Controlled Unclassified Information

Controlled Unclassified Information

What is Controlled Unclassified Information?

Controlled Unclassified Information (CUI) is information that is created or owned by the Federal Government that requires additional measures of safeguarding, but it is not considered classified information. At UNC, CUI is either received from federal agencies or created during work with federal proprietary information.

The National Archives and Records Administration (NARA) is the authority on CUI and standardizes how it is marked. They also maintain the CUI Registry, which centralizes data management requirements.

At UNCCH, Research Compliance Services and ITS Security Office advise on CUI management. We manage CUI carefully to protect our ability to receive federal contracts and to uphold our research integrity.

How is CUI managed at UNC?

There are two types of CUI – Basic and Specified.

Basic CUI is ONLY subject to the universal control rules set forth in the Code of Federal Regulations (CFR) and NARA CUI Registry. It also requires correct labeling and basic CUI protections.

Specified CUI is subject to BOTH the CUI-Basic controls and a secondary regulatory regime (such as Export Compliance Regulations, HIPAA, etc.).

  • If you believe you may be working with CUI-Specified, contact:
    • Assistant Vice Chancellor for Research Security,
    • ITS Security, and
    • the University compliance office that manages the secondary regulatory regime (i.e., Export Compliance Office or Privacy Office, etc.).
  • Mark the documentā€™s cover page as ā€œCUI SPECIFIEDā€, or “CUI SPā€; use double forward slashes (//) to separate categories and subcategories.

For more information regarding CUI at UNC, please review this Quick Reference Card.

Who do I contact for questions?

Research Compliance Services:

[email protected]

Information Technology Services: Security

[email protected]