Controlled Unclassified Information (CUI) is defined as federal non-classified information that the U.S. Government creates or possesses, or that a non-federal entity (such as UM) receives, possesses, or creates for, or on behalf of the U.S. Government, that requires certain information security controls to safeguard or disseminate.

CUI may include research data and other project information that a research team receives, possesses, or creates during the performance of a sponsored contract.

The CUI Program is implemented through 32 CFR 2002 "Controlled Unclassified Information."

UM information systems must meet the requirements of NIST SP 800-171 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”.