Controlled Unclassified Information, or CUI, is unclassified information that the federal government requires to be safeguarded or subject to controlled dissemination under applicable laws, regulations, or policies.

In precision manufacturing, aerospace, and defense contracting, CUI may appear in the technical and production information used to manufacture a component. Not every defense-related document is automatically CUI. Its status depends on the information’s content, contract requirements, customer flow-downs, and authorized markings or handling instructions.

Examples may include:

• Engineering Data: CAD models, drawings, specifications, GD&T requirements, and technical data packages.
• Derived Manufacturing Data: CAM files, setup sheets, tooling models, and G-code when they contain or reveal controlled technical information.
• Quality and Production Records: Bills of materials, First Article Inspection Reports, CMM results, nonconformance records, and manufacturing plans when they disclose protected technical or program information.

CUI can exist electronically or in printed form. Machine shops must control how applicable files, drawings, travelers, inspection records, emails, removable media, and cloud systems are accessed, stored, transmitted, displayed, and destroyed.

For Department of Defense work, contractors that process, store, or transmit CUI are generally required by contract to implement applicable NIST SP 800-171 security requirements. CMMC provides a method for assessing and verifying that implementation.

The specific CMMC requirement depends on the solicitation, contract, subcontract, information involved, and current implementation rules. The practical objective is not to treat every document as CUI, but to correctly identify protected information, restrict access to authorized personnel, and safeguard it throughout the manufacturing and quality process.