The Information You Must Guard: Controlled Unclassified Information and Spillage

Published 2026 | TIKC NewsWire

Classified information gets all the attention, but the data most contractors actually handle is Controlled Unclassified Information, or CUI: sensitive but unclassified material the government requires you to protect. Technical data, personally identifiable information, law-enforcement data, procurement-sensitive files, and more all fall under the CUI umbrella, each with rules for how it must be marked, stored, shared, and disposed of. Treat CUI casually, let it spill to someone who should not have it, and you move from a handling mistake into contractual breach and, where you certified protections you did not have, fraud exposure.

What CUI is and why it is strict

CUI is a government-wide category created to standardize how unclassified but sensitive information is protected across agencies and their contractors. If your contract involves CUI, you are generally required to safeguard it in line with federal standards, mark it correctly so others know what it is, limit who can access it, and report when it is compromised. The point is that unclassified does not mean unprotected. A spreadsheet of personal data or a sensitive technical file can do real damage in the wrong hands, and the government holds you responsible for keeping it in the right ones.

Marking and spillage are the daily risks

Two failures dominate. The first is mismarking, where CUI is not labeled, is labeled wrong, or is stripped of its markings as it moves between documents and systems, so people handle it without knowing what it is. The second is spillage, where CUI lands somewhere it should not: an unsecured email, a personal device, a shared drive open to the whole company, a subcontractor with no need to know. Spillage is often an accident, a forwarded message or a careless attachment, but the obligation to prevent it and to report it when it happens is not optional.

Where CUI meets your cyber duties

CUI does not stand alone. Protecting it on your systems is exactly what the security controls behind CMMC and NIST 800-171 are built to do, and a CUI spill on a defense contract can trigger the 72-hour cyber incident reporting clock. If you certified that you safeguard CUI to the required standard and you did not, the gap between claim and reality is the same false-certification problem driving today’s cyber-fraud cases. CUI is where your paperwork promises and your actual security have to match.

The insider dimension

Most spillage is not a hacker. It is a well-meaning or careless employee, which is why CUI protection and your insider-threat program are two sides of one coin. People who do not know what CUI looks like cannot protect it, and people who can move it freely will eventually move it wrong. Training, access limits, and clear marking are what turn a vague duty into a habit your staff can actually follow.

What to do now

• Identify your CUI. Know which information on your contracts is CUI and what category it falls in.
• Mark it correctly. Apply and preserve the right CUI markings as information moves between documents and systems.
• Limit access. Restrict CUI to people with a need to know, and keep it off open drives and personal devices.
• Have a spillage plan. Know how to contain and report a spill, and practice it before you need it.
• Train everyone. Make sure staff can recognize CUI and know the handling rules, not just your IT team.

CUI is the quiet majority of the sensitive information you touch, and the government measures you by how well you guard it. Mark it, limit it, train to it, and report honestly when something slips, and you keep both the data and the contract safe. Brick by brick.

FAQ

What is Controlled Unclassified Information?

Sensitive but unclassified information the government requires contractors to protect, such as technical data, personal data, and procurement-sensitive material, standardized under a government-wide CUI program.

What is CUI spillage?

When CUI ends up somewhere it should not, like an unsecured email, a personal device, or an open shared drive, or reaches someone without a need to know. Preventing and reporting it is a contractual duty.

How does CUI connect to my cybersecurity obligations?

Safeguarding CUI is what NIST 800-171 and CMMC controls are designed to do, and a CUI compromise on a defense contract can trigger cyber incident reporting. Certifying protections you lack creates false-certification risk.

Who needs CUI training?

Everyone who might touch it, not just IT. Staff who cannot recognize CUI or do not know the handling rules are the most common source of spillage.

Sources

National Archives Information Security Oversight Office. (2026). Controlled Unclassified Information Program, 32 CFR Part 2002.

National Institute of Standards and Technology. (2026). Special Publication 800-171, Protecting Controlled Unclassified Information.

This article is general information, not legal advice.