Information that is created, received, or maintained by or for the U.S. government that does not meet the standards for classification but still requires protection due to federal law, regulation, or government-wide policy. CUI covers a broad range of sensitive data types—including technical drawings, engineering specifications, financial records, contract details, or personally identifiable information (PII)—that, if improperly disclosed, could harm government interests, national security, or public trust.

CUI is formally defined and governed under Executive Order 13556 and managed through the National Archives and Records Administration (NARA) CUI Registry, which provides categories and marking standards. Contractors that handle CUI are required to safeguard it by implementing the NIST SP 800-171 security controls and, where applicable, achieving the appropriate level of CMMC certification.

It is important to note that while Federal Contract Information (FCI) is sometimes included in discussions of sensitive data, FCI and CUI are distinct. CUI requires more stringent protections and third-party oversight, making it the focal point of most compliance obligations across the Defense Industrial Base (DIB).