Controlled Unclassified Information (CUI) Handling Requirements

💡 Plain English Explanation

Controlled Unclassified Information (CUI) is a category of sensitive but unclassified government information that requires specific safeguarding and handling controls. This clause establishes the requirements for how CUI must be stored, transmitted, accessed, and disposed of when shared under an NDA with government contractors or agencies.

Unlike classified information (which requires security clearances), CUI encompasses a wide range of sensitive data including technical specifications, procurement information, law enforcement data, and privacy-protected information. The federal government established the CUI Program under Executive Order 13556 to standardize how agencies and their contractors handle this information.

Key aspects of CUI handling include:

• 1
  Marking Requirements: CUI must be properly marked with CUI banners, category indicators, and handling instructions per 32 CFR Part 2002.
• 2
  Access Controls: Only authorized individuals with a legitimate need-to-know may access CUI, and systems must meet specific security requirements.
• 3
  Storage and Transmission: CUI must be stored in controlled environments and transmitted only through approved channels with appropriate encryption.

⚠ Why This Clause Matters

For the Disclosing Party (Government/Prime Contractor): Proper CUI handling clauses ensure compliance with federal regulations and protect sensitive government information from unauthorized disclosure. Failure to include adequate CUI provisions can result in contract termination, debarment, and civil or criminal penalties.

For the Receiving Party (Contractor/Subcontractor): Understanding CUI obligations is essential to avoid compliance violations. CUI handling requires specific IT infrastructure (NIST SP 800-171 compliance), trained personnel, and documented procedures. The costs of compliance should be factored into business decisions.

Regulatory Framework: CUI requirements flow from Executive Order 13556, 32 CFR Part 2002, and DFARS 252.204-7012 (for defense contracts). Non-compliance can trigger False Claims Act liability, suspension, and debarment from federal contracting.

📄 Clause Versions

CONTROLLED UNCLASSIFIED INFORMATION (CUI) HANDLING

1. Definition of CUI. "Controlled Unclassified Information" or "CUI" means information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies, as defined by Executive Order 13556 and 32 CFR Part 2002, including any information marked as CUI or identified as falling within a CUI category.

2. Compliance Requirements. The Receiving Party shall handle, store, transmit, and dispose of all CUI in accordance with:
   (a) 32 CFR Part 2002 (Controlled Unclassified Information);
   (b) NIST Special Publication 800-171 (Protecting CUI in Nonfederal Systems);
   (c) Any applicable CUI Registry categories and handling requirements; and
   (d) Agency-specific CUI policies identified in writing by the Disclosing Party.

3. Marking and Identification. The Disclosing Party shall mark all CUI with appropriate CUI markings, including the CUI banner, category designation, and any limited dissemination controls. The Receiving Party shall maintain such markings on all copies and derivatives.

4. Access Controls. The Receiving Party shall limit access to CUI to personnel who:
   (a) Have a legitimate need-to-know for the Purpose;
   (b) Have been briefed on CUI handling requirements; and
   (c) Have executed appropriate non-disclosure agreements.

5. Information Systems. The Receiving Party shall process, store, and transmit CUI only on information systems that meet NIST SP 800-171 security requirements or have an approved Plan of Action and Milestones (POA&M) for achieving compliance.

6. Incident Reporting. The Receiving Party shall report any known or suspected unauthorized disclosure, loss, or compromise of CUI to the Disclosing Party within seventy-two (72) hours of discovery.

7. Disposition. Upon termination of this Agreement or upon request, the Receiving Party shall return or destroy all CUI in accordance with NIST SP 800-88 guidelines for media sanitization and provide written certification of destruction.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) HANDLING

1. CUI Definition and Scope. "Controlled Unclassified Information" or "CUI" means all information provided under this Agreement that:
   (a) Is designated as CUI pursuant to Executive Order 13556, 32 CFR Part 2002, or the CUI Registry;
   (b) Requires safeguarding or dissemination controls under any federal law, regulation, or government-wide policy;
   (c) Is identified by the Disclosing Party as CUI, regardless of marking; or
   (d) Would reasonably be understood to constitute CUI given the nature of the information and context of disclosure.
The Disclosing Party's determination of CUI status shall be final and binding.

2. Mandatory Compliance. The Receiving Party warrants and represents that it currently maintains full compliance with all applicable CUI requirements, including without limitation:
   (a) 32 CFR Part 2002 and all amendments thereto;
   (b) NIST Special Publication 800-171 Rev. 2 (or current version);
   (c) DFARS 252.204-7012 and related clauses;
   (d) All applicable CUI Registry category requirements;
   (e) All agency-specific CUI handling policies; and
   (f) Any future regulations governing CUI.
The Receiving Party shall provide evidence of compliance upon request.

3. Enhanced Access Controls. The Receiving Party shall:
   (a) Maintain a current list of all personnel authorized to access CUI;
   (b) Conduct background checks on all personnel with CUI access;
   (c) Provide annual CUI handling training to all authorized personnel;
   (d) Implement role-based access controls with principle of least privilege; and
   (e) Maintain access logs for a minimum of three (3) years.

4. System Requirements. All information systems used to process, store, or transmit CUI shall:
   (a) Meet or exceed all NIST SP 800-171 security requirements without exception;
   (b) Be assessed by a CMMC Third-Party Assessment Organization (C3PAO) if required;
   (c) Employ FIPS 140-2 validated encryption for data at rest and in transit;
   (d) Be physically located within the United States; and
   (e) Prohibit access from outside the United States without prior written approval.

5. Immediate Incident Reporting. The Receiving Party shall report any actual, suspected, or potential unauthorized disclosure, access, loss, theft, or compromise of CUI to the Disclosing Party within twenty-four (24) hours of discovery. Such report shall include all known details and proposed remediation steps.

6. Audit Rights. The Disclosing Party and its designated representatives shall have the right, upon reasonable notice, to audit the Receiving Party's CUI handling practices, information systems, and compliance documentation. The Receiving Party shall cooperate fully and provide all requested information.

7. Flow-Down. The Receiving Party shall flow down all CUI requirements to any subcontractor or third party that will access CUI, and shall remain fully responsible for their compliance.

8. Indemnification. The Receiving Party shall indemnify, defend, and hold harmless the Disclosing Party from any and all claims, damages, fines, penalties, and costs arising from the Receiving Party's failure to comply with CUI handling requirements.

CONTROLLED UNCLASSIFIED INFORMATION (CUI) HANDLING

1. CUI Definition. "Controlled Unclassified Information" or "CUI" means only that information which:
   (a) Is clearly and conspicuously marked as "CUI" or "Controlled" with the applicable category designation at the time of disclosure; and
   (b) Falls within a category listed in the CUI Registry maintained by the National Archives.
Information that is not properly marked shall not be treated as CUI, and the Receiving Party shall have no CUI-specific obligations with respect to unmarked information.

2. Marking Obligations. The Disclosing Party shall be solely responsible for:
   (a) Determining whether information constitutes CUI;
   (b) Applying all required CUI markings, including banner markings, category designations, and dissemination controls;
   (c) Providing the Receiving Party with applicable handling instructions; and
   (d) Identifying all regulatory requirements applicable to specific CUI categories.
The Receiving Party may rely on the Disclosing Party's marking and categorization determinations.

3. Compliance Timeline. The Receiving Party shall implement CUI handling requirements within ninety (90) days of receiving properly marked CUI, or such longer period as may be reasonably necessary to procure required security infrastructure.

4. Reasonable Security Measures. The Receiving Party shall implement security measures that:
   (a) Are commercially reasonable for the applicable CUI category;
   (b) Substantially comply with NIST SP 800-171 or equivalent security frameworks; and
   (c) Are proportionate to the sensitivity of the information and duration of the engagement.
Good faith efforts toward compliance shall satisfy this requirement.

5. Access Limitations. The Receiving Party shall limit access to CUI to personnel with a need-to-know who have acknowledged CUI handling requirements. The Receiving Party shall not be required to conduct additional background investigations beyond those already performed in the ordinary course of business.

6. Incident Reporting. The Receiving Party shall report confirmed unauthorized disclosures of CUI to the Disclosing Party within seventy-two (72) hours of confirmation. Reports of suspected incidents shall be provided within five (5) business days.

7. Limitation of Liability. The Receiving Party's liability for CUI-related breaches shall be limited to direct damages and shall not exceed the greater of (a) fees paid under this Agreement or (b) $500,000. The Receiving Party shall not be liable for consequential, incidental, or punitive damages arising from CUI handling.

8. Mutual Cooperation. Both parties shall cooperate in good faith to address any CUI compliance issues that arise, including providing reasonable extensions and technical assistance.

💬 Key Considerations

• ✓
  Assess your current compliance posture. NIST SP 800-171 compliance requires significant investment in IT infrastructure, policies, and training. Understand your gaps before accepting CUI obligations.
• ✓
  Identify applicable CUI categories. Different CUI categories (e.g., CTI, ITAR, PCII) have different handling requirements. Ensure the clause addresses the specific categories involved.
• ✓
  Consider CMMC requirements. Defense contractors should evaluate whether Cybersecurity Maturity Model Certification (CMMC) requirements apply and at what level.
• ✓
  Plan for subcontractor flow-down. If you will share CUI with subcontractors, ensure they can meet the same compliance requirements.
• ✓
  Budget for compliance costs. CUI handling may require encrypted storage, secure facilities, personnel training, and third-party assessments. Factor these costs into pricing.