CUI: What Counts as Controlled Unclassified Information and How Do You Know You Have It?

CUI is the tripwire for CMMC Level 2 — if you handle it, the 110 controls apply. CUI categories span export control, critical infrastructure, defense, and more; the NARA CUI registry is the authoritative list. Practical test: does the contract mark data as CUI, or does the agency's handling guidance say so? When in doubt, ask the contracting officer in writing. How do you determine CUI in your contracts?