The National Archives and Records Administration (“NARA”) is responsible for defining Controlled Unclassified Information and its management in the Federal Government. NARA publishes the CUI Registry at CUI Categories | National Archives. The United States Department of Defense publishes its own CUI registry at DoDCUI.mil which supplements the NARA CUI registry and adds clarity in the context of DoD.

According to NARA, all CUI is to be appropriately marked when created. This means that, if the government is providing your organization with CUI, it is the government’s responsibility to ensure the information is marked appropriately before it is given to your organization. Similarly, if the government expects information that your organization creates on their behalf to be handled as CUI, it is their responsibility to indicate this in their contract with you.