Examples of CUI: Categories in the Federal CUI Registry

Controlled unclassified information (CUI) is a defined federal category, and the list of what counts as an example is published in a single place: the CUI Registry kept by the National Archives. This guide groups real Registry categories by the Registry’s own organizational index groupings, so you can see the examples of CUI that research offices meet most often. It also explains what separates CUI from other unclassified information, and why CUI is not a classification level. The category names below were checked against the Registry on 2026-10-29.

What CUI is and who runs it

CUI is information the U.S. Government creates or possesses, or that an entity creates or possesses for the Government, that a law, regulation or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. The program is run by the National Archives and Records Administration (NARA) as Executive Agent, with day-to-day work delegated to the Information Security Oversight Office (ISOO). It was created by Executive Order 13556, and the implementing rule is 32 CFR Part 2002. (Sources: NARA’s About CUI page and 32 CFR 2002.4, checked 2026-10-29.)

The definition does not depend on how sensitive information feels. It depends on whether a specific authority, such as a statute or regulation, requires or permits controls on it. That is the test the rest of this page applies.

Examples of CUI by Registry grouping

The Registry lists CUI categories alphabetically inside 20 organizational index groupings. The table below shows example categories from each grouping, using the names exactly as the Registry’s category list gives them. It is a selection, not the complete list: each grouping has more categories, and the Registry is the authority for the full set. The first rows cover export-controlled research, technical information, patents, and personal and business data.

Registry grouping	Example categories as listed on the Registry
Export Control	Export Controlled; Export Controlled Research
Defense	Controlled Technical Information; Naval Nuclear Propulsion Information; Privileged Safety Information
Privacy	General Privacy; Health Information; Genetic Information; Student Records; Personnel Records
Patent	Patent Applications; Inventions; Secrecy Orders
Proprietary Business Information	General Proprietary Business Information; Entity Registration Information; Proprietary Manufacturer
Procurement and Acquisition	General Procurement and Acquisition; Small Business Research and Technology; Source Selection
Provisional	Personnel Security Information; Sensitive Personally Identifiable Information; Privacy Information
Critical Infrastructure	Ammonium Nitrate; Physical Security; Information Systems Vulnerability Information; Water Assessments
Financial	Bank Secrecy; Budget; General Financial Information; Retirement
Immigration	Asylee; Permanent Resident Status; Visas
Intelligence	General Intelligence; Operations Security; Geodetic Product Information
International Agreements	International Agreement Information
Law Enforcement	Criminal History Records Information; DNA; Informant; Investigation
Legal	Federal Grand Jury; Legal Privilege; Legislative Materials; Protective Order
Natural and Cultural Resources	Archaeological Resources; Historic Properties; National Park System Resources
NATO	NATO Restricted; NATO Unclassified
Nuclear	General Nuclear; Safeguards Information; Nuclear Security-Related Information
Statistical	Statistical Information; US Census; Investment Survey
Tax	Federal Taxpayer Information; Tax Convention
Transportation	Railroad Safety Analysis Records; Sensitive Security Information

Source: CUI Registry category list, National Archives, checked 2026-10-29. The list page itself shows only category names under each grouping; it does not show a category’s marking or whether it is Basic or Specified.

Types of CUI: categories and groupings

When people ask about the “type of CUI” or “types of CUI,” the rule’s vocabulary has two layers. A CUI category is a type of information for which laws, regulations or policies require or permit controls and that the CUI Executive Agent has approved and listed in the Registry. A grouping is the Registry’s organizational index heading under which categories are filed. The separate Basic and Specified split, covered below, describes how strict the handling controls are, not what the information is about.

What is considered CUI?

Information is CUI when both of these are true, according to 32 CFR 2002.4 and the NARA program description:

• It is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, and it falls under a CUI category approved by the CUI Executive Agent and listed in the Registry.
• A law, regulation or Government-wide policy requires or permits safeguarding or dissemination controls for it.

The rule also defines the opposite case. Uncontrolled unclassified information is information that neither the Order nor the authorities governing classified information cover as protected. The rule also says CUI does not include information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.

CUI documents

There is no single document type that is CUI. A proposal, a data set, a technical report, a contract attachment or an email can be CUI if its content falls under a Registry category and an authority requires controls. For how a designated document is marked, see the guide on CUI cover sheets and marking.

Is CUI a classification?

No. CUI is not a classification level. 32 CFR 2002.4 states that CUI does not include classified information, and NARA’s program page states that CUI is not classified under Executive Order 13526 or the Atomic Energy Act. Classified information (Confidential, Secret, Top Secret) follows a separate system. CUI is the Government’s way of naming unclassified information that still has required safeguarding or dissemination controls. Read “CUI classification” as a question about which Registry category applies, not about a clearance level.

Basic vs Specified: an overlay on any example

Under 32 CFR 2002.4, CUI Basic is the subset of CUI for which the authorizing law, regulation or Government-wide policy does not set out specific handling or dissemination controls; the rule says the CUI Basic controls apply whenever CUI Specified controls do not cover the involved CUI. CUI Specified is the subset where the authority contains specific handling controls that differ from those for CUI Basic, and they may be more stringent than, or may simply differ from, the Basic ones. The rule states that the CUI Registry indicates which laws, regulations and policies include such specific requirements, so check the Registry before assuming either. The comparison CUI Basic vs CUI Specified walks through the difference.

Common mistakes

• Treating CUI as a classification level. It sits outside the classified system, as covered above.
• Assuming any sensitive or confidential document is CUI. The test is a Registry category plus an authority that requires or permits controls, and information held in a non-executive entity’s own systems that did not come from or for an agency is outside the definition.
• Using a category name from memory. Category names are specific (for example, “Export Controlled Research” is its own listed category alongside “Export Controlled”). Use the Registry’s exact names.
• Confusing CUI with federal contract information. The two are different concepts; see FCI vs CUI.
• Assigning Basic or Specified from the category name alone. The Registry, not the name, indicates which authorities carry specific controls.

Related pages

• Controlled unclassified information (CUI), the dictionary definition
• NIST SP 800-171 for CUI in university research, on NIST SP 800-171 compliance
• CMMC scoping guide
• CUI cover sheets and marking

FAQ

What are examples of CUI?

Examples listed in the Registry include Export Controlled Research, Controlled Technical Information, Health Information, Student Records, Patent Applications, General Proprietary Business Information and Sensitive Personally Identifiable Information. See the table above for examples from each of the 20 groupings.

What types of CUI are there?

The Registry organizes CUI categories under 20 index groupings, and CUI is also divided into CUI Basic and CUI Specified depending on whether the underlying authority sets specific handling controls.

What is considered CUI?

Government-created or possessed information in an approved Registry category that a law, regulation or Government-wide policy requires or permits agencies to safeguard or restrict in dissemination.

Are CUI documents always marked?

Marking is one of the handling requirements in 32 CFR Part 2002, which covers designating, safeguarding, disseminating, marking, decontrolling and disposing of CUI. How a given document is marked is covered in the marking guide linked above.

Is CUI a classification?

No. CUI is unclassified information with required controls; classified information is a separate system.

Sources

• CUI Registry: CUI Categories, National Archives and Records Administration, checked 2026-10-29
• About CUI, National Archives and Records Administration, checked 2026-10-29
• 32 CFR Part 2002, Controlled Unclassified Information, section 2002.4 (definitions), eCFR, checked 2026-10-29