controlled unclassified information (CUI)

{
  "id": "MLC-T-CYB-000953",
  "term": "controlled unclassified information (CUI)",
  "field": "Cybersecurity",
  "definition": "1. Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information (see paragraph (e) of this section) or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency. Law, regulation, or Government-wide policy may require or permit safeguarding or dissemination controls in three ways: Requiring or permitting agencies to control or protect the information but providing no specific controls, which makes the information CUI Basic; requiring or permitting agencies to control or protect the information and providing specific controls for doing so, which makes the information CUI Specified; or requiring or permitting agencies to control the information and specifying only some of those controls, which makes the information CUI Specified, but with CUI Basic controls where the authority does not specify. Note: The CUI categories and subcategories are listed in the CUI Registry, available at https://www.archives.gov/cui.\n\n2. Information that law, regulation, or governmentwide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.\n\n3. Information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.\n\n4. Information that the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.\n\n5. Information that a law, regulation, or government-wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.",
  "abbreviation": "CUI",
  "references": [
    "CNSSI 4009-2022 from 32 C.F.R., Sec. 2002",
    "NIST SP 800-171Ar3 from E.O. 13556; NIST SP 800-171r3 from E.O. 13556; NIST SP 800-172Ar3 from E.O. 13556",
    "NIST SP 800-150",
    "NIST SP 800-37 Rev. 2 from Title 32 CFR, Part 2002; NIST SP 800-53 Rev. 5 from 32 C.F.R., Sec. 2002",
    "NIST SP 800-172r3 from E.O. 13556",
    "NIST CSRC Glossary"
  ],
  "url": "https://mlchart.com/terminology/cybersecurity/controlled-unclassified-information-cui/"
}