CUI
Controlled Unclassified Information (CUI) refers to sensitive information that, while not classified, requires safeguarding or dissemination controls in accordance with laws, regulations, or government-wide policies. The CUI program was established by Executive Order 13556 in 2010 to standardize the way the federal government and its contractors handle this type of information, reducing inconsistencies and improving information security across agencies.
Key Aspects of CUI
Definition:
CUI encompasses information that is sensitive but not classified. This includes data such as personally identifiable information (PII), intellectual property, legal documents, proprietary business information, and anything that could potentially harm national or economic security if improperly handled.
Examples of CUI:
- Health Information (e.g., HIPAA-protected data)
- Financial Information
- Export Control Information (e.g., subject to ITAR or EAR regulations)
- Critical Infrastructure Information
- Proprietary Business Information (e.g., trade secrets)
- Defense Information that does not qualify as classified (e.g., design specs or performance data for defense systems).
Categories of CUI:
CUI is categorized into two main types -
CUI Basic: Information that requires protection but is governed by relatively standard rules and procedures. Safeguarding is generally based on NIST SP 800-171 standards.
CUI Specified: Information that has stricter safeguarding or dissemination controls due to specific laws or regulations (e.g., Export Control laws like ITAR).
CUI vs. Classified Information: CUI is different from classified information (Confidential, Secret, Top Secret), which is subject to much higher levels of protection. However, CUI must still be handled carefully to prevent unauthorized access, modification, or destruction.
Safeguarding CUI
Organizations that handle CUI must comply with specific security requirements, particularly those outlined in NIST SP 800-171 Rev 2.
The CUI Program
The National Archives and Records Administration (NARA) is responsible for overseeing the CUI program. NARA provides guidance, establishes categories and markings for CUI, and ensures that agencies follow consistent procedures for safeguarding information.
1. CUI Registry: NARA maintains a CUI Registry, which outlines all categories and subcategories of CUI, along with the associated authorities (laws, regulations, or government policies) that require safeguarding.
2. Marking CUI: CUI must be marked appropriately to signal that it requires protection. The marking typically includes the designation "CUI" at the top and bottom of each page containing such information, along with any specific category (e.g., CUI//SP-PROPRIETARY for proprietary business information).
3. Handling and Sharing: CUI may only be shared with authorized individuals who have a "lawful government purpose" for accessing it. The dissemination of CUI must follow the specific rules for each category and include measures to protect it during transit (e.g., encryption, password protection).
CUI in Government Contracts
Many federal contracts, particularly with the Department of Defense (DoD) and other security-sensitive agencies, involve handling CUI. Contractors working with the DoD are often required to comply with DFARS 252.204-7012 and NIST SP 800-171 Rev 2 to safeguard CUI.
Under the Cybersecurity Maturity Model Certification (CMMC) framework, defense contractors handling CUI must obtain a CMMC Level 2 certification (or higher, depending on contract requirements), ensuring that they have implemented the necessary security controls to protect CUI.
Importance of CUI Compliance
Failing to properly safeguard CUI can lead to serious consequences, such as:
- Breaches of sensitive information
- National security risks
- Legal penalties or loss of contracts
For organizations that handle CUI, ensuring compliance with all applicable laws and standards is critical to maintaining trust with the federal government and avoiding the potential fallout from cybersecurity incidents.