The Controlled Unclassified Information (CUI) Decision Tree for Defense Contractors provides a practical framework for identifying potentially sensitive government information, understanding applicable safeguarding requirements, and determining the appropriate next steps.
Controlled Unclassified Information refers to information that requires safeguarding or dissemination controls under applicable laws, regulations, or government-wide policies. Defense contractors, subcontractors, compliance officers, and contracts managers must understand these requirements to protect sensitive information and meet relevant contractual obligations.
This decision tree walks users through four essential checks: establishing the federal nexus, verifying the applicable protection authority, checking the National Archives and Records Administration (NARA) CUI Registry, and confirming contractual handling requirements. It also highlights the distinction between CUI and Federal Contract Information (FCI), helping organizations avoid incorrect designations and overlooked security obligations.
The guide outlines key actions for handling confirmed CUI, including appropriate marking, access control, safeguarding, cyber incident reporting where required, and applicable subcontractor flow-down obligations. It also references important requirements, including 32 CFR Part 2002, FAR 52.204-21, DFARS 252.204-7012, and NIST SP 800-171.
Reference: NARA CUI Program | DoD Contract Requirements.
Use this decision tree as an initial screening aid to support CUI identification and compliance planning across the Defense Industrial Base (DIB). Confirm final determinations against applicable government guidance and contract requirements.
Enjoyed reading this infographics? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
