CUI is government-created or government-owned information that requires safeguarding under law, regulation, or policy — but is not classified. In a machine shop it almost always arrives as something you were sent in order to make a part.
What it usually is
- Engineering drawings carrying a CUI banner or a distribution statement limiting release.
- Technical data packages: models, tolerances, material and process specifications for a defense end item.
- Export-controlled technical data (ITAR or EAR), which is CUI and carries its own separate obligations on top.
- Purchase orders and statements of work that quote or attach any of the above.
- Quality and inspection records that reproduce controlled dimensions or processes.
- Correspondence with the prime that repeats the controlled detail — including the email body, not just the attachment.
What it usually is not
Your own commercial drawings, your pricing, your process know-how, and publicly available standards are not CUI. Protect them for your own reasons; they are not what the assessment is about. And your prime's own proprietary information, absent government markings, is a contractual matter between you and them rather than a CMMC one.
The hard case: nothing is marked
It is common to receive plainly controlled technical data with no marking at all, because a person somewhere skipped a step. The absence of a marking does not make the information uncontrolled, and it does not transfer your obligation to whoever forgot.
Ask the customer in writing whether the package contains CUI, and keep the answer. Treating it as controlled while you wait costs you very little; guessing wrong in the other direction is what an assessor will find.
Two markings people confuse
FOUO is a legacy marking that the CUI programme replaced; documents still carry it, and it does not mean the information is uncontrolled. Proprietary markings applied by a prime are not CUI unless the underlying information is government-controlled. When both appear on the same drawing, the government marking governs.
Where it ends up
Identifying CUI matters because scope follows it. In practice the same drawing exists in six places within a week of arriving: the mail server, someone's downloads folder, the engineering share, the CAM workstation, a USB stick that went to the floor, and a printout on the machine. Each copy is in scope. Shrinking that list is the cheapest security work available to you, and it starts with knowing which documents count.