The debate over CUI is revealing a larger struggle over how government buys technology

July 28, 2026 - 19:03

A simmering debate over Controlled Unclassified Information, or CUI, is pulling back the curtain on a much larger conflict: how the federal government buys technology in the first place. At the heart of the argument is a fundamental tension between efficiency and accountability. "We always say we want the government to act more like a business, but at the end of the day, the government isn't a business," said Emily Murphy, a former administrator of the Office of Federal Procurement Policy.

The CUI framework, designed to standardize how sensitive but unclassified data is handled, has become a flashpoint. Industry leaders argue that current compliance requirements are overly rigid, driving up costs and slowing down innovation. They want more flexibility, similar to how private companies manage risk. But government officials push back, pointing to the need for transparency and public trust. A private firm can quietly change a software vendor if security standards shift; an agency must justify every dollar and every decision to Congress and the public.

This clash is not just about data labels. It reveals a systemic struggle. The government's procurement rules were built for a slower, hardware-centric era. Today, agencies need cloud services, artificial intelligence, and rapid cybersecurity updates. Yet the buying process often remains stuck in a cycle of lengthy requests for proposals and fixed-price contracts that discourage adaptation. Until the underlying rules catch up with modern technology, debates over CUI will remain a symptom of a deeper, unresolved problem.