DoD CUI Program > Policy

CUI Policies

Executive Order 13556
Controlled Unclassified Information
This order establishes an open and uniform program for managing information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies, excluding information that is classified under Executive Order 13526 of December 29, 2009, or the Atomic Energy Act, as amended.

32 Code of Federal Regulations, Part 2002
Controlled Unclassified Information
The implementing directive describes the executive branch’s Controlled Unclassified Information (CUI) Program (the CUI Program) and establishes policy for designating, handling, and decontrolling information that qualifies as CUI.

DoD Instruction 5200.48
Controlled Unclassified Information (CUI)
Establishes policy, assigns responsibilities, and prescribes procedures for CUI throughout the DoD in accordance with Executive Order (E.O.) 13556; Part 2002 of Title 32, Code of Federal Regulations (CFR); and Defense Federal Acquisition Regulation Supplement (DFARS) Sections 252.204-7008 and 252.204-7012.

NIST Special Publication 800-53, Revision 5
Security and Privacy Controls for Federal Information Systems and Organizations

NIST Special Publication 800-171, Revision 2
Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations

NIST Special Publication 800-172
Enhanced Security Requirements for Protecting Controlled Unclassified Information
Supplement to NIST SP 800-171

Quick Reference Links