What is CUI? A Contractor’s Perspective

As a Cybersecurity Maturity Model Certification (CMMC) Registered Practitioner (RP), I frequently encounter government contractors subject to compliance requirements related to Controlled Unclassified Information (CUI), including CMMC, who do not understand what CUI is. This post is an attempt to help contractors understand exactly what CUI is and isn’t, when contractors should and should not apply CUI markings to documents, and how to handle CUI.

Anyone interested in a deeper dive into the history, structure, and requirements of the CUI program should take a look at our previous post Government Contractor’s Ultimate Guide to CUI.

TrustedSec is a CMMC RPO with years of experience helping federal contractors implement and assess compliance related to the handling of CUI in accordance with the NIST SP 800-171 requirements under DFARS 252.204-7012 and other contract clauses that predate the CMMC program. If you'd like assistance with compliance, get in touch with us!

What is CUI

The official definition of CUI at 32 CFR 2002.4(h) is very dense and is written primarily for internal government use. To simplify the concept of CUI as much as possible, from a contractor’s perspective, CUI is either of the following:

• Information the contractor receives directly or indirectly from the U.S. government (e.g., via another contractor) that was marked as CUI by the government
• Information the contractor creates for the U.S. government that the government instructs the contractor to apply specific CUI markings to

Any CUI documents, including email, that a contractor receives from the government should be very obvious because government agencies are required to mark all CUI before disseminating it. The markings are standardized as per 32 CFR 2002.20 and the NARA CUI Marking Handbook, so all CUI should include at least the following before a contractor receives it:

• A banner at the top of each page that says either “CUI” or “CONTROLLED”
• The name of the agency that designated the information as CUI (agency letterhead is acceptable for this purpose)

Documents containing CUI may also have a purple CUI coversheet, but this is optional.

Deciding what information is CUI and determining the appropriate CUI markings is inherently a government function (more on that below). Contractors should not try to mark any unmarked information they receive or create unless specifically instructed to do so by the government. The government will specify the exact markings to be applied to the document in these cases.

The only other circumstance when a contractor should mark documents as CUI is when the contractor copies information from CUI-marked documents into new documents.

What is Not CUI

Classified Information

Classified information (i.e., information marked Confidential, Secret, or Top Secret) is not CUI and is subject to a separate set of safeguarding requirements. This is explicitly stated in the CUI definition.

Contractors should avoid the habit of saying information is “classified as CUI” to avoid confusion with actual classified information. It is more accurate and less confusing to say information is “designated as CUI”.

Information Export Controlled Under EAR and/or ITAR

Information that carries Export Administration Regulations (EAR) or International Traffic in Arms Regulations (ITAR) export control markings is not automatically CUI. EAR, ITAR, and the CUI program are all separate regulations that only partially overlap. EAR and ITAR export-controlled information is only CUI if it also meets the definition of CUI.

If information is controlled under the CUI program and export controlled under EAR or ITAR, the information will carry both CUI markings and the appropriate EAR or ITAR export control markings. Contractors must handle information in accordance with all applicable requirements based on the applied markings.

Unmarked Information

For the most part, any unmarked information a contractor receives is not CUI because government agencies are required to mark all CUI before disseminating it as per 32 CFR 2002.16(a)(3). Individual agencies also have internal procedures for marking CUI before it is sent to contractors, e.g., Department of Defense Instruction 5200.48 §5.8(a).

A contractor that reasonably suspects it received an unmarked or incorrectly marked CUI document should report the document directly to the contracting officer for the relevant contract (this may be a requirement of some CUI handling agreements or contracts). See our previous post on Dealing With Unmarked and Mismarked CUI for more information on this topic.

All Information Handled Under a Contract

Some contractors seem to believe that all information they receive from or create for the government under a contract is CUI despite the lack of CUI markings or marking instructions. This is impossible because the definition of CUI states that information can only be CUI if there is a law, regulation, or government-wide policy requiring government agencies to safeguard or control the dissemination of that information. Most information contractors receive and create under a contract is not subject to any such laws, regulations, or government-wide policies, so it cannot be CUI.

Instead, most of the information received from or created for the government under a contract that is not intended for public release is actually Federal Contract Information (FCI). The safeguarding requirements for FCI are much simpler than for CUI, so this is an important distinction. There are 15 safeguarding requirements for FCI vs. 110-200 safeguarding requirements for CUI depending on which revision of NIST SP 800-171 is used and how much, if any, of NIST SP 800-172 is applicable.

Non-Government Information

Information a contractor receives or creates outside of a government contract or similar agreement is not CUI, at least from the perspective of the contractor. This is explicitly stated in the CUI definition: “CUI does not include […] information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency”.

This means a contractor may freely use its own pre-existing proprietary information and information it receives from any non-governmental source in support of a government contract without treating that information as CUI.

When Contractor Information Becomes CUI

An area that often confuses contractors is that information may be CUI from the perspective of the government without being CUI from the perspective of the contractor. A deeper dive into the definition of CUI at 32 CFR 2002.4(h) is necessary to understand this concept.

The definition of CUI states that information can only be CUI if:

• Either:
  • The government creates or possesses the information
    OR
  • An entity creates or possesses the information for or on behalf of the government
  AND
• A federal agency is required to safeguard or control the dissemination of that information as per a law, regulation, or government-wide policy

From the perspective of the contractor, any information the contractor did not create for and does not possess on behalf of the government (e.g., a contractor’s proprietary technical designs, part numbers, pricing information, or sales numbers) cannot be CUI because it does not satisfy possession portions of the CUI definition.

This gets interesting when a contractor sends such information to the government:

• The first point of the CUI definition is met because the government now possesses the information.
• If any laws, regulations, or government-wide policies apply to the information that the government has received from the contractor (of which there are many that apply to government handling of sensitive information from contractors), then the second point of the CUI definition is also met, and the government must designate the information as CUI.

The fact that the government has designated the information it received from a contractor as CUI changes nothing for the contractor that sent the information to the government. The contractor did not create the information for the government and does not possess it on behalf of the government, so from the contractor’s perspective, the first part of the CUI definition is not met, and the information is not CUI. The contractor remains free to handle and distribute its proprietary information however it chooses despite the government agency that received the information designating the information as CUI and handling it in accordance with the applicable laws, regulations, and policies.

When to Mark CUI

As mentioned above, designating and marking CUI is primarily a government function performed when the government receives, creates, or disseminates information that the government is required to protect under specific laws, regulations, or government-wide policies.

There are only two (2) scenarios when contractors should mark information as CUI:

• The contractor copies information from an existing CUI document to a new document.
• The contractor creates information for the government under a contract or other agreement, and the government provides explicit instructions to mark the information as part of that contract or agreement.

Copying CUI

CUI designations and markings follow the information in the document, even when that information is moved to a new document.

If a contractor is lucky, the source document will be portion marked. These markings indicate which portions of a document are CUI (potentially including what categories the CUI falls into) and which portions of the document are uncontrolled. Only the markings associated with the copied information must be applied to new documents when copying from portion-marked documents. Portions marked (U) are Uncontrolled and do not contain CUI. No marking is required when copying Uncontrolled information, although it may still require safeguarding as FCI.

If portion markings are absent, all CUI markings from the source document(s) must be applied to the destination document. This can be frustrating when a contractor strongly suspects the part of the document they are copying does not contain CUI. In this case, the contractor can reach out to the government contracting officer for a determination as to whether the information is CUI. This must be done on a case-by-case basis, which can cause its own frustration.

A smart contractor will portion mark the documents CUI is being copied into, as per the NARA CUI Marking Handbook, to keep track of what information in the document is and is not CUI. This will help prevent the spread of unnecessary CUI markings throughout the contractor’s documents.

Creating CUI

Documentation in or with the contract or other agreement should specify the information that must be marked as CUI and the exact CUI markings that must be applied to that information.

Most agencies are still rolling out CUI programs and may not yet require contractors to mark information that meets the CUI definition. Contractors may want to reach out to their contracting officer to determine if there are any marking expectations.

The Department of Defense (DoD) has the most mature CUI program of the government agencies and communicates CUI marking requirements to contractors via form DD 1423, also known as a Contract Data Requirements List (CDRL). A CDRL is included in solicitation packages whenever data is a contract deliverable. Not all data deliverables will contain CUI, so not all CDRLs will include CUI marking instructions.

The example CDRL below is from a solicitation for an Autonomous Intelligence System Platform Integration, retrieved from sam.gov. This CDRL is specifically for the system engineering drawings deliverable of that contract, as indicated in blocks 2 and 3 of the form. The text shown in the red box instructs the contractor to apply CUI markings and the specified limited dissemination control text to this deliverable. DoDI 5200.48, referenced in the CDRL, contains more specific CUI marking instructions that contractors must follow when marking this deliverable.

When Not to Mark CUI

Marking All Information Created Under a Contract

Some contractors are under the impression that all information they create under a contract is CUI and attempt to mark it. This often results in CUI markings that are wildly inconsistent with official marking standards.

While the information created under a contract is almost certainly FCI (unless it is intended for public release), it is likely not CUI unless the government has provided explicit marking instructions as described above. Contractors that attempt to mark documents without government instructions will encounter a few issues that result in incorrect markings:

• CUI documents are required to indicate which government agency designated the information as CUI (32 CFR 2002.20(d)).
  • A contractor is not a government agency and does not have the authority to independently designate information as CUI.
• Some CUI documents are required to carry CUI category markings (32 CFR 2002.20(b)(2)) and/or Limited Dissemination Control markings (32 CFR 2002.20(b)(3)).
  • The applicable markings are determined based on which laws, regulations, and government-wide policies apply to the government agency's handling of this information.
  • Contractors are not experts on the laws, regulations, and policies that apply to government agency handling of information and will often omit the required markings, select incorrect markings, or make up markings that deviate from the NARA standard categories when attempting to mark CUI independently.

A contractor must not attempt to mark documents it creates as CUI without explicit instructions to apply specific markings from an agency, e.g., the instructions shown in the example CDRL above.

Marking Proprietary Information

Some contractors believe that they must mark their own proprietary information as CUI before sharing it with subcontractors or other organizations. This has resulted in some CUI markings that are wildly inconsistent with the NARA marking standards (for all of the reasons described above).

Remember, a contractor’s proprietary information cannot be CUI unless it has passed through government hands:

• If I create proprietary information, send it to the government, and the government sends it to you: The government must designate the information as CUI on my behalf, and you must safeguard the CUI you received on the government’s behalf.
• If I create proprietary information and send it directly to you: You didn’t receive the information from the government; therefore, it cannot be CUI, and you have no obligation to safeguard it on the government’s behalf under the CUI program.

Proprietary information shared directly between private organizations should be subject to a non-disclosure agreement because the CUI program offers no protections in this scenario, even if a misguided contractor applies their own made-up CUI markings.

Some of this confusion may stem from a line in DFARS 252.204-7012 (the standard contract clause that requires defense contractors to safeguard CUI): Paragraph (h) asks contractors to mark attributional/proprietary information before sending it to the government. The intent is for the contractor to flag proprietary information so the government knows to safeguard the information as per the rest of paragraph (h) (i.e., the information will become CUI once the government receives it). This does not create an obligation for the contractor to do any of the following with regard to their own copies of the proprietary information submitted to the government:

• Mark the information as CUI
• Safeguard the information as CUI
• Pass CUI safeguarding requirements on to any private organizations they directly share the information with

Handling CUI

The CUI program is unlike EAR, ITAR, HIPAA, and a variety of other laws and regulations in that the CUI regulations do not automatically apply directly to anyone outside the federal government. The government is supposed to impose CUI safeguarding requirements on contractors and other organizations outside the government by imposing into CUI handling agreements before sharing CUI.

A contractor is only required to handle CUI in accordance with the agreement under which that specific CUI document was received. A contractor that receives CUI outside an agreement has no safeguarding obligations regarding that CUI.

CUI handling agreements are supposed to require contractors to use the requirements from NIST SP 800-171 to safeguard CUI in the contractor’s systems. In reality, agreements come in many different forms and don’t necessarily impose NIST SP 800-171 requirements.

Contractors must remember that there is no one-size-fits-all approach to handling CUI due to the variation in requirements between different CUI handling agreements and the potential for agencies to change their agreements over time. Contractors must keep track of which agreement each instance of CUI is associated with so it can be handled appropriately. Contractors may need to set up separate systems to meet the CUI safeguarding requirements of different agencies or pre-contract vs. post-contract CUI safeguarding requirements.

Some examples:

• The DoD has long required contractors to use NIST SP 800-171 revision 2 to safeguard CUI but is currently rolling out the CMMC program that changes the scope of how NIST SP 800-171 applies to the contractor’s environment and introduces independent third-party audits.
• The Government Services Administration also requires contractors to use NIST SP 800-171 to safeguard CUI but recently transitioned to NIST SP 800-171 revision 3 (which is wildly different from revision 2 as required by the DoD).
• The Department of Homeland Security CUI contract clause does not reference NIST SP 800-171 and instead refers contractors to a patchwork of internal policies and procedures for handling CUI and other information.
• Pre-contract agreements tend to impose vague requirements to safeguard CUI and limit dissemination of CUI to parties with a need-to-know. Our other post on Handing Pre-Contract FCI and CUI contains examples and has more detail on how to handle CUI before a contract is signed.

Another complication is that many contractors do not understand the CUI program and have been imposing their own supposed CUI handling requirements that have little to no basis in the official government requirements on their subcontractors. See our previous post on The Proliferation of “Fake” CMMC Contract Clauses for more on this topic.

CUI handling requirements can be complex. TrustedSec has years of experience working with both contractors and federal agencies to protect CUI using NIST SP 800-171, NIST SP 800-53, FedRAMP, and various other contractual requirements. We are available to help make sense of these programs and minimize the impact of compliance—get in touch with us!