What are the two main CUI categories used under the policy?

• A. Top Secret and Secret.
• B. CUI Basic and CUI Specified.
• C. Unclassified and Classified.
• D. Public and Restricted.

Answer: (B)

The policy uses two main CUI designations: CUI Basic and CUI Specified. CUI Basic is the default category for Controlled Unclassified Information that doesn’t have a more restrictive designation, applying standard protection and marking requirements across agencies. CUI Specified is used when information needs additional controls due to statutory, policy, or program-specific restrictions, signaling more stringent handling and access limitations beyond the Basic level. Together, they define how most CUI is treated and when extra safeguards are required.

Options referring to Top Secret or Secret relate to classified information, not CUI. The broad terms Unclassified and Classified aren’t the formal CUI categories. Public and Restricted aren’t official CUI categories either.