What is CUI? A Contractor’s Perspective

* CUI definition is found at 32 CFR 2002.4(h).
* CUI is information received directly or indirectly from the U.S. government that was marked as CUI, or information created for the U.S. government that the government instructs the contractor to mark.
* Government agencies are required to mark all CUI before dissemination using markings like "CUI" or "CONTROLLED" and agency names.
* Documents containing CUI may optionally include a purple CUI coversheet.
* Classified information (Confidential, Secret, Top Secret) is not CUI.
* Information Export Controlled Under EAR and/or ITAR is not automatically CUI; it is only CUI if it also meets the definition of CUI.
* Unmarked information received from the government is generally not CUI as agencies require marking before dissemination.
* Contractor information received or created outside of a government contract is generally not CUI.
* Information that the government has designated as CUI changes nothing for the contractor who sent it, as the contractor does not possess the information on behalf of the government.
* Marking should only occur when copying from existing CUI documents or when the government provides explicit marking instructions in a contract.
* If unmarked information is suspected to be CUI, the contractor should report it to the contracting officer.
* Contractor information usually falls under Federal Contract Information (FCI), which has fewer safeguarding requirements than CUI.

The central tension in this material revolves around the distinction between governmental designation and contractual obligation for contractors. The text establishes that CUI status is rooted in government action—either the government creating or possessing the information, or requiring its protection via law. This sets up a significant cognitive barrier: contractors often operate under an assumption of control over all contract-related data, which directly conflicts with the reality that they do not possess the information on behalf of the government to qualify as CUI holders themselves.
The guidance shifts the burden of marking from the contractor to the government when dealing with received or newly created materials. The instruction for contractors to mark based on explicit governmental direction (e.g., CDRLs) serves to correct an established, yet flawed, practice where contractors attempted to self-apply markings based on assumptions about their contractual role. This reveals a systemic issue where complexity and proprietary concerns lead to inconsistent application of regulations; the lack of a one-size-fits-all approach across different CUI handling agreements highlights that compliance is context-dependent rather than absolute.
The pattern suggests an impulse toward self-governance—contractors marking information they control—which resists the framework where government action dictates classification. When examining the intersection with export controls and contract clauses, the narrative demonstrates how disparate regulatory regimes (CUI, EAR/ITAR) create layers of complexity that contractors often misinterpret as simple categorization rather than layered legal requirements. The ultimate implication is that achieving cognitive sovereignty requires moving beyond surface-level markings to understand the underlying source and scope of governmental authority governing specific information flows.
Bridge Questions: If government marking decisions are inconsistent across various handling agreements, how can contractors build systems that reconcile these variations without relying on subjective interpretation? What mechanisms are needed to ensure that contractual language effectively translates into unambiguous CUI requirements for all stakeholders? What is the risk associated with a contractor attempting to impose their own classifications when dealing with information they do not create or possess for the government?