Controlled Unclassified Information, or CUI, is sensitive government-related data that is not classified but still must be protected. In practice, it can include contractor records, technical data, personnel information, or operational details that could harm an agency or program if exposed. CUI often drives security requirements because it defines which systems are in scope, which users may access the data, and what safeguards must be documented and monitored.
In cyber security, CUI matters because attackers often target it even when it is not secret in the traditional sense. Theft, ransomware, misconfigured sharing, and weak access control can all expose CUI and create contract, legal, and mission risks. Defenders protect it with segmentation, encryption, least-privilege access, logging, secure backups, and clear marking and handling procedures. Good CUI control also supports audits, since evidence must show that protections are actually operating, not just written in policy.