How to Classify Information Types

By Donald DeWitt Jr. • January 11, 2022

Determining what types of information your organization possesses is one of the first steps you need to take when starting efforts to enact cybersecurity controls. This classification of information dictates how the data must be controlled and protected.

Here are the different categories of information.

 

FCI – Federal Contract Information

As defined by 48 CFR 52.204-21, this is, “Information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information by the Government to the public (such as public websites) or simple transactional information, such as necessary to process payments.”

National Archives and Records Administration (NARA) specifies, “Non-federal systems that store, process, or transmit FCI that does not also qualify as CUI must follow, at a minimum, the basic safeguarding requirements outlined in FAR clause 52.204-21.”

 

It is important to note that FCI (CMMC Level 1) is the minimum if you have a Federal contract.

 

CUI – Controlled Unclassified Information

According to 42 CFR 2002.4, CUI is, “Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

 

“CUI does not include classified information or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.”

 

Additional Safeguards / Classifications:

  • CUI Basic: Requiring or permitting agencies to control or protect the information but providing no specific controls.
  • CUI Specified: Requiring or permitting agencies to control or protect the information and providing specific controls for doing so.
  • CUI Specified, with basic controls where not specified by authority: Requiring or permitting agencies to control the information and specifying only some needed controls.

 

NARA states that, “NIST SP 800-171 will be the minimum standard for protecting CUI in non-federal information systems and organizations (per 32 CFR 2002.14 and 2002.16).”

 

CUI categories for the defense industrial base (DIB)

Refer to this chart to see how to classify your CUI.

 

Banner MarkingCUI CategoryOrganization Grouping
CUI//SP-CTIControlled Technical InformationDefense
CUI//SP-CEIICritical Energy Infrastructure InformationCritical Infrastructure
CUI//SP-EXPTExport ControlledExport Control
CUI//SP-FISA(B)Foreign Intelligence Surveillance Act (Business Records)Intelligence
CUI//SP-PRVCYPrivacyPrivacy
CUI//SP-PROCUREGeneral Procurement & AcquisitionProcurement & Acquisition
CUI//SP-PROPINGeneral Proprietary Business InformationProprietary Business Information
CUI//SP-NNPINaval Nuclear Propulsion InformationDefense
CUI//SP-SRINuclear Security Related InformationNuclear
CUI//SP-PERSPersonnel RecordsPrivacy
CUI//SP-MFCProprietary ManufacturerProprietary Business Information
CUI//SP-PCIIProtected Critical Infrastructure InformationCritical Infrastructure
CUI//SP-DCNIUnclassified Controlled Nuclear Information – DefenseDefense
CUI//SP-UCNIUnclassified Controlled Nuclear Information – EnergyNuclear

 

Learn More

 

While this blog can get you started on determining how to classify your information, the experts at CyberSheath would be happy to help your company identify your FCI and CUI and create plans for safeguarding it. Contact us to take the next step in learning how to protect your sensitive information.

 

CyberSheath Blog

CMMC 2.0: Understanding the Context and Impact

Since CMMC 2.0 was announced last month, there has been a lot of supposition around what it means. Our approach is to only examine information regarding CMMC 2.0 that has come from official government bodies or authorized government bodies, like the CMMC accreditation body and the Department of Defense.  …

CMMC 2.0: The Effect on Assessments

As the discussions around the impact of the newly announced CMMC 2.0 continue to swirl, we are here to apply our knowledge to our analysis of the news. In our series of blogs on the topic, we started by discussing the context and impact for the update. Our next topic…

CMMC 2.0: POA&M Requirement Changes

In our series of blogs on the newly announced CMMC 2.0  topic, we started by discussing the context for the update and also wrote about the impact on assessments. Our next topic to discuss is the changes to a project management tool known as a plan of action and milestones (POA&M).…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Microsoft