If you work with federal contracts, chances are you've encountered Controlled Unclassified Information (CUI) and wondered who's actually responsible for keeping it secure. The answer isn't as straightforward as you might think.

CUI management involves multiple parties across the defense supply chain, each with specific roles and obligations. While anyone handling CUI bears some responsibility for its protection, the legal framework creates distinct requirements for government agencies, prime contractors, subcontractors, and individual personnel.

This guide is for defense contractors, government personnel, and compliance professionals who need to understand their CUI compliance obligations under current regulations like DFARS 252.204-7012, NIST SP 800-171, and CMMC 2.0.

We'll break down the legal foundations that govern CUI handling requirements, examine how government agencies lead program implementation and set standards, and clarify the specific CUI management obligations that flow down from prime contractors to their subcontractors and service providers.

Understanding CUI and Its Legal Framework

Definition of Controlled Unclassified Information and Its Categories

Controlled Unclassified Information (CUI) represents a category of sensitive information that falls under legal, regulatory, or contractual protections while remaining unclassified under federal law. You'll encounter CUI as information the U.S. government creates or possesses, or that your organization creates on behalf of the Federal government, requiring safeguarding under executive branch laws, regulations, or government-wide policies. For Defense Industrial Base (DIB) organizations like yours, CUI commonly includes technical drawings, specifications, contract details, and cybersecurity data listed in the National Archives' CUI Registry.

Your CUI management responsibilities involve understanding two primary categories: CUI Basic and CUI Specified. CUI Basic represents the default and most common category for DIB contractors, requiring safeguarding under baseline CUI controls without additional handling requirements. CUI Specified encompasses a subset with enhanced handling requirements, where governing legal, regulatory, or government-wide policies explicitly state protection methods and access controls, such as International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR) data.

Executive Order 13556 and Federal Regulatory Foundation

The Controlled Unclassified Information program was established through Executive Order 13556 in 2010 to address your industry's inconsistent safeguarding and marking policies. This foundational directive created the regulatory framework that governs your CUI compliance obligations today. The implementing regulation, 32 CFR Part 2002, outlines baseline CUI handling requirements for all executive branch entities and establishes the CUI program throughout the federal government, clearly stating your roles and responsibilities as a contractor handling sensitive government information.

Defense-Specific Implementation Through DFARS and NIST SP 800-171

Your defense contracting obligations are specifically defined through DFARS 252.204-7012, which requires you to implement NIST SP 800-171 controls to protect CUI in your systems. NIST SP 800-171 specifies 110 technical and procedural safeguards that you must implement for protecting CUI in non-federal information systems, serving as the core standard for your compliance under both DFARS and CMMC requirements. Additionally, DoD Instruction 5200.48 clarifies how the Department of Defense implements the CUI program, providing you with specific instructions for identifying, marking, disseminating, and decontrolling CUI within your defense contracts.

CMMC 2.0 Requirements for Defense Industrial Base Contractors

The DoD is migrating to the CMMC framework for assessing and enhancing your cybersecurity posture within the Defense Industrial Base. Under CMMC 2.0, you're required to implement NIST 800-171 controls and, depending on your contract requirements, pass third-party assessments to demonstrate compliance. If you handle CUI, CMMC Level 2 applies to your organization, establishing verification requirements that go beyond self-assessment to include independent validation of your cybersecurity implementation and CUI protection capabilities.

Government Agencies Leading CUI Program Implementation

National Archives and Records Administration as Executive Agent

The National Archives and Records Administration (NARA) serves as the Executive Agent for the CUI program under 32 CFR Part 2002, making it your central point of contact for CUI management regulations. NARA maintains the Federal CUI Registry, housing essential information that guides your CUI compliance efforts across all government agencies and contractor organizations.

Defense Counterintelligence and Security Agency's Role in DoD Implementation

When you're working within the Department of Defense ecosystem, the Defense Counterintelligence and Security Agency (DCSA) handles CUI program implementation. DCSA ensures that your organization follows proper CUI management protocols specifically tailored to DoD requirements and security standards.

Department of Defense CUI Program Management Responsibilities

Your understanding of DoD's approach to CUI management is crucial, as DoDI Instruction 5200.48 establishes policy for a uniform CUI program throughout the Department of Defense. Unlike centralized management structures, the DoD does not assign a single point of responsibility across the CUI lifecycle, meaning each party in your organization must understand and act on their specific role based on Executive Order 13556 requirements.

Originating Agency Duties for Initial CUI Designation and Marking

As you navigate CUI compliance, remember that the originating government agency bears responsibility for initially designating CUI. Government agencies are specifically tasked with both designating and marking controlled unclassified information, establishing the foundation for all subsequent CUI management obligations that flow down to your organization as a contractor or subcontractor.

Prime Contractors and Their CUI Management Obligations

Implementing NIST SP 800-171 Controls for CUI Protection

As a prime contractor handling CUI, you must implement NIST SP 800-171 security controls to protect controlled unclassified information in accordance with federal requirements. Your organization bears direct responsibility for establishing comprehensive CUI management protocols that meet both standard CUI protection requirements and any additional specifications for CUI Specified categories. This implementation forms the foundation of your entire CUI compliance framework.

Flowing Down CUI Requirements to Subcontractors

You are responsible for ensuring that all CUI requirements flow down appropriately to your subcontractors and third-party service providers. This critical obligation means you must establish clear contractual language that transfers CUI protection responsibilities throughout your entire supply chain. Your subcontractors must receive the same level of CUI management obligations that apply to your organization.

Proper Marking and Documentation of Derivative CUI Materials

When your organization creates derivative documents containing CUI, you must apply appropriate CUI markings to identify and protect this information. You are required to preserve existing CUI markings from source materials and transfer them to any newly created documents. Additionally, if your organization creates CUI under a DoD contract, you must identify it at the time of creation, apply proper markings according to DoDI 5200.48 Section 3.6.a, and ensure protection according to contract terms and applicable law.

Incident Reporting and Compromise Response Within 72 Hours

You must report any suspected compromise of CUI to the Department of Defense within 72 hours of discovery. This strict reporting timeline requires your organization to maintain robust incident detection and response capabilities to ensure timely notification of potential security breaches affecting controlled unclassified information.

Subcontractors and Third-Party Service Provider Responsibilities

Equivalent Protection Standards Regardless of CUI Origin

You must implement equivalent CUI protection standards as a subcontractor, even when you didn't generate or mark the information yourself. Your safeguarding obligations begin immediately upon receiving CUI from prime contractors or government agencies.

Managed Service Providers and Cloud Service Providers Compliance

Your organization faces specific CUI compliance requirements if you operate as a Managed Service Provider (MSP) or Cloud Service Provider (CSP) supporting government contractors. You must establish comprehensive safeguards related to CUI protection when assisting contractors with IT management services.

Training and Policy Enforcement for Personnel Handling CUI

You must ensure all employees understand proper CUI handling procedures through structured training programs and consistent policy enforcement. Your personnel require thorough education on controlled unclassified information protocols to maintain compliance throughout your organization.

Access Control and Export Restriction Compliance

You must prevent unauthorized access or dissemination of CUI, including restrictions on sharing with foreign nationals when export controls apply. Your access control measures become critical for CUI Specified categories subject to ITAR or EAR regulations, requiring enhanced security protocols.

Individual Personnel and Organizational Compliance Requirements

Individual Personnel and Organizational Compliance Requirements

Now that we have covered the roles of government agencies, prime contractors, and subcontractors, it's crucial to understand individual personnel responsibilities within your organization's CUI management framework.

Mandatory Initial and Annual Refresher Training Programs

You must complete mandatory initial training and annual refresher training on CUI per DoD 5200.48 and your contractual agreements. The Center for Development and Security Excellence (CDSE) offers CUI training specifically for industry personnel, or you can develop your own training programs provided they contain all 11 topics outlined in CUI Notice 2016-01.

Proper Physical and Digital CUI Marking Procedures

Your physical CUI materials must display authorized banner markings at the top and bottom of each page, including the control marking ('CONTROLLED' or 'CUI'), applicable categories, and any limited dissemination controls. For digital CUI, you need to include the CUI banner in headers, footers, and metadata fields where possible. When transmitting CUI via email, you must include appropriate markings in the subject line and body, with attachments individually marked. Physical media like USB drives and hard drives require external labels identifying the contents as CUI.

Secure Storage and Transmission of CUI Materials

You must restrict physical access to CUI and ensure storage meets safeguarding standards, such as using locked cabinets. Your digital CUI files must be stored in systems compliant with NIST SP 800-171 and protected from unauthorized access or exfiltration to maintain proper CUI compliance throughout your organization.

Assessment and Documentation of CMMC Level 2 Readiness

You must assess, apply safeguards, and retain records that demonstrate CMMC Level 2 compliance. CMMC 2.0 Level 2 applies to contractors handling CUI and may require passing third-party assessments. Your organization must prioritize closing gaps in CUI marking, access control, and incident reporting to ensure handling responsibilities are clear and defensible for assessment or contract review.

CUI management is a shared responsibility that extends across the entire Defense Industrial Base, from government agencies to individual personnel. Each player—whether you're a government agency establishing the framework, a prime contractor flowing down requirements, a subcontractor implementing protections, or individual personnel handling the information—has specific obligations that are critical to maintaining the security of sensitive information. Understanding these distinct roles ensures that CUI receives proper protection throughout its entire lifecycle, from creation to destruction.

The stakes for proper CUI management have never been higher, especially with the active enforcement of the CMMC Final Rule. If your organization handles CUI, you cannot afford to assume someone else will manage compliance for you. Take immediate action to assess your current CUI handling procedures, verify that proper markings are in place, and ensure all personnel understand their responsibilities under NIST SP 800-171 and CMMC Level 2 requirements. The time to address gaps in your CUI management program is now—before an assessment or contract review exposes vulnerabilities that could jeopardize your organization's ability to work with the Department of Defense.