32 CFR § 2002.12 - CUI categories and subcategories.

---
identifier: "/us/cfr/t32/s2002.12"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "32 CFR § 2002.12 - CUI categories and subcategories."
title_number: 32
title_name: "National Defense"
section_number: "2002.12"
section_name: "CUI categories and subcategories."
chapter_name: "INFORMATION SECURITY OVERSIGHT OFFICE, NATIONAL ARCHIVES AND RECORDS ADMINISTRATION"
part_number: "2002"
part_name: "CONTROLLED UNCLASSIFIED INFORMATION (CUI)"
positive_law: false
currency: "2026-04-05"
last_updated: "2026-04-05"
format_version: "1.1.0"
generator: "[email protected]"
authority: "E.O. 13556, 75 FR 68675, 3 CFR, 2010 Comp., pp. 267-270."
regulatory_source: "81 FR 63336, Sept. 14, 2016, unless otherwise noted."
cfr_part: "2002"
---


# 2002.12 CUI categories and subcategories.

(a) CUI categories and subcategories are the exclusive designations for identifying unclassified information that a law, regulation, or Government-wide policy requires or permits agencies to handle by means of safeguarding or dissemination controls. All unclassified information throughout the executive branch that requires any kind of safeguarding or dissemination control is CUI. Agencies may not implement safeguarding or dissemination controls for any unclassified information other than those controls permitted by the CUI Program.

(b) Agencies may use only those categories or subcategories approved by the CUI EA and published in the CUI Registry to designate information as CUI.