EN PT-BR
← Voltar ao feed
low government contractors defense

TrustedSec guidance clarifies when contractor information is CUI, when to mark it, and how it differs from FCI

1 fonte(s) · 1 atualização(ões) · publicado 27/10/2026 01:00 · coletado há 5 dias

This TrustedSec blog post by Chris Camejo, a CMMC Registered Practitioner, explains Controlled Unclassified Information (CUI) from a US government contractor's perspective. It is compliance guidance, not an incident or threat report. From a contractor's view, CUI is information received from the government that the government marked as CUI, or information created for the government where the government instructs the contractor to apply specific CUI markings. Unmarked information is generally not CUI. Most contract information is Federal Contract Information (FCI), which carries far lighter safeguarding requirements. The post also warns against contractors inventing their own CUI markings or handling requirements.

Detalhes técnicos

  • The definition at 32 CFR 2002.4(h) requires government creation or possession (or an entity acting for the government) and a law, regulation or government-wide policy requiring safeguarding.
  • Valid CUI carries a "CUI" or "CONTROLLED" banner and the designating agency name. A purple coversheet is optional.
  • Classified information, and EAR/ITAR export-controlled information, is not automatically CUI. Export-controlled data is CUI only if it also meets the CUI definition.
  • Contractors should mark information as CUI in only two cases: copying from an existing CUI document, or when the government gives explicit marking instructions (for the DoD, typically via a DD 1423 CDRL and DoDI 5200.48). Portion marking helps avoid spreading unnecessary CUI markings.
  • A contractor's own proprietary information is not CUI from its perspective, even if the government designates the copy it receives as CUI. Information shared directly between private organizations should be covered by an NDA, because the CUI program offers no protection there.
  • DFARS 252.204-7012 paragraph (h) asks contractors to flag proprietary information sent to the government. It does not require them to mark or safeguard their own copies as CUI.
  • CUI obligations arise only through the handling agreement under which the CUI was received. Requirements vary by agency:
    • The DoD uses NIST SP 800-171 Rev. 2 with the CMMC program.
    • The GSA recently moved to NIST SP 800-171 Rev. 3.
    • The DHS clause does not reference NIST SP 800-171.
  • FCI has 15 safeguarding requirements, versus roughly 110-200 for CUI depending on the NIST SP 800-171 revision and any NIST SP 800-172 scope.

Remediação

  • Do not mark unmarked or self-created information as CUI without explicit government instructions.
  • Report suspected unmarked or mismarked CUI to the contracting officer.
  • Track which handling agreement applies to each CUI instance, and separate systems where agency or pre-contract/post-contract requirements differ.
  • Use NDAs, not invented CUI markings, for proprietary data shared with subcontractors.

Linha do tempo

  1. trustedsec.com ↗ · pub. 27/10/2026 01:00 · coletado 27/10 11:00 primeiro registro

    TrustedSec guidance clarifies when contractor information is CUI, when to mark it, and how it differs from FCI

    ler a análise desta fonte

    This TrustedSec blog post by Chris Camejo, a CMMC Registered Practitioner, explains Controlled Unclassified Information (CUI) from a US government contractor's perspective. It is compliance guidance, not an incident or threat report. From a contractor's view, CUI is information received from the government that the government marked as CUI, or information created for the government where the government instructs the contractor to apply specific CUI markings. Unmarked information is generally not CUI. Most contract information is Federal Contract Information (FCI), which carries far lighter safeguarding requirements. The post also warns against contractors inventing their own CUI markings or handling requirements.

    Technical Details

    • The definition at 32 CFR 2002.4(h) requires government creation or possession (or an entity acting for the government) and a law, regulation or government-wide policy requiring safeguarding.
    • Valid CUI carries a "CUI" or "CONTROLLED" banner and the designating agency name. A purple coversheet is optional.
    • Classified information, and EAR/ITAR export-controlled information, is not automatically CUI. Export-controlled data is CUI only if it also meets the CUI definition.
    • Contractors should mark information as CUI in only two cases: copying from an existing CUI document, or when the government gives explicit marking instructions (for the DoD, typically via a DD 1423 CDRL and DoDI 5200.48). Portion marking helps avoid spreading unnecessary CUI markings.
    • A contractor's own proprietary information is not CUI from its perspective, even if the government designates the copy it receives as CUI. Information shared directly between private organizations should be covered by an NDA, because the CUI program offers no protection there.
    • DFARS 252.204-7012 paragraph (h) asks contractors to flag proprietary information sent to the government. It does not require them to mark or safeguard their own copies as CUI.
    • CUI obligations arise only through the handling agreement under which the CUI was received. Requirements vary by agency:
      • The DoD uses NIST SP 800-171 Rev. 2 with the CMMC program.
      • The GSA recently moved to NIST SP 800-171 Rev. 3.
      • The DHS clause does not reference NIST SP 800-171.
    • FCI has 15 safeguarding requirements, versus roughly 110-200 for CUI depending on the NIST SP 800-171 revision and any NIST SP 800-172 scope.

    Remediation

    • Do not mark unmarked or self-created information as CUI without explicit government instructions.
    • Report suspected unmarked or mismarked CUI to the contracting officer.
    • Track which handling agreement applies to each CUI instance, and separate systems where agency or pre-contract/post-contract requirements differ.
    • Use NDAs, not invented CUI markings, for proprietary data shared with subcontractors.