The authoritative registry is the National Archives and Records Administration (NARA) CUI Registry at archives.gov/cui, which catalogs every CUI category and subcategory, the associated dissemination controls (such as NOFORN, FEDCON, and FOUO-equivalents), required cover sheets, marking guidance, and links to agency-specific policies, forms, and training. The registry is the single government-wide index mandated by 32 CFR Part 2002.
How the CUI Registry Functions as a Controlled Index
The CUI Registry is not a document repository in the ordinary sense. It is a structured index that pairs each information category with the law, regulation, or government-wide policy that authorizes control. NARA maintains it under Executive Order 13556 and its implementing regulation, 32 CFR Part 2002, which directs the Archivist to publish and update the registry.
The mechanism matters because CUI is decentralized by design. Each agency designates categories and applies controls; NARA does not own the underlying information. The registry therefore functions as a concordance, mapping a category label (for example, "Controlled Technical Information") to its source authority, its approved abbreviation, its dissemination-control options, and its required marking pattern.
When you open a category entry, three layers appear. First, the category definition and the citation to its governing statute or regulation. Second, the authorized dissemination controls and the required banner, portion marking, and cover sheet. Third, links to the agency's own implementing policy, forms, and training. The registry indexes these; the agency hosts them.
This two-tier architecture explains a common frustration. The registry tells you a control exists and who owns it, but the actual form (a DD Form, an agency-specific cover sheet) lives on the owning agency's site. NARA links out rather than mirrors. If a link breaks, the category page still identifies the correct authority to contact.
The registry also publishes the CUI Marking Handbook, which translates category entries into marking procedures. The handbook is where the banner-and-portion-marking rules consolidate. Categories change; the handbook version tracks those changes. Treat the edition date on the handbook as your currency check.
Quantified Context: Scale and Update Cadence
The registry organizes CUI into a defined set of top-level categories, each with subcategories, and the count shifts as agencies add or retire designations. Rather than cite a fixed number that ages quickly, note that the registry lists dozens of categories spanning privacy, proprietary business information, critical infrastructure, law enforcement, export control, and immigration.
Dissemination controls are a smaller, more stable set. The common controls include NOFORN (no foreign dissemination), FEDCON (federal employees only), FOUO-equivalent restrictions, and law-enforcement-sensitive markings. Each carries a defined meaning and a defined marking string, which is why the registry tables them explicitly rather than leaving agencies to improvise.
Training requirements are time-bound. Under 32 CFR Part 2002, agencies must train personnel on CUI handling, and many require refresher cycles (commonly annual). The registry links to training resources but does not itself deliver the course; your agency's training portal does. The registry tells you training is required and points to the source.
Cover sheets are category-specific. A given category may require a particular cover sheet at transmission or storage. The registry entry identifies whether a cover sheet applies and links to the issuing agency's template. There is no single universal CUI cover sheet; assuming one exists is a frequent error.
Edge Cases and the Counterintuitive Detail
The counterintuitive point: the registry is deliberately incomplete as a document set. It is authoritative about what categories and controls exist, but it does not host every policy, form, or course. Expecting the registry to be a one-stop download library misreads its function; it is a routing table, not an archive.
A second edge case involves legacy markings. Documents marked FOUO, SBU, or LES predate the CUI program and may still circulate. The registry explains how legacy markings map to CUI categories, but the migration is agency-paced. A registry entry does not retroactively re-mark old documents.
A third edge: controlled unclassified information under export-control authorities (for example, ITAR technical data) may be indexed in the registry while remaining governed primarily by the export-control agency. The registry cross-references; the export agency enforces. Do not assume registry presence overrides a stricter authority.
Common Misconceptions
Misconception one: the registry is a public database of controlled documents. It is public as an index, but the information it describes is generally not public. Confusing the catalog with its contents is a security-relevant error.
Misconception two: one cover sheet fits all. Different categories and controls specify different cover sheets and banners. Using a generic cover sheet where a category-specific one is required can itself be a handling violation.
Misconception three: training completed at one agency transfers everywhere. CUI training is often agency-specific; reciprocity exists in principle but verify with your receiving organization.
Red flags to watch: A category entry with no linked governing authority is a signal to verify before applying a control. A cover sheet template hosted on an unofficial third-party site should never be used. Markings not traceable to a registry category or the Marking Handbook warrant escalation. Training links that resolve to expired portals mean your agency migration is incomplete; contact your CUI program office. Treating a registry category as authorization to create CUI is backwards; the underlying authority authorizes.
Comparison: Registry Versus Other Sources
| Source | What it provides | Scope | Update model | Best use |
|---|---|---|---|---|
| NARA CUI Registry | Category index, controls, marking links | Government-wide | Periodic, agency-fed | Finding the authoritative category and control |
| CUI Marking Handbook | Banner, portion, cover sheet procedures | Government-wide | Versioned editions | Applying correct markings |
| Agency CUI policy | Agency-specific implementation | Single agency | Agency cadence | Local forms and procedures |
| Agency training portal | Required courses, refreshers | Single agency | Continuous | Completing mandated training |
| 32 CFR Part 2002 | Governing regulation | Government-wide | Rulemaking | Understanding legal basis |
| Export-control agency sites | ITAR/EAR technical data rules | Statutory scope | As regulations change | Resolving stricter-authority conflicts |
The table's logic: use the registry to locate, the handbook to mark, and the agency to comply. Each layer answers a different question.
Timeline: How a Category Travels From Law to Your Desk
| Stage | What happens | Artifact produced |
|---|---|---|
| Authority enacted | Statute or regulation authorizes control | Legal citation |
| Category designated | Agency proposes CUI category | Registry entry |
| Registry publication | NARA indexes category and controls | Public listing |
| Marking guidance issued | Handbook maps category to markings | Marking procedures |
| Agency implementation | Policy, forms, cover sheets issued | Agency documents |
| Training deployed | Personnel trained on handling | Course completion |
| Document marked | Information marked per guidance | Marked artifact |
| Review and decontrol | Handling reviewed, controls lifted when eligible | Decontrol record |
The time between stages varies by agency and is not fixed by regulation. A category can appear in the registry before every agency has issued its local forms, which is why the registry sometimes points to guidance still in development.
Practical Actions: Locating and Verifying
Start at archives.gov/cui and search the category name, not a document title. The registry indexes categories, so category-first searching is faster.
Then confirm three things per entry: the governing authority citation, the authorized dissemination controls, and whether a cover sheet is specified. If any is missing, escalate to your agency CUI program office rather than guessing.
For forms and cover sheets, follow the registry's outbound link to the owning agency. Download only from official .gov or .mil sources. Record the handbook edition date you relied on.
For training, use your agency's portal, not a search engine result. Complete the required cycle (commonly annual) and retain completion records. If you handle multiple agencies' CUI, verify reciprocity in writing.
Thresholds to reconcile: the registry governs what categories exist; the handbook governs how to mark; your agency governs how to comply locally. Where they conflict, the stricter applicable authority controls, and the governing statute or regulation outranks all three. One unit system applies throughout: these are categorical and procedural rules, not measured quantities, so no unit conversion is involved.
Limitations and What the Registry Cannot Do
The registry cannot substitute for your agency's program office. It indexes; it does not adjudicate individual marking disputes. It also cannot guarantee that every linked form is current, because agencies control their own sites. Broken or stale links are a known limitation of a distributed model.
The registry does not resolve conflicts between CUI and other control regimes (classified marking, export control, privacy law). Those conflicts resolve through the stricter authority and legal counsel, not through the registry alone. And the registry is not legal advice; it is an authoritative index maintained under 32 CFR Part 2002.
This article is general educational information about how the federal CUI registry is structured, not a legal opinion or a compliance determination for your specific documents. Handling requirements vary by agency and by the underlying authority, so consult your agency's CUI program office or qualified counsel before marking, transmitting, or releasing controlled information. If you face an immediate security incident involving controlled information, contact your organization's security office or local authorities.