Understanding the Types of Controlled Unclassified Information in the United States

Understanding the Types of Controlled Unclassified Information in the United States

As a business owner or government contractor, it’s important to comply with the regulations set out by the United States government regarding the handling, transmission, and storage of Controlled Unclassified Information (CUI). CUI is unclassified information that requires safeguarding or dissemination controls, and its unauthorized disclosure could result in harm to national security or other federal interests. In this article, we’ll explore the various types of CUI and how to handle them appropriately.

What is CUI?

CUI is a broad category of information that includes any unclassified information that requires safeguarding or dissemination controls necessary to protect it from public release. CUI is used to protect information that is shared between government agencies and non-federal entities, such as state and local governments, academia, and contractors.

Types of CUI

The National Archives and Records Administration (NARA) has identified 23 categories of CUI. These categories are not intended to be comprehensive, but rather to provide a structure for agencies to identify and protect CUI in their possession. The categories include:

1. Agriculture
2. Banking and Financial
3. Chemical
4. Communications
5. Critical Infrastructure
6. Cultural
7. Defense
8. Education
9. Energy
10. Environment
11. Food
12. Geospatial
13. Health
14. Housing
15. Immigration
16. Infrastructure
17. Intelligence
18. International
19. Law Enforcement
20. Legal
21. Natural Resources
22. Nuclear
23. Personnel

CUI Examples

To better understand what constitutes CUI, let’s look at some examples:

1. Financial data related to a contract between a government agency and a contractor.
2. Reports and studies related to research performed under government contracts.
3. Unpublished patents relating to a government-funded research and development project.
4. Records of internal investigations conducted by a government agency.
5. Documents containing information on immigration reform proposals being considered by a government agency.

How to Handle CUI

Handling CUI requires proper diligence to ensure that it is safeguarded from unauthorized access. Here are some best practices for handling CUI:

1. Identify CUI: Establish procedures for identifying CUI in your possession, and whom to report to in case of unauthorized disclosure.
2. Marking: All CUI should be marked clearly as such to ensure that it receives the proper protection.
3. Access Controls: Access to CUI should be restricted to authorized individuals, and access should be recorded to track who has accessed the information.
4. Transmission: CUI may be transmitted only using approved distribution methods.
5. Storage: CUI should be stored securely, using data encryption, secure networks, and physical security measures.

Conclusion

Handling CUI requires a thorough understanding of its various categories and how to safeguard it from unauthorized access. By establishing proper procedures, identifying and marking CUI, access controls, transmission security, and secure storage measures, you can reduce the risk of unauthorized disclosure of sensitive information. As a business owner or government contractor, it’s your responsibility to comply with the regulations governing the handling of CUI to protect national security and other government interests.

Sources

1. https://www.archives.gov/cui
2. https://www.federalregister.gov/documents/2016/11/14/2016-27434/classification-policy-identification-and-categorization-of-unclassified-information-marked-as-controlled