Defense industrial base (DIB) contractors are responsible for identifying and protecting Controlled Unclassified Information (CUI) in their environments. To correctly identify CUI, DIB contractors should follow these steps:

1. Review the CUI Registry, which is the authoritative source for CUI categories and subcategories.

• https://www.archives.gov/cui
• https://www.dodcui.mil/Home/DoD-CUI-Registry

2. Consult with the contracting officer or CUI program manager of the agency that provided the information.

3. Apply the CUI marking guidance and use the appropriate CUI banner and portion markings.

• https://www.archives.gov/cui/registry/category-marking-list

4. Report any incidents of unauthorized access, disclosure, or loss of CUI to the agency and the DIBNet portal.

• https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting

Correctly identifying CUI can be a frustrating experience, but you’re not alone!

Contact us if you would like help deciphering your CUI requirements – it’s a crucial step on the journey to compliance.

BACK TO BLOGS