What is it?
The Controlled Unclassified Information program was established by Executive Order 13556 by President Barack Obama on November 4th, 2010.
32 CFR Part 2002 establishes policy for the safeguarding, designation, marking and decontrolling of CUI.
CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies but is not classified under Executive Order 13526 or the Atomic Energy Act, as amended.
CUI comes in two types: Basic and Specified.
The two most common types of CUI for the Department of Defense are Controlled Technical Information and Export Controlled Information.
Controlled Unclassified Information must be protected according to NIST 800-171 / CMMC Level 2 Requirements.