Level 4: Controlled Unclassified Information
Is the data/information Controlled Unclassified Information that under law or policy requires
protection from unauthorized disclosure as established by Executive Order 13556 (November 2010)
or other mission critical data?
​
A “Yes” answer here means that the data/information is CUI as described in applicable references and is not Secret.
A “No” answer here means that the data/information warrants further evaluation for data/information that should reside at a higher level than Level 4 such as NSS or Secret.
​
For Reference: CUI contains a number of categories, including, but not limited to the following:
• Export Control--Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. This includes dual use items; items identified in export administration regulations, international traffic in arms regulations and the munitions list; license applications; and sensitive nuclear technology information.
• Privacy Information--Refers to personal information or, in some cases, personally identifiable information (PII)2 as defined in Office of Management and Budget (OMB) M-07-163 or means of identification as defined in 18 USC 1028(d)(7).
• Protected Health Information (PHI)4 as defined in the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).
• Other information requiring explicit CUI designation (i.e., For Official Use Only, Official Use Only, Law Enforcement Sensitive, Critical Infrastructure Information, and Sensitive Security Information).
​
1 CUI Categories: http://www.archives.gov/cui/registry/category-list.html
2 NIST SP800-22, Protecting PII: http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf
3 OMB M-07-16: http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2007/m07-16.pdf
4 PHI: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/