CUI stands for Controlled Unclassified Information, which is unclassified information that requires safeguarding and dissemination controls, consistent with applicable law, regulation, or government-wide policy. CUI Basic is a subset of CUI that is not directly subject to any special requirements beyond the baseline protections for all CUI.

There are two designations for CUI: Basic and Specified. CUI Basic is the subset of CUI for which the authorizing law, regulation, or government-wide policy does not set out specific handling or dissemination controls. Agencies handle CUI Basic according to the uniform set of controls set forth in DODI 5200.48 and the DOD CUI Registry.

CUI Specified (SP) is the subset of CUI in which the authorizing law, regulation, or government-wide policy contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic. The distinction is that the underlying authority spells out the controls for CUI Specified (SP) information.