Glossary / Security, Classification
Controlled Unclassified InformationCUI
Controlled Unclassified Information (CUI) is unclassified information that the executive branch is required to safeguard or disseminate only under specific controls, per Executive Order 13556 and 32 CFR Part 2002. The CUI Registry (archives.gov) lists approved categories: export-controlled data, PII, law-enforcement sensitive, and others. On defense contracts, CUI brings in DFARS 252.204-7012 and the NIST SP 800-171 requirements, plus CMMC Level 2 where the contract calls for it. FAR 52.204-21 covers the more basic safeguarding of Federal Contract Information.
Why it matters to your pipeline
Many DoW contracts that involve non-commercial, technical, or operational information also involve CUI. Mishandling it, whether by storing it in unapproved cloud services, emailing it unencrypted, or failing to mark it, can trigger cure notices, contract termination, or False Claims Act liability under DoW rules that treat compliance statements as material to payment. Understanding what CUI you have, where it lives, and who has access to it is foundational cyber hygiene for defense work.
When this term shows up in an opening GovSmith finds for you, your vCM explains what it means for that pursuit and does whatever it calls for. You decide; we do the work.
Example
A contractor receives a technical data package with CUI markings. It ensures the CUI is stored only on an NIST SP 800-171-compliant system, restricts access to cleared U.S. persons per the export-control banner, and trains staff on the CUI handling guide before opening the package.
Find out what applies to you
Some terms will matter to your business right away and some won’t for years. A vCM can tell you which are which.