Does My Organization Handle CUI?

For organizations supporting the Department of Defense, one of the most important cybersecurity compliance questions is also one of the most basic: 

Does my organization actually handle Controlled Unclassified Information (CUI)? 

The answer affects far more than how a document is labeled. It can influence which information systems must be protected, which contractual cybersecurity requirements apply, how information may be shared with subcontractors, and ultimately the scope of an organization’s obligations to be compliant with federal government regulations such as DFARS clauses and programs like CMMC. 

Unfortunately, determining whether an organization handles CUI is not always as simple as looking for a document stamped CUI. 

Some information arrives properly marked. Some arrives with no marking at all. Other documents still carry legacy markings that predate the current CUI Program. Occasionally, an organization may receive something marked CUI even though the content raises legitimate questions about whether the designation is appropriate. 

Organizations may also create or develop information which is categorically CUI, while performing a Government contract rather than simply receiving it from the Government or a prime contractor. 

These situations create an important distinction: 

The question is not simply, “Do I have documents marked CUI?” 

The better question is: 

“Does my organization receive, create, process, store, transmit, or otherwise handle information that qualifies as CUI in support of contract performance?” 

A repeatable decision process can help answer that question as shown in THIS FLOWCHART below.

Start With the Contract: Should I Expect to Handle CUI? 

The first decision point should occur before reviewing individual files. 

Ask: 

Does my contract or subcontract include DFARS 252.204-7012 or DFARS 252.204-7021? 

If at an initial solicitation, does the associated Request for Proposal (RFP) include a reference to DFARS 252.204-7025 or a required CMMC level for award of the contract associated to the solicitation? 

Although any of the above clauses or references are strong indicators that you may receive, or even create CUI as part of the contract, DFARS 252.204-7012 is the most foundational, and with the longest history, the contractual reference you are most likely to encounter.  

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, is an important contractual indicator that the organization should evaluate whether covered defense information will be involved in performance of the contract. 

DFARS 252.204-7012 defines a covered contractor information system as an unclassified information system owned or operated by or for a contractor that processes, stores, or transmits covered defense information. 

More importantly, the clause defines covered defense information to include controlled technical information or other information described in the CUI Registry that requires safeguarding or dissemination controls and is either: 

• marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of contract performance; or 

• collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of contract performance. 

The second part of that definition is particularly important. 

Organizations sometimes approach CUI identification as though CUI can only be a document that the Government sends them. That is too narrow. 

Information can also be collected, developed, received, transmitted, used, or stored by or on behalf of a contractor while supporting the contract. 

An engineering firm, for example, may create technical information while performing work. A software developer may create source code or technical documentation. A manufacturer may develop process information or supporting technical artifacts. The question is therefore not limited to what arrived as an attachment from a contracting officer. 

If DFARS 252.204-7012 is present 

The organization should reasonably expect that covered defense information may be involved and should establish a process for recognizing and protecting it. 

The next question becomes: 

Have we actually received or created information that may qualify as CUI? 

If DFARS 252.204-7012 is not present 

Do not automatically conclude that the organization can never encounter CUI. 

Instead, review the contract, subcontract, statement of work, applicable flow-downs, data requirements, and the information the customer expects the organization to handle. 

If the relationship is with a prime contractor, this can also be an appropriate time to ask the prime whether CUI is expected to be shared or generated during performance. 

The point is not to create a CUI obligation where none exists. The point is to understand what the contract expects before information begins flowing into systems that may not be designed to protect it. 

What Exactly Is CUI? 

Before deciding whether an organization handles CUI, it is necessary to understand what the term actually means. 

32 CFR Part 2002 provides the definition: 

“Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information (see paragraph (e) of this section) or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.” 

There are several important concepts in this definition. 

CUI is not simply “sensitive information” 

An organization cannot classify every document that seems important, confidential, proprietary, or security sensitive as CUI. 

The information must have the necessary Government connection, and a law, regulation, or Government-wide policy must require or permit safeguarding or dissemination controls. 

That means ordinary corporate proprietary information does not automatically become CUI. 

Neither does every: 

• engineering drawing 

• specification 

• spreadsheet 

• photograph 

• source code file 

• technical report 

• purchase document 

• email concerning a Government customer 

The information must meet the applicable definition and authority 

CUI does not have to originate with the Government 

The definition expressly includes information that an entity creates or possesses for or on behalf of the Government. 

This becomes particularly important for contractors that generate technical information while performing Government work. 

CUI categories have underlying authority 

32 CFR Part 2002 explains that CUI categories and subcategories represent types of information for which laws, regulations, or Government-wide policies require or permit safeguarding or dissemination controls. Those categories and subcategories are approved and listed in the CUI Registry. 

This is why a determination should go deeper than asking whether something “looks sensitive.” 

The Recipient Should Not Simply Redefine the Information 

Consider the following situation. 

A defense contractor receives an engineering package marked CUI. Someone at the contractor reviews the file and says: 

“I don’t think this should really be CUI.” 

That concern may be legitimate. 

What the organization should not do is simply remove the marking, place the information in an uncontrolled system, or begin distributing it as ordinary commercial information. 

32 CFR Part 2002 defines the designating agency as the executive branch agency that designates or approves the designation of a specific item of information as CUI. The regulation also explains that designation occurs when an authorized holder, consistent with the regulation and CUI Registry, determines that specific information falls within a CUI category or subcategory. 

For a contractor receiving information, the practical distinction is important: 

The recipient may question the designation, but should not simply override it on its own. 

The CUI regulation actually anticipates disagreement and provides a process for resolving it. 

Decision Point Two: Have We Actually Received or Created Potential CUI? 

A contract may indicate that CUI is expected, but that does not necessarily mean CUI has already entered the organization’s environment. 

The second decision point is therefore: 

Have we received, created, developed, transmitted, stored, used, or otherwise handled information that may qualify as CUI? 

If the answer is no, the organization should continue monitoring information flows associated with the contract. 

This distinction can be useful operationally. An organization may know that a future phase of a contract will require technical information that will be CUI while, during an earlier phase, that information has not yet been introduced into the environment. 

If the answer is yes, the organization now needs to determine how the information has been identified and whether what it received makes sense. 

That leads to the most visible decision point. 

Decision Point Three: Is the Information Marked CUI? 

The marking provides important information, but it should not be treated as the only factor. 

There are three common situations: 

1. The information is properly marked CUI and the designation appears consistent with the work. 

2. The information is not marked CUI, but there is reason to believe it may be CUI. 

3. The information is marked CUI, but there is reason to believe the designation may be incorrect. 

Each requires a different response. 

Scenario One: It Is Marked CUI and the Designation Makes Sense 

This is the simplest condition. 

The organization receives information using an authorized CUI marking, the information is consistent with the types of controlled information expected under the contract, and there is no reasonable indication that the designation is incorrect. 

The operational response should be straightforward: 

Handle the information as CUI. 

32 CFR Part 2002 requires authorized holders to comply with the applicable CUI requirements and review applicable agency policies for additional instructions. For CUI Specified, holders must also follow the requirements established by the applicable underlying law, regulation, or Government-wide policy. 

This is also where CUI identification begins to affect CMMC scoping. 

The final DFARS CMMC rule repeatedly connects the requirement to contractor information systems that process, store, or transmit FCI or CUI and are used in performance of the contract. 

Once CUI is confirmed, the organization needs to know: 

• where it is received 

• where it is stored 

• where it is processed 

• how it is transmitted 

• who can access it 

• what systems or services provide security protection for the environment 

Those are subsequent scoping questions. The first step, however, is simply recognizing that the information being handled is CUI. 

Scenario Two: It Is Not Marked CUI, but Something Does Not Look Right 

This situation deserves special attention. 

A common assumption is: 

“If it isn’t marked CUI, it isn’t CUI.” 

32 CFR Part 2002 does not support that conclusion. 

The regulation expressly states: 

“The lack of a CUI marking on information that qualifies as CUI does not exempt the authorized holder from abiding by applicable handling requirements…” 

That sentence changes the decision process significantly. 

Consider an organization that routinely receives controlled technical information associated with a defense program. Previous drawings of the same type have been marked CUI. A new drawing arrives through the same program channel but contains no CUI marking. 

The organization should not automatically conclude: 

“This one is safe to put on the normal network because the customer forgot the marking.” 

Instead, the inconsistency should trigger review. 

32 CFR Part 2002 requires agencies to establish mechanisms through which authorized holders inside and outside the agency can obtain instructions when they receive unmarked or improperly marked information that the agency designated as CUI. 

The Federal Register discussion is even more explicit. It explains that a contractor may be responsible for knowing the types of CUI it receives pursuant to the contract, the applicable CUI Registry category, and the handling requirements, even when information is not marked properly. 

The practical response should therefore be: 

Protect first and clarify. 

The organization should limit unnecessary dissemination, elevate the question internally, and contact the prime contractor or disseminating organization through the appropriate contractual or CUI channel. 

The recipient is not making the final designation itself. It is recognizing that the information appears inconsistent with the way similar information is normally handled and seeking a determination from the appropriate party. 

Scenario Three: It Is Marked CUI, but Something Also Does Not Look Right 

The opposite situation occurs as well. 

An organization may receive something marked CUI but have a legitimate reason to question the designation. 

Perhaps the information appears to be publicly available. 

Perhaps an entire package has been marked CUI even though certain portions appear unrelated to protected Government information. 

Perhaps the information appears inconsistent with the CUI category identified in the marking. 

The correct response is not to ignore the marking. 

Instead, use the challenge process. 

32 CFR 2002.50 states that authorized holders who, in good faith, believe that a CUI designation is improper or incorrect, or believe that they have received unmarked CUI, should notify the designating agency or disseminating agency.  

This creates an important symmetry: 

Possible unmarked CUI? Ask. 

Possible incorrectly marked CUI? Ask. 

And there is another critical requirement while the question is being resolved. 

The regulation states: 

“Until the challenge is resolved, authorized holders should continue to safeguard and disseminate the challenged CUI at the control level indicated in the markings.” 

That provides a clear operational rule: 

Challenge the designation, but continue protecting the information while the challenge is pending. 

Do not independently decontrol the information simply because someone within the contractor organization believes the marking is incorrect. 

Decision Point Four: Does the Information Use a Legacy Marking? 

Legacy markings create another frequent source of confusion. 

Many organizations have encountered older markings such as FOUO or other agency-specific control markings that predate implementation of the CUI Program. 

A logical reaction might be: 

“It has an old Government sensitivity marking, so it must be CUI.” 

But the regulation takes a more nuanced approach. 

32 CFR 2002.20 states that agencies were required to discontinue use of legacy or other markings that are not permitted by the CUI Program or contained in the CUI Registry. 

Even more importantly: 

“If legacy markings remain on information, the legacy markings are void and no longer indicate that the information is protected or that it is or qualifies as CUI.” 

That is a significant statement. 

An organization should therefore not create a blanket rule that says: 

Legacy marking = CUI. 

The old marking itself is no longer authoritative evidence that the information currently qualifies as CUI. 

But that does not mean the opposite rule is correct either: 

Legacy marking = Not CUI. 

The distinction is between the marking and the underlying information. 

Legacy Marking Does Not Necessarily Mean Legacy Information Is Uncontrolled 

32 CFR 2002.36 addresses legacy material specifically. 

Documents created before November 14, 2016 must be reviewed by agencies and re-marked if they contain information that qualifies as CUI. Where agencies do not individually re-mark qualifying legacy information, an alternate permitted marking method must be used. 

The regulation also permits an agency CUI Senior Agency Official to approve a limited legacy marking waiver when re-marking a substantial amount of stored information would be excessively burdensome. 

Further, when information from a legacy document is reused and that information qualifies as CUI, the newly created document must be designated and marked accordingly. 

The correct conclusion is therefore: 

The legacy marking itself is no longer a valid CUI designation, but the information underneath the legacy marking may still qualify as CUI. 

How Should a Contractor Handle a Legacy-Marked Document? 

A practical decision process can look like this. 

First, recognize that the legacy marking alone is not enough. 

Do not automatically map an obsolete marking directly to CUI simply because the document once required special handling. 

Next, examine the surrounding context. 

Consider: 

• Who provided the information? 

• What contract or subcontract does it support? 

• Is DFARS 252.204-7012 included? 

• Does the contract identify the information to be protected? 

• Is the material consistent with a category or subcategory in the CUI Registry? 

• Is it the same type of information previously provided as CUI? 

• Did the sender identify its status through another mechanism? 

The last question matters because 32 CFR Part 2002 recognizes circumstances in which individually marking CUI may be impractical or subject to an approved waiver. In such cases, recipients may be made aware of CUI status through alternate methods such as access agreements, system notices, or storage-area indicators. 

Then seek clarification. 

Where there is a credible indication that legacy information may qualify as CUI, the organization should contact the disseminating party and ask for confirmation. 

Where appropriate, request a correctly marked copy or other formal identification of the information’s status. 

Protect the information while resolving the question. 

The fact that an old marking is void does not mean a contractor should immediately redistribute potentially controlled Government information through an uncontrolled environment. 

The safer decision is to limit exposure while the status is being resolved. 

Marking Matters, but Marking Is Not the Entire Test 

The result is a more useful framework than simply asking whether “CUI” appears at the top of a page. 

This avoids two equally problematic extremes: 

“If it isn’t marked, it isn’t CUI.” 

and 

“If it looks sensitive, we will call it CUI.” 

Neither provides a reliable compliance process. 

What If the Government or Prime Contractor Marked It Incorrectly? 

Another common reaction is: 

“The customer made the mistake, so it isn’t our problem.” 

There is some truth in the first half of that statement but not necessarily the second. 

The Federal Register discussion accompanying 32 CFR Part 2002 explains that a contractor receiving improperly marked CUI is not responsible for having marked the information incorrectly. 

However, it also explains that the contractor could still be responsible for knowing the types of CUI it receives pursuant to the contract, understanding the applicable CUI Registry category and handling requirements, and properly protecting the information even when it was not marked correctly. 

This is an important distinction: 

Responsibility for the marking error is different from responsibility for properly handling information once the contractor has reason to recognize what it may be. 

A mature CUI program therefore trains personnel to recognize more than just markings on the top of a page. 

Employees who regularly work with defense information should understand the kinds of information their organization expects to receive and know how to escalate something that does not look right. 

Build a CUI Identification Process Before You Need It 

Organizations should not wait until a questionable file appears in someone’s inbox to decide what to do. 

A basic CUI identification procedure should answer questions such as: 

• What contracts or subcontracts may involve CUI? 

• Who reviews applicable DFARS clauses and flowdowns? 

• What categories or information types are expected? 

• How should employees recognize current CUI markings? 

• What should they do with unmarked information that appears like it should be controlled? 

• How should legacy-marked information be handled? 

• Who internally has authority to communicate with the customer about questionable information? 

• How are designation challenges documented? 

• What happens to information while a determination is pending? 

• How is a corrected designation communicated to affected personnel? 

• When does a determination require an update to CMMC scope? 

A simple escalation process may be sufficient: 

The important point is consistency. 

CUI identification should be a documented and repeatable business process, not an employee guessing exercise. 

CUI Identification Comes Before CMMC Scoping 

CUI identification and CMMC scoping are closely connected, but they are not the same question. 

CUI identification asks: 
What protected information do we handle? 

CMMC scoping asks: 
Which assets, systems, people, facilities, and service providers fall within the assessment because of how that information is processed, stored, transmitted, or protected? 

The first decision influences the second. 

The final DFARS CMMC rule, 32 CFR Part 170, requires applicable CMMC status for contractor information systems that will process, store, or transmit FCI or CUI and be used in performance of the contract. 

It also states that, when CMMC applies, the requirement extends to the information systems that process, store, or transmit FCI or CUI in performance of the contract. 

The same information-driven logic applies to the supply chain. The rule explains that CMMC flowdown is required when the subcontract or other contractual instrument requires a subcontractor to process, store, or transmit FCI or CUI. 

That is why accurately answering “Do we handle CUI?” matters so much. 

If an organization incorrectly treats ordinary information as CUI, it can unnecessarily expand its protected environment and compliance burden. 

If it fails to recognize actual CUI because something arrived without the expected marking, it may improperly exclude systems or assets that require protection. 

Neither outcome is desirable. 

The Decision Logic 

For the final article graphic, the decision process can be summarized conceptually as follows. 

1. Do I expect to handle CUI? 

Does the contract or subcontract contain DFARS 252.204-7012? 

If yes, determine what covered information is expected during performance. 

If no, verify whether another contractual requirement or customer direction identifies CUI before assuming that CUI will be handled. 

2. Have I received or created information that may require protection? 

If no, continue monitoring contract information flows. 

If yes, examine how the information has been identified. 

3. Is it marked CUI using a current authorized marking? 

If yes, ask whether there is any reasonable indication the designation is incorrect. 

• No concern: Handle as CUI. 

• Concern exists: Challenge or seek clarification and continue protecting it as marked until resolved. 

If no, continue. 

4. Does it contain a legacy marking? 

If yes, recognize that the legacy marking itself is no longer a valid indication of CUI status. 

Determine whether the underlying information may still qualify as CUI. 

If uncertainty remains, seek clarification. 

If no, continue. 

5. Does the unmarked information appear to qualify as CUI? 

Consider the source, contract, expected information type, CUI category, previous information received, accompanying instructions, and any alternate method used to identify its status. 

If yes, protect the information while seeking clarification. 

If no, there may be no current basis to treat the information as CUI, although other contractual or organizational protections may still apply. 

6. Obtain the appropriate determination. 

The result should ultimately lead to one of four conditions: 

Confirmed CUI 
Protect the information as CUI and evaluate the associated CMMC scope. 

Incorrect or incomplete marking 
Follow the corrected designation and handling instructions. 

Confirmed non-CUI 
Handle according to the applicable contract and organizational requirements. 

Still unresolved 
Continue protecting the information appropriately while the question remains open. 

The Most Important Rule: Do Not Guess 

The goal is not to turn every employee into a CUI subject-matter expert. 

Employees should instead be able to recognize three basic conditions: 

I know this is CUI. 

I have no current reason to believe this is CUI. 

Something about this information does not make sense, and I need to ask. 

The third condition is the one organizations should plan for. 

The Federal CUI framework itself recognizes that information may be unmarked, improperly marked, subject to legacy markings, or challenged by an authorized holder. Those situations are not outside the system—they are addressed by it. 

A defensible position for an organization therefore does not rely entirely on markings, and it does not encourage employees to make unsupported CUI determinations. 

Instead, it understands its contracts, knows the kinds of protected information it expects to encounter, recognizes questionable situations, protects information while necessary questions are resolved, and documents the resulting determination. 

So, does your organization handle CUI? 

Start with the contract. 

Follow the information. 

Look at the markings, but do not stop there. 

And when something does not make sense, ask before you assume.