Controlled Unclassified Information
US government information that is not classified but still requires safeguarding under laws, regulations, or government policies. Defense contractors handling CUI must meet the security requirements in NIST SP 800-171, which is the basis for CMMC assessments. The National Archives runs the CUI program and maintains the registry of categories.