Controlled Unclassified Information (CUI)

Controlled Unclassified Information is defined by the National Archives and Records Administration and must be protected according to the rules in 32 CFR Part 2002. NIST SP 800-171 provides the list of controls that are required for protecting CUI in non-Federal information systems.

For more information about CUI, you can refer to the National Archives CUI page.

CUI, and data subject to ITAR and EAR, falls in the UMD data classification category of Restricted (Level 4) data; defined as data where access and use are strictly controlled and restricted by laws, regulations, or contracts. Unauthorized access, use, disclosure, or loss could have significant legal consequences, including civil and criminal penalties, loss of funding, inability to continue current research, and inability to obtain future funding or partnerships.

If you would like to learn more about data classification, you can refer to the UMD Data Classification Standard.

---