Controlled Unclassified Information and classified national security information are often discussed together because both are subject to government information-handling rules.
But they are fundamentally different.
CUI is not a lower classification level. It is a separate program for protecting certain types of unclassified information.
Understanding the distinction is essential for employees, contractors, and organizations that handle government information.
What is classified information?
Classified national security information is information that has been classified under applicable national security authority.
The familiar classification levels are:
- CONFIDENTIAL: Unauthorized disclosure could reasonably be expected to cause damage to national security.
- SECRET: Unauthorized disclosure could reasonably be expected to cause serious damage to national security.
- TOP SECRET: Unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to national security.
Additional dissemination or handling controls may apply.
Classification decisions are made under authorized government procedures. A software scanner cannot independently create or revoke a classification determination.
What is CUI?
Controlled Unclassified Information is information that requires safeguarding or dissemination controls pursuant to applicable laws, regulations, or government-wide policies but is not classified under the governing national security classification authorities.
The CUI program standardizes how executive branch agencies identify and handle this information.
CUI can include information in categories covering privacy, law enforcement, critical infrastructure, and other subjects identified in the official CUI Registry.
CUI is generally divided into:
CUI Basic: Information subject to the CUI program's generally applicable controls.
CUI Specified: Information for which the underlying authority establishes specific handling requirements that differ from the general controls.
How do the markings differ?
Consider the following examples:
| Example marking | General interpretation |
|---|---|
| SECRET | Classified marking |
| TOP SECRET | Classified marking |
| SECRET//NOFORN | Classified marking with an additional dissemination control |
| CUI | Controlled Unclassified Information marking |
| CUI//SP-PRVCY | CUI Specified privacy-related marking |
These examples illustrate recognizable formats. Valid marking combinations and their required use depend on the governing policies.
A critical distinction is that the presence of a marking provides an indicator of how information is designated or intended to be handled. It does not independently establish whether the designation was correctly applied.
Can CUI and classified information appear together?
Yes. Information may be commingled in a properly managed document or information product.
When that occurs, applicable classified-information marking rules and CUI requirements must be followed.
The CUI program does not eliminate the protections required for classified information.
Common misconceptions
"CUI is classified information."
No. CUI is, by definition, unclassified.
"Anything sensitive is automatically CUI."
No. CUI must fit within the applicable legal and regulatory framework. Organizations cannot arbitrarily designate information as CUI simply because it is confidential.
"If a document has no CUI banner, it contains no CUI."
Not necessarily. Documents may be incorrectly marked, unmarked, or governed by specific marking guidance.
"A scanner can determine whether something is classified."
Not authoritatively. Software can identify patterns and indicators. Classification and designation determinations require appropriate authority and context.
Why automated marking detection helps
Employees may review many documents containing overlapping marking conventions.
Automated scanning can make recognizable markings easier to locate and examine.
Strike Gate focuses on detecting classified and CUI marking indicators in supported files, helping users identify material that may require additional review.
It does not replace classification authorities, CUI designation decisions, or organizational release controls.
The practical goal is straightforward: help people identify potentially significant markings before information is shared.