Controlled Unclassified Information (CUI)

CUI was defined in Executive Order 13556 [PDF] as information held by or generated for the Federal Government that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations and government-wide policies that isn’t classified under Executive Order 13526 or the Atomic Energy Act, as amended. 

A few important points about CUI:

• Research data and other project information that a research team receives, possesses, or creates during the performance of federally funded research may be CUI.
• The obligation to determine whether or not an award will involve CUI belongs to the federal sponsor; award documents should specifically identify CUI and applicable security requirements. 
• CUI safeguarding requirements are only applicable to Drexel University and Drexel’s information systems when mandated by a federal agency in a contract, grant, or other agreement.
• The security requirements apply to the components of nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components.
• DoD has a Mandatory Controlled Unclassified Information (CUI) Training and participants will receive a certificate after passing the exam with a 70% or better score.

The CUI Registry is the online repository for all information, guidance, policy, and requirements on handling CUI, including everything issued by the CUI Executive Agent other than 32 CFR Part 2002. Among other information, the CUI Registry identifies all approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, establishes markings, and includes guidance on handling procedures.

CUI Basic vs CUI Specified

CUI Basic

The subset of CUI for which the authorizing law, regulation, or Government-wide policy does not set out specific handling or dissemination controls. Agencies handle CUI Basic according to the uniform set of controls set forth in this part and the CUI Registry. CUI Basic differs from CUI Specified (see definition for CUI Specified), and CUI Basic controls apply whenever CUI Specified ones do not cover the involved CUI.

CUI Specified

The subset of CUI in which the authorizing law, regulation, or Government-wide policy contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic. The CUI Registry indicates which laws, regulations, and Government-wide policies include such specific requirements. CUI Specified controls may be more stringent than, or may simply differ from, those required by CUI Basic; the distinction is that the underlying authority spells out the controls for CUI Specified information and does not for CUI Basic information. CUI Basic controls apply to those aspects of CUI Specified where the authorizing laws, regulations, and Government-wide policies do not provide specific guidance.

What is NOT controlled unclassified information?

When reviewing the CUI Registry it's easy to start thinking that everything is CUI but that's not true. It's important to remember that the definition of CUI limits the scope to certain categories of federal information, essentially government information requiring safeguarding pursuant to government requirements.

Research data is only likely to be CUI if 1) it is provided to you by the U.S. government (or another party on their behalf); or 2) it is developed by you during the performance of U.S. government sponsored research; and the contract or agreement specifies that the information is CUI. The following are illustrative examples of information that is not CUI:

• Proprietary research that is not funded by the federal government is not CUI. This is true even when the background information provided by the sponsor and/or your research results are proprietary technical information subject to the US export control regulations.
• Medical information and/or human subjects data subject to privacy protections (e.g., HIPAA or as part of informed consent representations) are not CUI.
  • Exception: Such data may be CUI when provided by the U.S. government, e.g., medical information about federal employees, to the University for use in research.
• Student information subject to privacy protections (e.g., FERPA) is not CUI.
  • Exception: Such data may be CUI when collected by the U.S. government, e.g., certain financial information provided by students and/or parents in federal financial aid applications, which is then passed to the University for use in financial aid administration.
• Information that is already in the public domain (e.g., published), including publicly available U.S. government data sets.
• Non-contextualized research data (e.g., raw output collected for a CUI project that must be correlated with additional input from a person, application or second data source in scope of the CUI research project to have meaning or context) will generally not be considered CUI unless it bears identifying marks linking it to specific CUI project.
  • Note: Researchers are advised to discuss the possibility for designating certain output as "non-contextualized research data" with Drexel University Export Controls when developing the technology control plan for the CUI project for which it will be collected.

It may be prudent to handle controlled information (e.g., export controlled, HIPAA, or FERPA data) that is not CUI with the same safeguarding standards but this information should not be marked as CUI.

Safeguarding CUI Basic

32 CFR 2002.14 details the safeguarding requirements for CUI. In general, authorized holders must take reasonable precautions to guard against unauthorized disclosure of CUI which must include the following measures:

1. Establish controlled environments in which to protect CUI from unauthorized access or disclosure and make use of those controlled environments;
2. Reasonably ensure that unauthorized individuals cannot access or observe CUI, or overhear conversations discussing CUI;
3. Keep CUI under the authorized holder's direct control or protect it with at least one physical barrier, and reasonably ensure that the authorized holder or the physical barrier protects the CUI from unauthorized access or observation when outside a controlled environment; and
4. Protect the confidentiality of CUI that agencies or authorized holders process, store, or transmit on in accordance with the applicable security requirements and controls.

The regulations identify two types of information systems that process, store, or transmit CUI and specifies different safeguarding standards for each.

• Federal information Systems are information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. An information system operated on behalf of an agency provides information processing services to the agency that the Government might otherwise perform itself but has decided to outsource.
  • Safeguarding: In accordance with the applicable security requirements and controls established in FIPS PUB 199, FIPS PUB 200, and NIST SP 800-53, and paragraph (g) of 32 CFR 2002.14.
• Non-Federal Information Systems are information systems that do not meet the criteria for a Federal information system. Agencies may not treat non-Federal information systems as though they are agency systems, so agencies cannot require that non-executive branch entities protect these systems in the same manner that the agencies might protect their own information systems.
  • Safeguarding: NIST SP 800-171. Note: 32 CFR 2002.14(h)(2) requires that agencies must use NIST SP 800-171 unless CUI Specified or an agreement establishes requirements to protect CUI Basic at higher than moderate confidentiality.

Drexel information systems are not Federal Information Systems and do not meet the referenced requirements.

Protecting CUI in Nonfederal Systems and Organizations (NIST SP 800-171)

The CUI Program is implemented through 32 CFR 2002 Controlled Unclassified Information which specifies National Institute of Standards and Technology (NIST) Special Publications (SP) 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171) for safeguarding requirements applicable to non-federal information systems that store, process, or transmit CUI.

NIST SP 800-171 identifies 110 unique requirements that apply to University information systems that process, store, or transmit CUI. The requirements are organized into the following 14 families: access control (22 controls); awareness and training (3 controls); audit and accountability (9 controls); configuration management (9 controls); identification and authentication (11 controls); incident response (3 controls); maintenance (6 controls); media protection (9 controls); personnel security (2 controls); physical security (6 controls); risk assessment (3 controls); security assessment (4 controls); system and communications protection (16 controls); and system and information integrity (7 controls).

Due to the nature of the controls, it is unlikely that locally managed (i.e., lab, department or school) systems will be able to fully comply, at least not without significant cost, effort and time for implementation. Before considering developing a one-off solution, researchers should carefully consider NIST SP 800-171 and NIST SP 800-171A Assessing Security Requirements for CUI. Additional considerations are necessary for DoD funded programs

Are covered defense information (CDI) and controlled technical information (CTI) the same as CUI?

The Department of Defense (DoD) is the only agency that uses the terms covered defense information (CDI) and controlled technical information (CTI) which it defines in Defense Federal Acquisition Regulations Supplement (DFARS) 252.204-7012. However, in order to understand scope of control, you also need to understand how DoD uses the term covered contractor information system, also defined in DFARS 252.204-7012.

• Controlled Technical Information (CTI) means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.
• Covered Contractor Information System means an unclassified information system that is owned, or operated by or for, a contractor and that processes, stores, or transmits CDI.
• Covered Defense Information (CDI) means unclassified CTI or other information, as described in the CUI Registry, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—
  • Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or
  • Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

Essentially, CTI is a specific category of CUI (listed on the CUI Registry as part of the Defense organizational index grouping) while CDI is a DoD term that encompasses all categories of CUI plus any other information DoD has not approved for public release. DFARS 252.204-7012 is the DoD contract clause that requires covered contractor information systems be subject to the security requirements in NIST SP 800-171, the same standards that apply to CUI Basic; however, it also includes DoD-specific cyber incident reporting requirements.

DoD funded research involving CDI must include DFARS 252.204-7012 and will almost certainly include DFARS 252.204-7000 which requires DoD prior approval for any publication or other public release.

On 9/29/20, DoD released an interim rule in the Federal Register to amend the DFARS, in part, to add 252.204-7019 (notice) and 252.204-7020 (contracts) which specify NIST SP 800-171 assessment requirements for DoD contracts involving CDI; these clauses became effective 11/30/20. Specifically, a recent assessment (< 3 years old) at the level required by the contract must be on file in the Supplier Performance Risk System (SPRS) for the covered contractor information system before the contracting officer can issue the award the contract. Contracts will be assigned one of three levels of assessment are identified: Basic (self-assessment), Medium (DoD review) and High (DoD review and inspection). The requirement applies to the prime and all subcontractors whose work will involve CDI.

• Note 1: These new clauses do not apply to previously issued contracts unless added through a contract modification.
  
• Note 2: In the same Federal Register Notice adding DFARS 252.204-7019 and 252.204-7020, DoD released DFARS 252.204-7021 which implements the requirements of the new safeguarding program DoD will roll out in phases through 10/1/2025. This new program is the Cybersecurity Maturity Model Certification (CMMC) program, which is discussed as a separate topic on this page.

Cybersecurity Maturity Model Certification (CMMC) Program

What is the CMMC Program?

The Department of Defense (DoD) developed the CMMC Model as a unifying standard for the implementation of cybersecurity across the Defense Industrial Base (DIB). The CMMC framework includes a comprehensive and scalable third-party certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. CMMC is designed to provide increased assurance to the DoD that a DIB company or institution can adequately protect sensitive unclassified information, accounting for information flow down to subcontractors in a multi-tier supply chain.

The CMMC 2.0 model has three levels (1-3) with Level 1 containing the minimum safeguarding requirements for DoD contracts, including those for fundamental research. The model is cumulative whereby each level builds on the practices and processes of the lower levels. The updated model aligns more with NIST SP 800-171 and NIST SP 800-172 requirements.

The CMMC Model is currently in the rulemaking process. During this time, the DoD intends to suspend the CMMC pilot and not include CMMC requirements in any DoD solicitations. Once the rulemaking process concludes, CMMC requirements will go into effect . Additional Information can be found at the Acquisition & Sustainment Departments website.

What CMMC Level is required for CDI/CUI?

CMMC Level 2 will be the base requirement for contracts involving CDI/CUI but a higher level may be required, i.e. to address advanced persistent threats. CMMC Level 2 consists of the 110 requirements specified in NIST SP 800-171. Drexel plans to obtain a Level 2 Certification.

How will I know what CMMC Level is required?

In November 2020, DoD issued a new DFARS clause implementing CMMC requirements to support the issuance of the acquisition activities piloting the CMMC Model. As part of the same Federal Register Notice, DoD issued new DFARS clauses to support an interim cybersecurity program that will remain in place until the CMMC Model is fully implemented. The new DFARS clauses and brief descriptions are provided below:

• DFARS 252.204-7019 Notice of NIST SP 800-171 DoD Assessment Requirements. This is a notice clause for use in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial items, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items.
  • It states that in order to be considered for an award, if the Offeror is required to implement NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology.
• DFARS 252.204-7020 NIST SP 800-171 DoD Assessment Requirements. This is the clause that will be used in contracts involving CDI to implement the Basic, Medium, and High assessment requirements.
  • These are the same requirements listed in DFARS 252.204-7019 but expanded descriptions are provided for the processes around the conduct and reporting of Medium and High assessments by DoD.
• DFARS 252.204-7021 Cybersecurity Maturity Model Certification Requirements. This is the clause that will be used in the phased rollout of the CMMC Model requirements.
  • This requires that the Contractor have a current (i.e. not older than 3 years) CMMC certificate at the CMMC level required by this contract and maintain the CMMC certificate at the required level for the duration of the contract.

Given the CMMC Level descriptions, we expect Level 1-3 requirements to be applied to research contracts issued to Drexel University. However, based on the risk-based phased rollout approach being taken by DoD we do not anticipate receiving contracts containing DFARS 252.204-7021 routinely.

Will Drexel Information Systems meet CMMC Requirements?

Drexel Plans to obtain a level 2 certification

Additional Information

More information about the Cybersecurity Maturity Model Certification (CMMC) program and implementation is available on the CMMC Accreditation Board (training and accreditation of assessors; and marketplace for CMMC service providers) and the OUSD (A&S) CMMC (CMMC model, assessment guides and FAQs) websites. The assessment guides on the OUSD(A&S) website are what will ultimately be used by the accredited third-party assessors to perform the certification assessments; CMMC Levels 1 and 3 assessment guides are currently available.

More information on Drexel University’s Information Security's CMMC webpage