Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Information Technology Laboratory

Small Business Cybersecurity Corner

NIST Small Business Resources for Protecting Controlled Unclassified Information (CUI)

What is CUI?

CUI is information the government creates or possesses, or that an entity creates or possesses on behalf of the government, that law, regulation, or government-wide policy requires you to take technical and operational steps to protect. Systems that process, store, and transmit CUI often support government programs involving sensitive critical assets. As part of a contractual agreement with the federal government, or possibly with other organizations like municipal governments, prime contractors, universities, etc., you will likely be required to demonstrate you are taking adequate measures to protect CUI. CUI is marked by the federal agency, and it is the responsibility of the federal agency to ensure that requirements to protect CUI are identified in applicable contracts or agreements.

NIST’s Role

NIST is responsible for developing and publishing the security requirements for the protection of CUI. How requirements are mandated, and any compliance issues related to nonfederal implementation of NIST’s guidelines, are the responsibility of the federal agency requiring its use, as expressed in a specific contract or agreement.

Protecting CUI Small Business Resources

These small business resources are designed to help small businesses get started with NIST’s suite of protecting CUI guidelines. They provide an overview of foundational concepts, tips for getting started, helpful resources, frequently asked questions, and more.

Protecting Controlled Unclassified Information, NIST SP 800-171r3 Small Business Primer

Assessing Security Requirements for CUI, NIST SP 800-171Ar3 Small Business Primer

Videos:

Small Business Cybersecurity Webinar - Protecting Controlled Unclassified Information: Overview of SP 800-171 r3 — Webinar: Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems, overview of NIST SP 800-171r3 Small Business Prime

Assessing Security Requirements for Controlled Unclassified Information (CUI), Overview of NIST SP 800-171Ar3 Small Business Primer — Webinar: Assessing Security Requirements for Controlled Unclassified Information (CUI), overview of NIST SP 800-171Ar3 Small Business Primer

Related Tools:

The Cybersecurity and Privacy Reference Tool (CPRT) provides downloadable Excel and JSON versions of SP 800-171r2 and SP 800-171r3.

Additional Resources:

Created November 3, 2026, Updated November 6, 2026

Was this page helpful?