One of the most important—and misunderstood—concepts in CMMC compliance is Controlled Unclassified Information (CUI). Whether or not your organization handles CUI directly determines CMMC scoping, certification level, security controls, and even assessment cost. 

Understanding what CUI is, where it exists, and how it impacts CMMC Certification is critical for primes and subcontractors that want to remain eligible for DoD contracts. 

CMMC scoping is the process of identifying which systems, people, processes, and environments are subject to CMMC requirements. 

Scope is determined by: 

• Whether you handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) 

• Where that data is stored, processed, or transmitted 

• Which users and systems can access that data 

Only systems in scope must meet CMMC controls. Improper scoping is one of the most common causes of failed assessments. 

Controlled Unclassified Information (CUI) is sensitive information that requires safeguarding or dissemination controls but is not classified. 

CUI is defined by the federal government and commonly appears in: 

• Technical drawings 

• Engineering data 

• Test results 

• Specifications 

• Contracts and reports 

• Certain emails and attachments related to DoD work 

If your organization stores, processes, or transmits CUI, it directly impacts your CMMC certification requirements. 

CUI is the dividing line between CMMC Level 1 and CMMC Level 2. 

• Organizations handling FCI only typically fall under CMMC Level 1 requirements 

• Organizations handling CUI fall under CMMC Level 2 requirements 

This distinction determines: 

• Which CMMC controls apply 

• Whether a self-assessment is allowed 

• Whether a third-party assessment organization (C3PAO) is required 

• Overall CMMC certification cost and timeline 

Misidentifying CUI is one of the most common reasons contractors fail or delay certification. 

If CUI is in scope, CMMC Level 2 certification is usually required. 

Level 2 aligns with the NIST SP 800-171 controls list, which includes 110 security controls across 14 domains such as: 

• Access control 

• Audit and accountability 

• Incident response 

• Configuration management 

• Identification and authentication 

• System and communications protection 

These controls apply to all systems and users that can access CUI unless scope is properly limited. 

Once CUI is present, CMMC scoping becomes critical. 

Assessors will evaluate: 

• Where CUI is stored 

• Who can access it 

• Which systems can transmit it 

• Whether non-production systems are exposed 

If CUI exists broadly across your environment, the entire environment may become in scope—dramatically increasing compliance effort. 

This is why many organizations implement CMMC enclaves. 

A CMMC enclave is a segmented environment designed to contain CUI while isolating the rest of the organization from Level 2 requirements. 

Properly designed enclaves: 

• Limit the number of systems in scope 

• Reduce documentation requirements 

• Lower certification cost 

• Simplify ongoing compliance 

However, enclaves must be supported by accurate CMMC documentation, policies, and procedures to withstand a CMMC audit. 

Handling CUI significantly increases documentation requirements. 

Organizations must maintain: 

• System Security Plans (SSPs) 

• Policies and procedures aligned to CMMC guidelines 

• Evidence of control implementation 

• Plans of Action and Milestones (POAMs) for unmet controls 

During the CMMC assessment process, assessors validate that documentation accurately reflects how CUI is protected in practice. 

Most organizations handling CUI must undergo: 

• A third-party assessment performed by a C3PAO 

• Certification every three years 

• Ongoing compliance maintenance 

While limited self-assessment scenarios may exist, they are uncommon. Contractors should assume that CUI triggers external assessment requirements. 

CUI directly impacts: 

• Number of applicable controls 

• Assessment duration 

• Remediation effort 

• Documentation workload 

• Ongoing compliance management 

In short, CUI presence is one of the biggest drivers of CMMC certification cost. 

This makes early identification and scoping essential. 

Because CUI is often misunderstood, the best first step is a CMMC self-assessment or readiness checkup. 

A structured checkup helps organizations: 

• Identify whether CUI exists 

• Validate scope accurately 

• Determine the correct CMMC level 

• Identify security and documentation gaps 

• Auto-generate POAMs and policies 

• Estimate timelines and costs 

This creates a clear foundation before engaging assessors or committing to certification. 

CMMC compliance starts with understanding your data. Contractors that correctly identify and manage CUI gain control over scope, cost, and risk—while those that ignore it often face unexpected audit challenges. 

Knowing whether CUI exists, where it lives, and how it is protected is the foundation of every successful CMMC program.