Controlled Unclassified Information (“CUI”) is sensitive, unclassified information. This means that not only must CUI not be available to the general public, but also that access to the information must not be granted to anyone unless they have a “lawful government purpose” to handle that information.

Things get even a little more confusing when CUI is subject to export controls, like those covered by the International Traffic in Arms Regulation (“ITAR”) and Export Administration Regulations (“EAR”), or when there are “limited dissemination controls” that restrict to whom the CUI can be disseminated.

The flowchart above, prepared by the CMMC Information Institute and available in PDF form here, illustrates a process for determining when you, as the Authorized Holder of the CUI, can disseminate the CUI to a recipient (in this case, “Mary”).