Controlled unclassified information from the contractor's side: what CUI is, how it differs from FCI, CUI Basic and Specified, marking, controlled technical information, export-controlled data, spotting CUI in a contract, destruction, training and incidents.
The legal definition of CUI in 32 CFR Part 2002, what it excludes (classified information and contractors' own information), CUI Basic and Specified, the CUI Registry, decontrol and misuse, and why it decides whether NIST SP 800-171 applies.
How Federal contract information differs from CUI, the 15 FAR 52.204-21 safeguards for FCI versus the NIST SP 800-171 requirements for CUI, how each maps to CMMC Level 1 and Level 2, and what subcontractors need for each.
The difference between CUI Basic and CUI Specified: where the handling controls come from, the moderate confidentiality baseline, mandatory category markings for CUI Specified, limited dissemination controls, and when an agency can require more than NIST SP 800-171.
How CUI must be marked under 32 CFR 2002.20: banner and portion markings, the only authorized markings, void legacy markings, what to do with unmarked or mismarked documents, media marking under SP 800-171, cover sheets and the proposed FAR reporting rules.
What controlled technical information is under DFARS 252.204-7012, how distribution statements B to F identify it, the drawings, specifications and source code it covers, why CTI makes a system a covered contractor information system, and an enforcement example.
How ITAR and EAR treat storing export-controlled technical data that is also CUI: the end-to-end encryption carve-outs, FIPS 140 modules, proscribed countries, US-person cloud regions such as AWS GovCloud and Microsoft GCC High, and the DFARS cloud rule on top.
How to work out whether a contract involves CUI: what the contract must mark or identify, information you create in performance, the prime's duty to decide what flows down, what to do with unmarked information, systems operated for an agency, and the proposed SF XXX form.
When CUI may be destroyed and how: the 32 CFR 2002.14(f) standard, NIST SP 800-88 methods, SP 800-171 media sanitization, cryptographic erase, sanitization certificates DHS requires, and how decontrol differs from destruction.
What training contractors must give staff who handle CUI: the SP 800-171 literacy training requirement, its CMMC weight, what agency CUI training covers, and how the 2025 and 2026 FAR proposals first added and then dropped a specific CUI training mandate.
Which events contractors must report: the DFARS 7012 definitions of cyber incident and compromise, the narrower CUI incident in the 2026 FAR proposal, mismarked CUI, the SP 800-171 incident reporting requirement, and the 72-hour, 8-hour and 1-hour deadlines that apply.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.