Controlled Unclassified Information, or CUI, is defined by two key elements. 1. It is information created by or for the federal government. Information that organizations create outside of a contract with the federal government is not CUI. 2. A law, regulation, or Government-wide policy requires the information to be protected with safeguards or dissemination controls. Information is CUI only if a law, regulation, or policy requires the information to be protected. In the absence of a federal requirement to protect a piece the information, it is considered uncontrolled unclassified information. Currently, CUI is divided into 20 broad Organizational Groups such as Critical Infrastructure, Defense, , Law Enforcement, Privacy, and Tax. The Organizational Groups are further divided into 125 CUI Categories. For example, the Organizational Group “Defense” consists of four CUI Categories – Controlled Technical Information, DoD Critical Infrastructure Security Information, Naval Nuclear Propulsion Information, and Unclassified Controlled Nuclear Information – Defense. Each CUI Category is defined by a specific law, regulation, or policy. For example, the CUI Category “Controlled Technical Information” is associated with 48 CFR 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. 48 CFR 252.204-7012 defines Controlled Technical Information as: Research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog item identifications, data sets, studies, analyses and related information, and computer software executable code and source code. To determine if something is CUI, first determine whether the information was created by or for the federal government. If yes, then determine whether a law, regulation, or government-wide policy requires the information to be protected. If you answered yes to both questions, it is CUI. With that said, the government is required to notify contractors what information is CUI. If the government does not define what specific information is considered CUI, the contractor should seek additional guidance from the government. An official list of all CUI Categories can found at https://www.archives.gov/cui/registry/category-list.