CUI explained
What is CUI? Identifying and protecting government information
Controlled Unclassified Information is unclassified information subject to government safeguarding or dissemination controls. A document mentioning CUI is not necessarily CUI itself.
Identify the information first
CUI is not classified information. Its protection requirements come from applicable law, regulations or government-wide policies. Consult the government information owner and the CUI Registry to establish what information your organisation handles.
Map where it goes
In Scope, record where the information is processed, stored or transmitted, including service providers. Review access, connections and responsibilities before deciding what is outside the boundary.
Use references safely
Do not upload actual CUI into UpCISO. Reference evidence held in an approved repository. The upload scanner is a limited mistake-detection aid; a clean result is not permission to upload sensitive material.
Official sources
Reviewed 2026-09-22. Check current sources and your contract when making assessment or eligibility decisions.