CUI and Export Controls
Table of contents
A common misconception among contractors handling controlled unclassified information (CUI) is that all CUI must remain in the United States and/or be handled by U.S. persons or citizens. Another associated misconception is that all export-controlled information is also CUI. There is also some confusion about the meaning of CUI Export Controlled markings.
This post will explain how to recognize CUI that is export controlled and clear up some of the misconceptions about the intersection between the CUI program, Export Administration Regulations (EAR), and International Traffic in Arms Regulations (ITAR).
CUI handling requirements can be complex. TrustedSec has years of experience working with both contractors and federal agencies to protect CUI using NIST SP 800-171, NIST SP 800-53, FedRAMP, and various other contractual requirements. If you need help to make sense of these programs and minimize the impact of compliance, get in touch with us—we're available to assist!
Overview
The CUI designation alone does not impose any export control or citizenship requirements. By default, CUI may be released to anyone with an authorized lawful purpose to access the information (32 CFR 2002.16(c)(1)).
Export control markings associated with EAR or ITAR also do not automatically mean that information is CUI. There are many ways in which information can be controlled by EAR and ITAR without meeting the definition of CUI.
A document that contains CUI must carry CUI markings regardless of any export controls. Similarly, a document that contains export-controlled information must carry export control markings (either associated with the CUI program, EAR, or ITAR, depending on the circumstances). A document that is both CUI and export controlled must carry both sets of markings.
There are three (3) scenarios where CUI will be export controlled:
- A law, regulation, or government-wide policy restricts U.S. government agencies from sharing the information with non-U.S. persons, in which case the CUI program imposes an export-related Limited Dissemination Control on the CUI that will be marked on the document in accordance with CUI marking standards before the document is disseminated to contractors.
- Export control regulations outside the CUI program, like EAR or ITAR, apply to civilian handling of information that also happens to be CUI because a law, regulation, or government-wide policy controls how U.S. government agencies safeguard or disseminate the information.
- Contracts or other agreements with the government prohibit contractors from sharing information, potentially including CUI, with non-U.S. persons.
Note that CUI EXPT marking (used for information in the CUI Export Controlled category) does not indicate that the CUI is export controlled. This category marking indicates that the CUI is about export controls. The Limited Dissemination Control markings, described below, are instead used to mark information that is export controlled under the CUI program.
Contractors that are confused about why restrictions on the government’s handling of the information affect the CUI designation should review our other post What is CUI? A Contractor’s Perspective.
CUI Limited Dissemination Controls
Limited Dissemination Controls indicate restrictions on who the government can distribute CUI to. There must be a specific law, regulation, or government-wide policy that restricts who the government can distribute CUI to in order to apply a Limited Dissemination Control to CUI (32 CFR 2002.16(a)(2)(i)). This makes Limited Dissemination Controls in general relatively uncommon, and export control Limitation Dissemination Controls rare.
A variety of Limited Dissemination Controls are defined in the CUI Registry Limited Dissemination Controls List. Information that is export controlled under the CUI program will carry at least one (1) of the following markings. CUI that does not carry these markings is not export controlled under the CUI program:
Marking | Description |
|---|---|
NOFORN (Portion Marking: NF) | Information may not be disseminated in any form to foreign governments, foreign nationals, foreign or international organizations, or non-U.S. citizens. |
REL TO followed by a list of country trigraphs | Information has been predetermined by the designating agency to be releasable or has been released only to the specific foreign country(ies)/international organization(s) indicated, through established foreign disclosure procedures and channels. |
DISPLAY ONLY followed by a list of country trigraphs | Information is authorized for disclosure to a foreign recipient but without providing the foreign recipient with a physical copy for retention (regardless of medium), to the foreign country(ies)/international organization(s) indicated, through established foreign disclosure procedures and channels. |
The National Archives and Records Administration (NARA) maintains the full list of country trigraphs used with the REL TO and DISPLAY ONLY markings.
As per the CUI Regulations and the NARA CUI Marking Handbook, these Limited Dissemination Control markings must appear in the mandatory banner at the top of each page of a CUI document and must appear on the optional cover page if it is used.
DoD is Special
The Department of Defense (DoD) doesn’t quite follow the government-wide CUI marking standard and maintains its own standard. DoD CUI documents will not list the Limited Dissemination Control in the banner on each page as required by NARA. Instead, DoD CUI documents will have a Designation Indicator on the first page that lists which component of the DoD decided the information is CUI, what CUI category the information falls into, and a point of contact. The Designation Indicator should also contain any applicable Limited Dissemination Controls.
To confuse matters further, DoD also uses Distribution Statements that predate the CUI program. DoD personnel may indicate the applicable Distribution Statement in the Designation Indicator instead of the Limited Dissemination Control and rely on the Distribution Statement to indicate who the information can be released to.
Contractors should only encounter Distribution Statements A, C, D, and F. Of these, Distribution Statements A and C do not impose export controls while D does. F may or may not impose export controls (read the Distribution Statement in the document to determine what is allowed).
The full list of DoD distribution statements includes:
Distribution Statement | Description | Notes |
|---|---|---|
A | Approved for public release: distribution is unlimited. | This information cannot be CUI nor export controlled because it is public. |
B | Distribution authorized to U.S. Government agencies [category] [date of determination]. Other requests for this document must be referred to [controlling DoD office]. | Contractors will not usually encounter this information because distribution is limited to government agencies. |
C | Distribution authorized to U.S. Government agencies and their contractors [category] [date of determination]. Other requests for this document must be referred to [controlling DoD office]. | This allows distribution to U.S. government agencies and their contractors regardless of nationality, so it should not impose export controls itself. |
D | Distribution authorized to the Department of Defense and U.S. DoD contractors only [category] [date of determination]. Other requests for this document must be referred to [controlling DoD office]. | This limits distribution to U.S. DoD contractors only and therefore would impose export controls. |
E | Distribution authorized to DoD Components only [category] [date of determination]. Other requests for this document must be referred to [controlling DoD office]. | Contractors will not usually encounter this information because distribution is limited to DoD components. |
F | Further distribution only as directed by [controlling DoD office] [date of determination] or higher DoD authority. | This may or may not impose export controls depending on what the controlling office decides. |
Export Control Regulations
Unlike the CUI program, which only applies directly to the government and indirectly to private entities that have an agreement with the government, EAR and ITAR apply directly to everyone in the United States regardless of their relationship (or lack thereof) with the government. Also, unlike the CUI program that only applies to information, EAR and ITAR apply to both information and physical objects.
Information that is export controlled under EAR or ITAR will carry the following markings regardless of whether it is CUI:
EAR | EXPORT CONTROLLED - This information may be subject to the Export Administration Regulations (EAR) pursuant to 15 C.F.R. Parts 730-774. Transfer of this data by any means to a Non-U.S. Person, whether in the United States or abroad without the proper U.S. government authorization is strictly prohibited. Violations of the EAR may be subject to both criminal and administrative penalties under the Export Control reform Act of 2018 (50 U.S.C. §§ 4801-4852). |
|---|---|
ITAR | EXPORT CONTROLLED - This information may be subject to the International Traffic in Arms Regulations (ITAR) pursuant to 22 C.F.R. Part 120-130. Transfer of this data by any means to a Non-U.S. Person, whether in the United States or abroad without the proper U.S. government authorization is strictly prohibited. A violation of the ITAR may be subject to both criminal and administrative penalties under the Arms Export Control Act of 1976 (as amended). |
Information that carries EAR or ITAR export control markings is not automatically CUI. EAR, ITAR, and the CUI program are separate regulations that only partially overlap.
Contractors should not independently mark EAR or ITAR export-controlled documents as CUI nor adjust the Limited Dissemination Control markings on existing CUI documents to reflect EAR or ITAR export controls. The government will apply both the applicable CUI markings (including applicable Limited Dissemination Controls) and the applicable EAR or ITAR export control markings if information is controlled under the CUI program and also export controlled under EAR or ITAR.
As with all CUI, contractors must safeguard and limit the dissemination of documents marked as CUI in accordance with the terms of the agreement under which the CUI is being handled regardless of EAR or ITAR markings. EAR and ITAR do not contain safeguarding requirements; they only restrict to whom the information can be sent.
An Example
This example shows how information may be export controlled under ITAR while not being designated as CUI:
- A company in the United States independently designs and builds a machine gun.
- Both the machine gun and the design documents for it are export controlled under ITAR from the moment they came into existence because fully automatic weapons and technical data regarding fully automatic weapons are in the United States Munitions List (part of ITAR). It is up to the designer to know these regulations exist and follow them.
- The design documents for the machine gun are not CUI because the company did not create them for the government and does not possess them on behalf of the government (part of the definition of CUI).
- The machine gun itself cannot be CUI, because the CUI program only covers information, not physical objects (the “I” in CUI is for “Information”).
Continuing with this example, we can demonstrate how export-controlled information could end up also being designated as CUI:
- The contractor submits a proposal including its proprietary design documents and a sample machine gun to the government in response to a DoD RFP asking for new machine gun designs.
- The government must designate the proposal, including the design documents, as CUI due to various laws and regulations that require the government to safeguard and control the dissemination of information related to procurement and acquisition, source selection, proprietary information, and controlled technical information.
- The sample machine gun and its design documents also remain export controlled because ITAR applies to government agencies as well as civilians.
At this stage in our example, the design documents in the hands of the government are both CUI and export controlled. We can continue to show how this information could end up in the hands of a contractor:
- The government decides to send the sample machine gun and its design documents to a contractor for a technical evaluation.
- The government applies ITAR export control markings to the design documents because ITAR applies to technical data regarding fully automatic weapons.
- The government also applies CUI markings to the design documents because the information became CUI upon receipt by the government, and CUI must be marked before it is disseminated.
- The government should establish a CUI safeguarding agreement with the contractor before sharing the design documents because the documents are CUI and the contractor will possess them on behalf of the government.
- The contractor evaluating the machine gun must handle the machine gun and its design documents in accordance with ITAR export control regulations that apply universally.
- The contractor must also apply CUI safeguards to the design documents as per the terms of their CUI agreement with the government.
Even through the government and its evaluation contractor are treating the design documents as CUI at this point in the example, the designer’s copy of the design documents is not CUI, and the designer has no CUI-related obligation to safeguard or limit the dissemination of the design documents. This is because the designer did not create the design documents for the government and does not possess them on behalf of the government. The designer can share copies of the design documents with anyone they choose, as long as the recipient is a U.S. person because ITAR universally applies to the design documents.
Contracts and Other Agreements
Some government contracts and other agreements may require certain information to remain within the United States regardless of whether the information is CUI. A contractor must adhere to these requirements after agreeing to them.
Contractors must read all government contracts and other agreements carefully to understand their data residency obligations. This includes following references to any other contract clauses, regulations, laws, or government policies.
An example of such a requirement that would apply to CUI that is not otherwise export controlled is as follows:
- The DoD contract clause for safeguarding CUI at DFARS 252.204-7012(b)(1)(i) requires cloud services to meet the security requirements in DFARS 252.239-7010, the DoD contract clause for cloud computing services.
- DFARS 252.239-7010(b)(3) requires all government data to remain within the United States unless it is physically located on DoD premises or the contractor has received written notification from the Contracting Officer to use another location.
- Therefore, cloud providers that have agreed to a DFARS 252.204-7012 clause must maintain DoD CUI (government data) handled under that contract within the United States as per the terms of DFARS 252.239-7010(b)(3), even if that information does not carry CUI, EAR, or ITAR export control markings.
The CUI Export Controlled Category
The “Export Controlled” CUI category that uses the marking EXPT is a common source of confusion. As briefly described above, this marking indicates that the information is CUI because it is related to export controls, not that the information itself is export controlled. CUI marked EXPT is not export controlled unless it also carries any of the relevant Limited Dissemination Control markings, DoD Distribution Statements, or an EAR/ITAR marking as shown above.
The following example demonstrates how information that is not export controlled may be CUI in the Export Controlled category:
- ITAR requires organizations to apply for licenses to export or import certain defense articles.
- 22 CFR 120.21(b) (a regulation) requires the government to withhold ITAR license applications from public disclosure unless certain conditions are met (a dissemination control).
- The government must designate ITAR license applications it receives as CUI because the government possesses the information, and there is a regulation (22 CFR 120.21(b)) that requires the government to handle the information using dissemination controls (withholding ITAR license applications from public disclosure).
- The license application would be marked as CUI//SP-EXPT because this is the banner marking the CUI Registry lists for 22 CFR 120.21(b) in the CUI authorities of the Export Controlled CUI category.
- 22 CFR 120.21(b) does not impose any export controls on the license application; therefore, the CUI would not carry any export-related Limited Dissemination Control markings.
- EAR and ITAR also do not prohibit international distribution of license applications, so those export control markings would not be applied.
Should the government share the license application with any other organization (e.g., to generate statistics on international arms sales):
- The license application must be marked as CUI.
- The government should establish a CUI safeguarding agreement with the organization that will receive the license application.
- The receiving organization would be responsible for safeguarding the license application in accordance with the CUI agreement.
- The receiving organization is under no obligation to exclusively handle the license application in the United States or limit its dissemination to U.S. Persons.
Although the government and the organizations it shares the license with must treat the license application as CUI, this does not impose any CUI safeguarding or dissemination controls on the exporter that completed the license application. The applicant is free to handle their own copy of the license application however they want and share it with whomever they want. The designation of the license application as CUI is meant to protect the applicant from having their information leaked by the government or another organization that possesses it on behalf of the government, not to protect the applicant from itself.