The ISOO CUI Registry is the U.S. government's official online catalog that defines which unclassified information categories are "controlled" and therefore must be marked, safeguarded, and disseminated under the Controlled Unclassified Information (CUI) Program. Its core purpose is to end the old patchwork of agency-specific labels by giving every federal agency and contractor one authoritative list of approved CUI categories, each with a marking, a governing authority, and handling requirements. The National Archives and Records Administration (NARA) maintains the registry through the Information Security Oversight Office (ISOO), and agencies may not protect information as CUI unless it appears there or is issued under a recognized law, regulation, or government-wide policy.
How the CUI Registry Rewired the Government's Labeling System
Before the CUI Program, the same defense document might carry "For Official Use Only," "Sensitive But Unclassified," or "Law Enforcement Sensitive" depending on which office handled it. The registry exists to collapse that noise into a single, government-wide taxonomy. Executive Order 13556, signed in November 2010, established the program and tasked the National Archives with implementation; the regulation at 32 CFR Part 2002 then made the registry the definitive scope document.
That history matters for anyone reading the registry today. The rules went operational across the federal enterprise roughly in 2023, though agencies have moved at different speeds, and some legacy markings still surface in older correspondence. A document dated 2019 carrying "Sensitive But Unclassified" is not automatically wrong to withhold β it simply predates the marking discipline the registry now imposes.
The registry's official title is the "Controlled Unclassified Information Registry," and it lives on the archives.gov domain under the ISOO program office. It is not a database of individual documents. ISOO does not track, catalog, or hold the actual files agencies designate as CUI. The registry holds category definitions only.
Think of it as the dictionary, not the library. A contracting officer looking at a marked document can cross-check the marking against the registry's category list to confirm the label is authorized and see what handling the category demands. That check is the practical daily use most people have for the site.
Where the CUI Program's Authority Actually Sits
ISOO, a small office inside NARA, holds the pen on the registry's contents. Under 32 CFR 2002.4, the CUI Executive Agent β the Director of ISOO β is responsible for maintaining the registry and approving categories. Agencies cannot simply invent a new CUI category on their own authority. They must petition through an established process and justify the category against an underlying law, regulation, or government-wide policy.
The distinction between "authority" and "category" is where most newcomers stumble. The registry lists categories such as "Privacy" or "Procurement and Acquisition," but every category traces back to a legal source. Privacy categories rest on the Privacy Act of 1974 and related statutes. Export-control categories rest on the International Traffic in Arms Regulations and the Export Administration Regulations. The registry entry shows both the category and the authority behind it.
That design has a consequence worth stating plainly: if an agency cannot point to a law, regulation, or government-wide policy, it cannot legitimately protect information as CUI. The registry is a bounded list, and the boundary is legal, not discretionary. A program manager who claps "CUI" onto a document out of convenience is not exercising judgment; they are operating outside the registry.
NARA's own program guidance states that ISOO does not adjudicate individual agency marking disputes. Day-to-day marking decisions belong to the agency's CUI Program Manager, whom each agency must designate and report to ISOO. The registry supplies the shared vocabulary; the agencies supply the local decision-making.
Reading a Registry Entry: Categories, Markings, and Authorities
Each registry entry carries a consistent skeleton. The category name comes first, then the abridged marking used on documents, then the authority or authorities that enable protection, then a short definition of what the information covers, then any required or permitted handling caveats. The abridged marking is the short form printed on the face of a document, such as "CUI//SP-PRIV" for a privacy category.
The two marking families in the registry's scheme are basic and specified. Basic CUI carries only the "CUI" designation with no additional sub-label. Specified CUI appends a category code after a double slash, so a document marked for a specific category reveals the category family at a glance.
Remember that the registry's categories are grouped into broad families β roughly two dozen of them β including Privacy, Procurement and Acquisition, Proprietary Business Information, Law Enforcement, Export Controlled, Critical Infrastructure, Intelligence, and several others covering fields like immigration, financial, and legal matters. The families exist for navigation; the regulation applies to the categories within them.
The split-value drafting means the same practical rule holds whether you are reading the web version or a cached PDF snapshot: the category definition is the operative text, and the marking is the shorthand. If the shorthand and the definition conflict, the definition governs.
Who Actually Uses the Registry, and for What
Three audiences drive most traffic to the registry, and each uses it differently. Federal agency officials consult it to confirm that a designation they plan to make is authorized and to find the correct marking. Contractors handling CUI use it to map the categories they receive to the handling requirements in their contracts, especially when the contract invokes Defense Federal Acquisition Regulation Supplement requirements.
Contractors working under DFARS face an additional layer. The cybersecurity requirements for protecting CUI in contractor systems, codified in the DFARS 252.204-7012 clause and NIST SP 800-171, assume the contractor knows which categories it touches. The registry helps contractors identify the CUI categories their deliverables likely include. Without that identification, scoping a controls assessment is guesswork.
The third audience is the general public, which most often wants to know whether something it received is legitimately marked. A citizen who receives a redacted document with a "CUI" stamp can check the registry to see whether the code corresponds to a real category. That check will not resolve an appeal or a FOIA dispute, but it tells the recipient whether the marking is recognizable.
A Worked Cross-Check Using the Registry's Own Logic
To see how the registry functions in practice, walk through an example. Suppose a defense contractor receives a solicitation attachment bearing the marking "CUI//SP-PROCURE." The contractor does not recognize the code and needs to know whether the document is legitimately controlled and what handling to apply.
The first move is to open the registry's category list and search for the code. The PROCURE family, Procurement and Acquisition, appears in the registry as a recognized category covering source-selection-sensitive and contract-related information. Each subcategory carries its own entry and its own underlying authority, usually drawn from procurement statutes and the Federal Acquisition Regulation.
Once the category is confirmed, the contractor consults the handling requirements tied to the category and to any contract clauses. The registry entry itself does not restate every safeguarding rule; it points to the governing authority. The contractor's obligations then come from the contract plus the underlying law, not from the website alone.
If the search returns no match, the marking is suspect. That is a real failure case worth flagging: a code that does not exist in the registry may indicate an outdated legacy marking, a typo, or a document that was never legitimately controlled. The registry is not an adjudicator, but it is a reliable first filter, and a mismatch should be escalated to the contracting officer rather than resolved by assumption.
Where the Registry Stops: Scope After the Category Check
The registry defines scope, not procedure. Once a category is confirmed, the actual handling rules come from elsewhere: agency policy, contract clauses, and the underlying statutes. A privacy category invokes Privacy Act restrictions on disclosure. An export category invokes ITAR or EAR controls on release to foreign persons. The registry names the category; the authority does the governing.
That distinction is the registry's chief limitation. It does not tell you how to store, transmit, or destroy a document. Agencies and contractors derive those rules from their own policies, which must be consistent with 32 CFR Part 2002 and with the category's enabling authority. A reader who expects a complete procedural manual from the registry will be disappointed.
The registry also does not cover classified information. National security classifications remain governed by Executive Order 13526 and its implementing directives, not by the CUI Program. A document marked "SECRET" never appears in the CUI registry, and the two systems do not share a marking vocabulary.
One edge case worth knowing: some information is designated CUI by statute whether or not a particular agency has adopted a category practice. The regulation accounts for this, and the registry's category list reflects statutory authorities where they exist. If a statute requires protection of specific unclassified information, the registry is designed to reflect that category rather than leave the protection unauthorized.
The Registry and the Contractor's Actual Obligations
For contractors, the registry's practical value is scoping. Under DFARS 252.204-7012, contractors that handle covered defense information must implement NIST SP 800-171 controls. "Covered defense information" is a DFARS term, not a CUI registry term, which is exactly the confusion that trips people up. The DFARS term maps broadly onto CUI categories but is defined in the contract clause, not in the registry.
A contractor who reads the registry to determine whether SP 800-171 applies will find incomplete guidance. The registry tells you a category exists; the contract tells you the obligations attach. The correct sequence is contract first, registry second. Read the clause, identify which CUI categories the deliverables include, then use the registry to understand each category's governing authority.
The mapping is not always one-to-one. Some procurement categories correspond directly to DFARS covered defense information; others, such as certain privacy categories, fall under separate statutes with different handling rules. A contractor building a compliance program should map its contract deliverables to registry categories category by category rather than treating "CUI" as a single uniform bucket.
That category-by-category approach also drives the assessment scope. NIST SP 800-171 applies to the systems that store, process, or transmit covered defense information. If a contractor touches only one CUI category in a small subsystem, the scope can be narrowed accordingly β but only after the contract and the registry entry confirm what that category actually is.
How Categories Get Added, and Why the List Moves Slowly
The registry does not update on a marketing calendar. Adding a category requires an agency to demonstrate an underlying legal authority and justifies the protection under the established process. Because that process demands statutory or regulatory grounding, the list changes slowly and deliberately.
The practical implication for readers is that an older registry snapshot is often still accurate for the major categories. The defined families and their codes have been stable since the program's early implementation, and the 2023 operational milestone did not rewrite the taxonomy. A cached registry listing from 2020 will still recognize "CUI//SP-PRIV" and "CUI//SP-PROCURE."
Even so, agencies have issued supplementary policy guidance that affects how categories are handled without changing the category list itself. That is where an outdated snapshot fails: not in the code, but in the handling details the agency has added. Verify handling against the agency's current policy rather than against a stale copy of the registry.
The governing body also matters here. ISOO's CUI Executive Agent maintains the list, and the office publishes supplemental guidance alongside it. Anyone citing the registry as authority should cite ISOO and NARA, not the specific web page, because the page address can change while the category survives.
Common Mistakes When Interpreting a CUI Marking
The most common misinterpretation is treating the registry as a complete list of everything an agency can protect. It is a list of authorized categories, not a catalog of every document. A document without a registry-recognizable code is not legally CUI merely because someone wrote "CUI" on it.
The second mistake is assuming "CUI" and "classified" share a continuum. They do not. The CUI program covers unclassified information only. A document marked "CUI" cannot be treated as classified, and treating it as though it were classified can itself violate the program's dissemination rules, which allow sharing with those who need it under the authorized authority.
A third mistake is using the registry to resolve a classification dispute or a FOIA appeal. The registry establishes scope, and the dispute-resolution machinery runs through the agency's CUI Program Manager and the FOIA process, not through a website lookup. Citing the registry in a FOIA appeal may support a claim about the marking's legitimacy, but it will not settle the request.
Finally, some agencies still use legacy markings on older documents. A 2018 memo labeled "For Official Use Only" is not made invalid by the registry's existence; it reflects a pre-CUI practice. The registry governs new markings and identifies categories; it does not retroactively relabel every archived file.
How to Check a Marking Against the Registry in Five Steps
This is the routine a contractor or agency reviewer can follow when a document's marking is unfamiliar. It assumes the document has already been received and the question is whether the marking is authorized and what handling follows.
1: Read the full marking exactly as printed, including the double slash and code, e.g., "CUI//SP-PRIV." Note the basic versus specified distinction. 2: Open the ISOO CUI Registry through the NARA website and locate the category family from the code. 3: Confirm the specific category entry and its listed authority or authorities. The authority field determines whether the category is legitimately established. 4: Read the category definition to check that the content matches the category. A code that is valid but applied to the wrong content is a misdesignation, not a valid marking. 5: Consult the contract clause or agency policy for handling rules. The registry confirms scope; the contract and the underlying authority set the obligations.
If step 3 or step 4 fails β no matching category, or content that does not fit the definition β stop and escalate. Ask the issuing office to confirm the marking. Do not strip the marking and do not treat the document as unrestricted on the assumption that the marking is invalid. The failure-handling rule is conservative: hold the document, verify with the source, and document the exchange.
A worked timing note: the lookup itself takes about two minutes for a reader who knows the family, and closer to ten for someone navigating the site for the first time. That is cheap compared with the cost of guessing wrong on a controlled document.
FAQ
Is the CUI Registry the same thing as a CUI document database? No. The registry catalogs categories, codes, and authorities, and ISOO does not track individual documents there. A document marked CUI does not get registered, logged, or indexed in the registry; only its category does. Users who search the site expecting to find a specific file will come up empty.
Can an agency protect anything as CUI without a registry entry? No. Under the program's regulation, an agency must point to a law, regulation, or government-wide policy. Without that authority, marking the information as CUI is not authorized, though the agency may have separate procedures for the same content under another authority. The registry exists to make that authority check explicit.
What does the code "SP" in a marking actually mean? "SP" signals that a category family code follows, so "CUI//SP-PRIV" identifies a privacy category. The double slash separates the general CUI designation from the specified category. Readers who see only "CUI" with no code are looking at a basic marking, which carries no family indication.
Does the registry tell me how to store or transmit a CUI document? No. It establishes category identity and authority, and handling rules come from the governing statute, the agency's policy, and any contract clauses. A registry entry that names the Privacy Act does not itself restate Privacy Act storage rules. The practical rule is registry for scope, contract and policy for procedure.
Is information marked CUI higher than classified information? It is the opposite. CUI is unclassified information, and classified information sits under a separate executive order and a separate marking system. Treating CUI as though it were classified is a recognized error and can obstruct lawful sharing with those who need the information to do their jobs.
What do I do if a marking does not match any registry category? Treat it as unresolved rather than as automatically invalid. Hold the document, do not strip the marking, and ask the issuing office or your contracting officer to confirm. A mismatch may reflect a legacy pre-CUI marking, a typographical error, or a genuinely unauthorized designation, and the source is the only party who can say which.
Does the 2023 operational milestone change what the registry authorizes? The milestone marked the program's operational rollout across agencies, and the category taxonomy itself carried over from earlier implementation. Verify current handling guidance against ISOO's published supplements and the agency's own policy, because those supplements can change without altering the category list.
Can I rely on a cached or PDF copy of the registry? For recognizing whether a major category and its code exist, a cached copy from 2020 onward is usually still accurate. For handling requirements and current agency policy, it is not reliable, because agencies issue supplemental guidance that a snapshot cannot reflect. Use the cached copy for the code lookup, then verify handling at the source.