What defense suppliers need to know about CUI

What qualifies as CUI?

CUI is unclassified information that the government creates or holds—or that another party creates or holds on the government’s behalf—that is required by law, regulation, or government-wide policy to be protected in specific ways. 

While CUI is sometimes confused with routine Federal Contract Information (FCI), there are important differences between the two: 

• FCI is information provided by or created for the government under a contract that is not intended for public release. It does not include publicly available information or simple transactional information such as payment-processing instructions. FAR 52.204-21 establishes applicable basic safeguards for systems that handle FCI, while CMMC requirements depend on the applicable contract or subcontract. 

• CUI may include information such as technical drawings, specifications, and export-controlled data that meets the definition above and applicable category criteria. CMMC Level 2 requires you to protect CUI by following the security standards in NIST SP 800-171 Rev. 2. 

Your official CMMC level and assessment type are specified in your contract, though you may face additional protection obligations beyond its terms. 

Inclusion in a defense customer’s file doesn’t automatically make a document CUI, and the lack of a marking doesn’t necessarily mean that it is not CUI. Suppliers must do their own due diligence, using contract and agency guidance to determine whether a given file qualifies as CUI and what safeguards it may require. The following steps can help.

Step 1: Check for a designation

As a starting point, see whether the information carries a marking. For example: 

• A CUI // SP-CTI banner. This gives you a clear answer: Handle the document per your CUI procedures. 

• A legacy marking, such as “For Official Use Only” (FOUO). While this may map to a current CUI category, you’ll have to investigate further. 

• Only a “Proprietary” marking or company banner. Again, you must dig deeper to clarify the document’s status. 

• Distribution Statement B–F. This tells you that distribution restrictions apply, but not necessarily that the document contains CUI. Follow the stated restrictions and confirm whether CUI handling requirements also apply. 

If an unclear or absent marking leaves you uncertain, obtain guidance by reviewing the instructions for your contract and exploring the categories described in the National Archives’ CUI Registry. If the status of the information remains uncertain, seek clarification from the information’s originator or the Government Contracting Activity (GCA) for insight. For future reference, document their responses within your project records.

Step 2: Map your information flows

The protection requirements for CUI extend to the systems that process, store, transmit, or protect it as it travels through your organization. These can include: 

• Email inboxes used to receive a project file 

• Design applications used to open the file 

• Shared drives where the file is saved 

• ERP or quoting systems where CUI from the file is entered 

• Printed instructions or equipment files that contain CUI 

• Derivative specifications retaining CUI that are sent to subcontractors 

• Assets and services that provide security protections for the CUI environment, even if they don’t handle CUI directly 

Working with IT and project team members to map this flow can help you build an inventory of the assets you must protect. Based on the role each asset plays, you can determine whether CMMC Level 2 applies and, if so, what its corresponding asset category and requirements are. 

Each asset within the CMMC Level 2 assessment scope must be cataloged in your asset inventory, shown on your network diagram, and documented along with any applicable security practices and risk management rules in your System Security Plan (SSP). 

Even assets that are not intended to be part of the workflow may still fall within CMMC Level 2 scope, so evaluate their roles, capabilities, and connections individually. The following criteria can help guide your review; use current CMMC scoping guidance to confirm how they apply to your environment: 

• The asset cannot process, store, or transmit CUI. 

• The asset does not provide security protections for CUI assets. 

• The asset is physically or logically separated from CUI assets or is inherently unable to process, store, or transmit CUI. 

• The asset does not fall into another in-scope category. 

Be prepared to provide this justification for any asset you classify as out of scope.¹

Step 3: Read your contract requirements

A defense contract may include explicit information on CUI protection requirements. Defense Federal Acquisition Regulation Supplement (DFARS) provisions and clauses 252.204-7012, 252.204-7019, 252.204-7020, and 252.204-7021 convey specific compliance obligations. Additional requirements can flow down from your prime. 

Before making a final determination of your CUI handling requirements, work with your contracts or compliance lead to confirm your understanding of these terms. Seek additional clarification from your prime or contracting activity as needed.

CUI protection in action

Use your CUI workflows and contractual requirements to define a security boundary that supports how your team works.  

Rather than bringing their entire environments into scope, organizations of any size can choose to concentrate CUI work within a dedicated, managed enclave. This may reduce the number of systems requiring CUI safeguards and make administration, documentation, and evidence collection more manageable.  

The potential time and cost savings achievable with this approach depend on the design, supporting services, and consistent use of approved workflows. 

A managed enclave can also shift specified operational tasks to a provider. Confirm which services and evidence are included, and which responsibilities remain with your organization. 

Work with your contracts, IT, security, and compliance leads to review the boundary and follow applicable assessment requirements. 

Keep documentation that supports your scope decisions and responses to customer inquiries, including: 

• Applicable customer terms and DFARS clauses and provisions 

• Identified CUI categories and clarification received 

• Information flows and authorized external recipients 

• Asset inventories and network diagrams, with asset treatment and control responsibilities described in your SSP 

Update these records as systems, users, and workflows change.

Next steps for CUI

To learn more about CUI handling requirements and practices, download our new eBook: Could you be handling CUI without knowing it? Inside, you’ll find a link to an on-demand webinar discussing the topic in depth.  

If you’re ready to take the next step, talk to an Exostar expert who can help support your organization’s CUI protection and secure collaboration needs.

¹The asset categories and conditions for treating assets as outside scope are distinguished in 32 CFR 170.19(c)(1), Table 3 in the Code of Federal Regulations.  

This blog is for informational purposes only and does not constitute legal advice or guarantee compliance. Requirements may vary by contract and change over time. Confirm applicable obligations with your contracts, legal, and security teams.