How to Classify Information Types

By Donald DeWitt Jr. • January 11, 2022

Determining what types of information your organization possesses is one of the first steps you need to take when starting efforts to enact cybersecurity controls. This classification of information dictates how the data must be controlled and protected.

Here are the different categories of information.

 

FCI – Federal Contract Information

As defined by 48 CFR 52.204-21, this is, “Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information by the Government to the public (such as public websites) or simple transactional information, such as necessary to process payments.”

National Archives and Records Administration (NARA) specifies, “Non-federal systems that store, process, or transmit FCI that does not also qualify as CUI must follow, at a minimum, the basic safeguarding requirements outlined in FAR clause 52.204-21.”

 

It is important to note that FCI (CMMC Level 1) is the minimum if you have a Federal contract.

 

CUI – Controlled Unclassified Information

According to 42 CFR 2002.4, CUI is, “Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

 

“CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.”

 

Additional Safeguards / Classifications:

  • CUI Basic: Requiring or permitting agencies to control or protect the information but providing no specific controls.
  • CUI Specified: Requiring or permitting agencies to control or protect the information and providing specific controls for doing so.
  • CUI Specified, with basic controls where not specified by authority: Requiring or permitting agencies to control the information and specifying only some needed controls.

 

NARA states that, “NIST SP 800-171 will be the minimum standard for protecting CUI in non-federal information systems and organizations (per 32 CFR 2002.14 and 2002.16).”

 

CUI categories for the defense industrial base (DIB)

Refer to this chart to see how to classify your CUI.

 

Banner MarkingCUI CategoryOrganization Grouping
CUI//SP-CTIControlled Technical InformationDefense
CUI//SP-CEIICritical Energy Infrastructure InformationCritical Infrastructure
CUI//SP-EXPTExport ControlledExport Control
CUI//SP-FISA(B)Foreign Intelligence Surveillance Act (Business Records)Intelligence
CUI//SP-PRVCYPrivacyPrivacy
CUI//SP-PROCUREGeneral Procurement & AcquisitionProcurement & Acquisition
CUI//SP-PROPINGeneral Proprietary Business InformationProprietary Business Information
CUI//SP-NNPINaval Nuclear Propulsion InformationDefense
CUI//SP-SRINuclear Security Related InformationNuclear
CUI//SP-PERSPersonnel RecordsPrivacy
CUI//SP-MFCProprietary ManufacturerProprietary Business Information
CUI//SP-PCIIProtected Critical Infrastructure InformationCritical Infrastructure
CUI//SP-DCNIUnclassified Controlled Nuclear Information – DefenseDefense
CUI//SP-UCNIUnclassified Controlled Nuclear Information – EnergyNuclear

 

Learn More

 

While this blog can get you started on determining how to classify your information, the experts at CyberSheath would be happy to help your company identify your FCI and CUI and create plans for safeguarding it. Contact us to take the next step in learning how to protect your sensitive information.

 

CyberSheath Blog

2022 in Review: The CyberSheath Story Expands

This year marked a deluge of messaging about the Cybersecurity Maturity Model Certification (CMMC) and federal contractors were rightfully confused. With our keystone event, CMMC CON, we aimed to set the record straight and offer the best guidance for those in the Defense Industrial Base (DIB).   CMMC CON 2022…

CyberSheath Endorsed by Frost & Sullivan in First Independent Analyst Commentary on CMMC

Independent analyst firms have weighed in with commentary on nearly every discipline of information technology. Security has garnered a large portion of that IT discussion, yet until recently, Cybersecurity Maturity Model Certification (CMMC) compliance has been left out.   Frost & Sullivan changed that by selecting CyberSheath as its preferred…

Be Prepared: CMMC 2.0 Is Coming

Cybersecurity is increasingly important to safeguard your company, your customers, and your partners. We're moving into a global cyber era and we've got to get better at protecting ourselves.   Our adversaries are capitalizing on the lack of security controls in place in the defense industrial base (DIB) and we…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO