Those types of information for which laws, regulations, or government-wide policies require or permit agencies to exercise safeguarding or dissemination controls and which the CUI Executive Agent has approved and listed in the CUI Registry.
Sources:
NIST SP 800-172r3
from
32 C.F.R., Sec. 2002