What Does CUI Stand For?

If your organization is doing contract or subcontract work for the U.S. Department of Defense (DoD), you are almost assuredly in possession of CUI! As a DoD contracting partner (or an organization hoping to obtain a DoD contract), it’s important to understand what it is and how to handle it as part of your contractual obligations.

The designation of Controlled Unclassified Information, or CUI, was created by the federal government through the Executive Branch in 2010. Finding that the many departments and agencies within the government all handled CUI differently using disparate policies and regulations, Executive Order (E.O.) 13556 established a uniform program to safeguard the use and dissemination of information that was owned by the government and deemed to be crucial but not classified.

In March 2020, DoD Instruction 5200.48 was initiated by the Office of the Under Secretary of Defense for Intelligence and Security to operationalize EO 13556 for all DoD-related contracts, as well as establish an official DoD CUI Registry.

What is Controlled Unclassified Information and Why Does it Need to be Protected?

While it seems like “classified” information gets all the attention and includes three distinct categories: confidential, secret, and top-secret, CUI is perhaps the most vulnerable and, therefore, potentially the most damaging if it were to fall into the wrong hands.

Prior to 2010, CUI was found under secretive names like “sensitive but classified” or “official use only”. But compared to traditional classified information, CUI is much more accessible and provides “the path of least resistance for adversaries” seeking to learn information about DoD design plans, policies, equipment, chains of command, etc. CUI is seen by intelligence and security professionals as one of the most significant risks to U.S. national security.

Now consider the advances in technology, cybersecurity threats, and advanced surveillance techniques since 2010 and you can see why the federal government, and particularly the DoD, has developed CUI security requirements and registries as a way to manage this sensitive information.

Definition of Controlled Unclassified Information

Specifically, the Controlled Unclassified Information definition for CUI is government created and owned intelligence or information requiring dissemination controls and safeguarding to ensure its safety.

By creating one standard, uniform, and shared system of transparent information sharing, plus a registry to track and control the data, CUI security requirements had been established and were defined by these eight categories or contractor obligations:

1. Identification
2. Sharing
3. Marking
4. Safeguarding
5. Storage
6. Dissemination
7. Destruction
8. Records Management

Examples of Controlled Unclassified Information

While there are numerous groups in the organizational index maintained by the National Archives (the federal government agency charged with disseminating CUI information and guidelines), Controlled Unclassified Information examples related to the DoD include:

• Controlled Technical Information — All technical information related to military or space applications, including research and engineering data, design drawings, specifications, standards, manuals, technical reports, and data sets, studies, and analyses.
• Critical Infrastructure Security Information — Information that might disclose vulnerabilities of the United States and DoD relating to critical infrastructure, including operations, property, or facilities information, or information relating to gas and chemical pipelines, explosives, hazardous chemicals storage facilities, or other types of programs/facilities as defined by the DoD.
• Naval Nuclear Propulsion Information — All technical information related to the safety of nuclear reactors, naval nuclear propulsion plants, and radiation and radioactivity-related facilities.
• Unclassified Controlled Nuclear Information Related to Defense — Information relating to special nuclear material, facilities, or equipment.

Within the additional federal government categories, such as Critical Infrastructure, NATO, Intelligence, Law Enforcement, Nuclear, Provisional/Homeland Security, and Privacy (military records), the DoD may have a vested interest in maintaining CUI information.

What Entails Controlled Unclassified Information Compliance?

So how do you get DoD contractors and subcontractors to understand the importance of guarding any CUI entrusted to them and to willingly participate in procedures that ensure compliance and the safety of the information?

To that end, the National Institute of Standards and Technology (NIST) created NIST Special Publication (SP) 800-171 (popularly known as NIST SP 800-171). This standard sets out key cybersecurity compliance initiatives that are meant to define the ways contractors can process, store, and transmit CUI, plus secure any physical access to their plants, manufacturing site, or facilities.

To comply with NIST SP 800-171, DoD contractors and subcontractors self-assess on 110 control functions divided into 14 focus categories and report their score to the DoD on an honor system basis. However, understanding that the self-assessment scoring process was not adequate, the DoD has implemented the Cybersecurity Maturity Model Certification (CMMC) which will soon become mandatory for all DoD contracts.

The soon-to-be required CMMC 2.0 standards can take months to implement all the while losing government contracts. Engaging a third-party NIST expert allows organizations to meet compliance requirements in an expedited fashion that benefits the company’s bottom line.

In the Final Analysis

For those contractors and subcontractors intending to do business with the DoD (or the General Services Administration, GSA, or NASA), understanding the definition of Controlled Unclassified Information, its purpose, and how to comply with NIST SP 800-171 and CMMC 2.0 will be critical in maintaining existing contracts and being awarded new opportunities.

At Business Lens, we offer NIST expertise that ensures your organization is compliant with CUI and NIST SP 800-171 fast. Our dedicated experts will perform an assessment audit to discover where your organization meets requirements and where it falls short. Our audit can be completed in as little as a week.

Once we know your Supplier Performance Risk System (SPRS) score, we can develop a plan to provide solutions so that you comply in all areas, as well as an ongoing monitoring program that keeps you compliant in the years to come.

Contact Business Lens to learn more about our services, request information, or schedule an audit.