In today’s digital world, information is not just valuable; it’s the lifeblood of organizations, including the government. However, not all information holds the same weight when it comes to its sensitivity. Some data demands special protections due to its sensitivity and potential impact if it lands in the wrong hands. This is where Controlled Unclassified Information (CUI) comes into play. Understanding what CUI is, what it isn’t, and the critical importance of protecting CUI is paramount for any entity required to handle such data.

“Sometimes working on a good definition of CUI for your organization based on the contracts you get and the data you receive and generate on contracts is a difficult set of steps to go through,” says Ryan Bonner of DEFCERT. “One of the biggest things you have to identify when it comes to CUI is if someone gives you a simplistic answer like, ‘just think of it all as CUI,’ that’s a short-term fix to a long-term problem.”

Ways to Identify Controlled Unclassified Information

CUI refers to unclassified information that requires safeguarding or dissemination controls, consistent with applicable laws, regulations, and government-wide policies. Identifying CUI amidst the vast sea of information can be challenging but not impossible. “The most helpful tool is going back to the federal definition of what CUI is,” says Bonner. “Most organizations have tried to learn about CUI through secondary resources like their DFARS 7012 clause. And very few organizations go back to the source, which is 32 CFR part 2002.”

Here are some key indicators to help you recognize CUI:

• Relevance to National Security: CUI often pertains to national security, law enforcement, privacy, proprietary business interests, and other sensitive areas critical to government operations or vital to the interests of the United States Government.
  
• Government Designation: CUI may be designated as such by federal agencies or departments based on its nature and potential impact if disclosed improperly. Look for markings such as “Controlled Unclassified Information” or agency-specific designations like “For Official Use Only (FOUO)” or “Law Enforcement Sensitive (LES).” Other examples would be Personally Identifiable Information (PII), Sensitive Personally Identifiable Information (SPII), Proprietary Business Information (PBI), Unclassified Controlled Technical Information (UCTI), and Sensitive but Unclassified (SBU). (More on each of these below.)
  
• Handling Properly: Documents and information containing CUI typically come with specific handling instructions outlining who can access the information, how it should be stored, transmitted, and destroyed, and any other relevant security protocols. A specific set of non-prescribed security controls were developed by the National Institute of Standards and Technology (NIST) in Special Publication (SP) 800-171.
  
• Non-Public Nature: CUI is not intended for public release and is often shared only with authorized individuals or entities on a need-to-know basis. If information seems restricted or not meant for public consumption, it might fall under the category of CUI.
  
• Sensitive Data Elements: Certain data elements within documents or datasets, such as personally identifiable information (PII), financial records, or critical infrastructure details, are frequently classified as CUI due to their sensitive nature and the potential threat they bring to the United States if exposed to our adversaries.

Types of Controlled Unclassified Information

CUI encompasses a wide range of information types, each requiring protection based on its unique characteristics and associated risks. Here are some common types of CUI:

• Legal and Regulatory Information: This includes laws, regulations, and directives that govern specific industries or activities. Examples include export control regulations, intellectual property laws, and environmental protection statutes.
  
• Privacy Information: CUI often includes personally identifiable information (PII), such as names, Social Security numbers, and medical records, which, if compromised, can lead to identity theft, fraud, or other privacy violations.
  
• Financial Information: Data related to budgets, contracts, grants, and financial transactions falls under CUI, as unauthorized access or disclosure could result in financial loss, fraud, or damage to the integrity of financial systems.
  
• Security Information: This category covers sensitive information related to national security, law enforcement, homeland security, and cybersecurity. Examples include threat assessments, intelligence reports, and classified security protocols.
  
• Proprietary Business Information: CUI often includes trade secrets, proprietary algorithms, manufacturing processes, and other intellectual property critical to the competitiveness and success of businesses. Unauthorized disclosure can harm a company’s market position and profitability.

Protecting CUI in 10 Steps

Government contractors play a crucial role in handling CUI, as they often have access to sensitive data during their work. To ensure the protection of CUI, government contractors must adhere to stringent security requirements and protocols mandated by federal regulations and contractual agreements. Here’s what government contractors must do when protecting CUI:

• 1. Understand Regulatory Requirements: Government contractors must familiarize themselves with relevant laws, regulations, and contractual obligations governing the protection of CUI. Key regulations include the Controlled Unclassified Information (CUI) program established by the National Archives and Records Administration (NARA) and agency-specific requirements.

• 2. Implement Security Controls: Contractors must implement (appropriately) the required security controls to safeguard CUI against unauthorized access, disclosure, alteration, or destruction. This includes physical security measures, such as access controls and secure storage facilities, as well as technical safeguards, such as encryption, access controls, monitoring systems and more.
  
• 3. Comply with Security Standards: Contractors must adhere to established security standards and best practices, such as those outlined in the NIST SP 800-171, which provides guidelines for protecting Controlled Unclassified Information in non-federal systems and organizations.
  
• 4. Develop Security Plans and Policies: Contractors handling CUI are required to develop comprehensive security plans and policies tailored to their specific operations and the types of CUI they handle. These plans should outline procedures for handling, storing, transmitting, and disposing of CUI in accordance with applicable regulations and contractual requirements.
  
• 5. Train Personnel: Contractors must provide security awareness training to employees and subcontractors who handle CUI to ensure they understand their responsibilities and the importance of protecting sensitive information. Training should cover topics such as handling procedures, security protocols, incident reporting, and the consequences of non-compliance.
  
• 6. Control Access to Information: Contractors should implement robust access controls to restrict access to CUI only to authorized individuals with a need-to-know. This may involve using role-based access controls, user authentication mechanisms, and monitoring access logs to detect and prevent unauthorized access attempts.
  
• 7. Monitor and Audit Systems: Contractors should regularly monitor and audit their systems and networks to detect security incidents, unauthorized access attempts, or other suspicious activities. This may involve deploying intrusion detection systems, logging and analyzing security events, and conducting periodic security assessments.
  
• 8. Report Security Incidents: Contractors must promptly report any security incidents or breaches involving CUI to the appropriate authorities, such as the contracting agency or the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Timely reporting is essential for mitigating the impact of security incidents and preventing further harm.
  
• 9. Maintain Compliance Documentation: Contractors should maintain accurate and up-to-date documentation demonstrating compliance with security requirements, including security plans, policies, procedures, training records, and audit reports. This documentation may be subject to review by government auditors or contracting officers.
  
• 10. Cooperate with Government Oversight: Contractors must cooperate with government oversight activities, such as audits, inspections, or investigations, to verify compliance with security requirements and address any identified deficiencies or vulnerabilities.

Learning how to protect CUI is of utmost importance for safeguarding our national security, preserving individual privacy, keeping our competitive advantage in our defense systems, ensuring public safety, and maintaining trust in government and private institutions. By following the above steps and prioritizing the protection of CUI, government contractors can fulfill their contractual obligations, mitigate security risks, and contribute to the overall security posture. By doing so, organizations will find the path to meeting cybersecurity and information security requirements easier to accomplish.

---