CUI

Controlled Unclassified Information (CUI)

Controlled Unclassified Information (CUI) is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act, as amended.

What is Controlled Unclassified Information (CUI)

The official U.S. government definition of CUI (Controlled Unclassified Information), established by Executive Order 13556 and implemented in 32 CFR § 2002.4(h), is information that the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls

If your project involves CUI, the sponsor will typically identify this requirement in the award document, solicitation, contract, statement of work, data management requirements, or related terms and conditions. Awards involving CUI often include specific cybersecurity, data protection, access control, or reporting requirements.

Common indicators that an award may involve CUI include:

  • References to Controlled Unclassified Information (CUI) in the solicitation or award documents.
  • Requirements to comply with NIST SP 800-171, CMMC,or other federal cybersecurity standards.
  • Clauses related to safeguarding sensitive government information.
  • Restrictions on who may access project data, systems, or research results.
  • Special reporting requirements for cybersecurity incidents or data breaches. 

If you are unsure whether your proposal or award contains CUI requirements, contact Sponsored Research Services (SRS) as early as possible. SRS will work with you to review the RFP or award terms, identify any CUI-related obligations, and coordinate with other campus offices to ensure appropriate protections are in place before work begins.

Controlled Unclassified Information (CUI) requirements are most commonly associated with federal government agencies, particularly when an award involves sensitive government information that must be protected. Examples of sponsors that may include CUI requirements in specific awards include:

  • U.S. Department of Defense (DoD) 
  • National Science Foundation (NSF) 
  • Department of Energy (DOE) 
  • NASA 
  • Other federal agencies that handle sensitive information subject to government safeguarding requirements. 

It is important to note that not every award from these agencies contains CUI requirements. CUI obligations apply only when the specific award, contract, agreement, or associated data includes information designated as CUI or incorporates requirements for safeguarding such information. 

Researchers should review award documents carefully for references to CUI, NIST SP 800-171 compliance, cybersecurity requirements, data protection clauses, or other information handling restrictions.

If you are submitting a proposal, the RFP will most likely indicate whether or not CUI is anticipated. Review the RFP carefully and work with SRS to determine if RIT is able to conduct the research.

Occasionally, CUI clauses may be included in an award even if it was not refenced in an RFP. In these cases, the SRS post award team will work with you and the sponsor to address any concerns. 

RIT evaluates awards and contracts to identify Controlled Unclassified Information (CUI) requirements before project work begins. When an award references CUI obligations, SRS works with the sponsor, the principal investigator, and relevant campus offices (i.e. Research Computing, RIT Information Security, Office of Legal Affairs, Risk Management, and Compliance and Ethics) to address any issues.

Because CUI requirements vary by sponsor and award, researchers should not assume that standard university systems are approved for CUI projects. If you believe your project involves CUI, contact Sponsored Research Services (SRS) as early as possible so that appropriate reviews and safeguards can be established or mitigated before work begins. RIT is working towards compliant systems and current capabilities are listed here - https://www.rit.edu/security/rit-information-handling-and-services-matr… .

Note: Not all federal awards contain CUI requirements. CUI protections are required only when specified by the sponsor or when the project involves information designated as Controlled Unclassified Information.

The National Archives website provides an overview of CUI and resources for learning and training. 

RIT is partnered with Citi Program for various training courses, and one on CUI is offered. Please visit the SRS page on CITI to learn how to find and enroll in Citi Program courses.