organizationally, the US National Archives (NARA) maintains a central registry that defines which types of information actually qualify as CUI. There are currently over 100 such categories, for example “Privacy” for personal data or “Export Controlled” for technologies that may not be sent abroad without authorization. Each category can come with its own additional rules.
An important difference from classified secret information: CUI may in principle be shared with authorized parties — so the goal is not to hide the data completely, but to keep its dissemination controllable. The word “controlled” in the name refers precisely to this: control over the flow, not absolute exclusion.
Where CUI comes up in the tech debate
CUI plays a central role in the discussion about which cloud providers US agencies are allowed to use. Microsoft, Google, and Amazon each operate special data centers in the US that are specifically certified for CUI and even for classified data — separate from their regular commercial services. The question of whether a provider from another country could ever meet these requirements is politically highly sensitive.
CUI is also becoming increasingly important in the field of AI. If a federal agency wants to train or use an AI model and draws on CUI in doing so, the training data and infrastructure must meet the same protection rules as any other CUI processing. This limits which commercial AI services are even eligible for use by government agencies.
In the news, CUI usually comes up when there is a data breach: an employee saves documents to a personal cloud account, a contractor loses an unencrypted laptop, or a hacking attack hits a company somewhere in the supply chain. In all these cases, the decisive question is: Did the data involved include CUI — and were the required protective measures followed?
