How is CUI defined in DoDI 5200.48?

How is CUI defined in DoDI 5200.48?

• A. Information classified as Secret
• B. Unclassified information that requires safeguarding or dissemination controls under law, regulation, or policy and is not classified.
• C. Any information created by DoD contractors
• D. Public information not subject to controls

Answer: (B)

CUI is unclassified information that requires safeguarding or dissemination controls under law, regulation, or policy, and is not classified. The focus here is on how the information must be handled, not on its classification level. That means data can be sensitive and still be unclassified if protections and access restrictions are required by applicable laws or policies. Public information or material that is already classified as Secret would not be CUI, and not every item created by DoD contractors is automatically CUI—the key is whether it requires controls while remaining unclassified.

CUI is unclassified information that requires safeguarding or dissemination controls under law, regulation, or policy, and is not classified. The focus here is on how the information must be handled, not on its classification level. That means data can be sensitive and still be unclassified if protections and access restrictions are required by applicable laws or policies. Public information or material that is already classified as Secret would not be CUI, and not every item created by DoD contractors is automatically CUI—the key is whether it requires controls while remaining unclassified.