- Chapter 1 | What is CUI?
- Controlled Unclassified Information (CUI) is an information security activity for which every individual in the Defense IndustrialBase (DIB) is potentially responsible, depending upon the contract language. It includes recognizing, marking, and protecting sensitive information in an unrestricted environment. By contrast, “classification” (Confidential, Secret,or Top Secret) is an information security activity accessible only by and for specifically authorized individuals within a highly restricted environment.
Categorizing data as CUI is intended to ensure it is protected to an extent that avoids giving away insight to U.S. adversaries while facilitating a reasonable operational tempo for activities that depend on that information. Protecting data that does not rise to the level of classification ensures barriers and costs for adversaries attempting to aggregate data as it is being shared across distributed, low-security, and non-Federal environments.
A single incident of CUI disclosure would usually be considered a low-risk or trivial security event, but the risk increases when CUI remains consistently unprotected, hence openly and freely available to adversaries. This is based on a theory of aggregation which asserts that multiple pieces of trivial data can be assembled into a single picture that gives adversaries insight into capabilities, activity, and strategy.
“Giving away” information that should be protected - including the results of research that may have been costly to attain - offers advantages to adversaries at the expense of the U.S. CUI designation allows information-sharing at a reasonable pace at the same time it creates barriers and expense for adversaries attempting to exploit the information domain.
- Policy Sources
-
32 CFR Part 2002 -- Controlled Unclassified Information (CUI)
-
DoDI 5200.48 Controlled Unclassified Information (CUI)
|
|
|
- Chapter 3 | Getting Support from Designated Authorities
- As individuals, security professionals have portable rights and responsibilities for handling CUI in a compliant manner. The points of contact below can offer authoritative insight.
- Designated Authorities
- DCSA CUI Program Office
CUI support for industry directly from DCSA is available at: (571) 305-4878 and dcsa.quantico.ctp.mbx.eso-cui@mail.mil. DCSA also provides an "engagement guide" outlining how to gain insight into CUI requirements for a contract. Link to guide: CUI Customer Engagement Guide
- DoD Component / Agency CUI Contact:
This contact is the designated agency CUI-lead by DoD. They can provide general guidance on CUI determinations, help navigate the agency-to identify the appropriate approved CUI templates for each contract, and address general questions regarding CUI implementation (training, applicability, etc.)
- Facility Security Officer (FSO)
Informing your employer FSO is a practical first-step in the event he or she did not administer CUI training (usually during onboarding), but you come into direct contact with CUI on a contract.
- Contract Officer’s Representative (COR)
Per DoD, the COR is responsible for addressing CUI handling required by contract language, providing a copy of the DD Form 254 if appropriate, and reviewing specific CUI categories indicated by the contract language.
|
