Source
r/CMMC•
4Signs

Understanding CUI

I work in compliance at a manufacturer that recently started defense work. We are a subcontractor (I’m sure many tiers down the chain) with no direct contracts with the government. We are trying to understand what information that we receive is actually CUI. Based on the description of CUI we believe at least some of what we are sent could be CUI. But nothing we receive has any CUI markings, we are never informed what info is CUI from our customers, and when we asked directly the Buyer in Procurement and Engineer from that company did not know the answer.

Does the CUI you receive always include CUI markings, or are you informed in some other way what the CUI is? Thanks!

Posted Nov 20, 2023, 10:56 PM UTC

616
jlaw7905•

That sounds right. The DoD clients don't even understand what CUI is or how to mark it correctly.

All CUI should be marked as such and have a designation indicator block on the first page. That's not to say you haven't received unmarked CUI though.

It's the government client's responsibility to mark their CUI correctly. If you received something you thought may be CUI, escalated it up the chain to ask about it, then you did your part in my opinion.

12
4SignsOP•

Thanks for the reply. Its crazy, from where we sit it feels like all these companies are acting like “don’t ask don’t tell” when it comes to CUI

10
DarthCooey•

Maybe the best video I've ever seen breaking down what is/isn't CUI: https://youtu.be/IEy-TkmKMt8?si=hcCKnrd9s8Zp0UKc

6
4SignsOP•

Thanks so much, this was extremely helpful!

2
DarthCooey•

Ryan Bonner and the entire team at Defcert are amazing. Highly recommend checking them out if you ever decide to bring in outside help: https://defcert.com/

(No I don't work for them, but have worked closely with them on some mutual clients in the past.)

4
Navyauditor2•

This is tough and many are struggling with this question.

I would first say that if it is not marked it is not CUI. The government and your primes if they develop the information have a responsibility to mark. They are required to mark. We need to stop the eternal search trying to divine the governments intent with a crystal ball. They need to do their job in this model.

Second accept Distribution Statement B-F as CUI. There is argument on this that we could do an hour long video on the regulatory complexities about. If taking the tough stance on marking then accept those marks as CUI.

Finally I am seeing some marking but not a lot. It is increasing and expect to see more going forward.

6
Quadling•

Get it in writing that you have asked what information that you receive from them is CUI. Get their answer in writing that nothing you get is CUI. That is the only way you are covered. And honestly, it doesn't matter. If the govt finds out that you have been getting CUI, and you shouldn't, it won't matter that it's not your fault, the prime will lose the contract, and you will lose the business.

You should know the contract number or name. Look it up and find out who the prime is

5
4SignsOP•

Thanks for your suggestions, losing the business over this is my concern. Right now we are trying to treat all of the info we receive from these POs as CUI but that makes complying with 800-171 more difficult for us

1
Quadling•

Ehhh, maybe, but there are cheap ways to do it. Prevail is pretty cheap, and you can enclave the data with no Internet access, depending on how you use it, and that's legit. If you want to talk, I'm happy to chat with you. No strings. :)

1
securesailor•

Ask the government PM for the program’s Classification Guide. It will tell you what information/data is classified and what makes it that way. Most Classification Guides will probably still refer to CUI as FOUO.

2
4SignsOP•

Sorry what do you mean by government PM?

1
HSVTigger•

Often, only the primes deal with the PM. You are downstream supplier, you have to work with your customer to filter the CUI.

1
cybermyteteam•

In your subcontract there should be flow downs from your prime. Is there anything that talks about needing to be in compliance with Covered Defense Information or DFARS 252.204-7012. Go through the CUI categories from the NARA website. If your prime is sending you unmarked information that falls into CUI category then they are in the wrong. If they are not sending you information from one of the CUI categories this is also possible. When you work through scoping the goal is to really reduce the spread of CUI information, maybe they’ve done just that. Good luck!

2
BrightDefense•

As the previous posters mentioned, whether it's labeled or not, you should be pursuing CMMC Level 1 and get the 17 best practices implemented! It would be best to get a CMMC consultant to guide you through this process and tailor the policies and procedures to meet this portion of your business.

1
roaddog•

Our challenge is that we create CUI as part of our work product. Identifying and subsequently marking that is going to be an interesting journey.

1
ApokatastasisComes•

It is not the government’s responsibility to mark CUI. Your company and any other company that has CUI must mark it as such. Welcome to the nightmare

-2
DomainFurry•

… it's absolutely the governments job to properly classify information. The controlling agency should be marking it according to there CUI program. I would not modify government docs, I would only mark something CUI that we as a contractor created.

This is NARA: "Upon implementation, agencies are responsible for marking or identifying any CUI shared with non-federal entities. Questions regarding the status of information (marked or unmarked) should be directed back to the government contracting activity. Some agencies are not yet marking CUI and are still implementing the elements of the CUI program. Contractors should not follow CUI program requirements or markings until directed to do so in a contract or agreement."

4