How do you tell whether your contract involves CUI?
A contract involves CUI when it marks or identifies CUI, or when information the contractor collects, develops, receives, uses, transmits or stores in performing the contract is CUI. That two-part test comes from the covered defense information definition in DFARS 252.204-7012: the information must be a CUI Registry category that is either marked or otherwise identified in the contract, or it must be created or held by or for the contractor in support of performance. Start by reading the contract's own language, including the statement of work, the data deliverables list and any distribution statements on technical data. If a prime or contracting officer has inserted NIST SP 800-171 language, ask in writing which information the clause is meant to reach. The answer is a determination the contracting party makes, and you should not assume that the presence of the clause alone means every file you touch is CUI.
The determination depends on three things: what the contract itself identifies, which CUI Registry categories match that information, and your role. A prime that passes technical data to you may have marked it, and the marking carries the obligation with it. Information you generate yours, such as engineering analyses or test results, can become covered if it falls within a Registry category and supports performance. Your organization owns this call, and it should be written down with the contracting officer's answer attached. Where the answer is unclear, ask for a properly identified list of the CUI categories involved rather than deciding alone. Once you have a defensible scope, an independent assessor or certification body, not an implementation partner, is the party that reviews how you implement the requirements and issues any report.
For the next step, build a short inventory of the information types and systems the contract touches, and mark each as confirmed CUI, confirmed not CUI, or pending a written answer. Keep the list with the contract file so that a later review can trace each decision. Ask the contracting officer whether the solicitation will use the proposed SF XXX form for CUI requirements, since the June 2026 FAR overhaul proposal would use it to state the categories, authorities and NIST SP 800-171 Rev. 3 parameter values that apply. That form was not final as of October 2026, so confirm its status before relying on it.
Which parts of the contract to check, in order
This sequence turns a stack of contract documents into a written list of covered information and the questions that still need an answer from the contracting officer. Work through it in order, because each step narrows what the next one has to examine.
Read the safeguarding clauses first
Start by reading every clause in the contract that addresses safeguarding. For DoD work, that is DFARS 252.204-7012 and any reference to it in the Section I clause list. For civilian or non-DFARS work, look for FAR 52.204-21. Note the clause date, any deviation or revision cited, and whether the clause flows to subcontracts. The output is a short register of which safeguarding rules the contract invokes, with the clause text and its location in the document set recorded beside each entry.
Identify the covered defense information definition
Under DFARS 252.204-7012, covered defense information is either marked or otherwise identified in the contract, or it is collected, developed, received, transmitted, used or stored by or for the contractor in support of performance. Read the definition as written and separate the two tests. Information that a contract marks or identifies is straightforward to list. Information the contractor creates in performance needs its own review in the next steps. The output is a note stating which of the two tests you are applying to each category.
Check the statement of work and data deliverables
Read the statement of work, the performance work statement, and the contract data requirements list line by line. Look for references to CUI categories, controlled technical information, export-controlled data, or any marking or dissemination instruction. Pay attention to Attachment or Exhibit tables that list data items with handling notes. The output is a table of each deliverable or data item, the page or paragraph where it appears, and whether the contract marks or identifies it as CUI, as a category, or not at all.
Review distribution statements on technical data
For drawings, specifications, technical reports and source code, check the distribution statement and any legend on each document. Distribution statements B through F restrict release and are a common sign that a document is controlled technical information. Record the statement letter, the controlling office, and the date on each item. Documents with no statement still need a question to the contracting officer, because a missing legend does not settle whether the information is controlled. The output is an inventory of technical data with its distribution status and any gaps.
Record the source of every finding
For each item on the lists you have built so far, write down the exact source: the contract number, the clause, the line or table, the document title and version, and the marking seen on it. Keep findings that come from the contract separate from findings you have inferred from the work. An entry with no source should move to the open questions list. The output is a findings log that a second reviewer can trace back to the documents without asking you what you meant.
Compile covered information and open questions
Combine the findings into one written list of covered information, grouped by category, with the source for each entry. Then compile a separate list of open questions for the contracting officer, covering unmarked information, mismarked documents, information the contractor creates in performance, and any flow-down question for subcontractors. Under the current FAR overhaul proposal, a standard form called SF XXX would state the CUI categories and reporting locations for a contract, but it is a proposal and not yet final, so confirm with the contracting officer which form, if any, the contract uses. The output is the two lists, reviewed by someone outside the team that prepared them.
Send questions to the contracting officer in writing
Send the open questions to the contracting officer in writing, attaching the findings log and quoting the clause or deliverable line behind each question. Where information appears to be incorrectly marked, request a properly marked document, since the CUI regulation in 32 CFR 2002.20 directs agencies to request correction from the disseminating entity. Record each answer against its question and update the covered information list. The output is a signed-off list that the organization can use to scope its systems and flow-down decisions, with the written responses filed with the contract.
What the contract must mark or identify
Under DFARS 252.204-7012, covered defense information is CUI from the CUI Registry that is either marked or otherwise identified in the contract and provided by or for DoD, or collected, developed, received, transmitted, used or stored by or for the contractor in support of performing the contract. Controlled technical information is covered as well. So the first check is the contract itself: look for CUI markings on the requirement and for any language that names the categories of information the work involves. Search the statement of work, the data item descriptions and CDRLs, any attachments or exhibits, and the data rights clauses, since a contract often identifies CUI in an attachment rather than in the body. Record each place you find an identification, because that record becomes the basis for your scoping decisions.
When the contract is silent or the identification is vague, do not assume either answer. Ask the contracting officer in writing which categories, if any, the work involves and whether any deliverable or data set is controlled. The same route applies to documents that look mismarked. Under 32 CFR 2002.20(a)(3), an agency that receives an incorrectly marked document should notify the disseminating entity or designating agency and request a properly marked document. Treat an unclear contract the same way: the question goes to the party that controls the designation, and you keep the written answer in your contract file. Until you have it, document your interim handling decision and the reasoning behind it.
Because the prime must decide what flows down under DFARS 252.204-7012(m)(1), you may receive a subcontract that is silent or ambiguous about CUI. Ask the prime to state whether the information you will handle retains its identity as covered defense information, and confirm the answer before work starts. Confirm the answer with the contracting officer if the prime is unsure. A written answer protects both sides if the scope is later challenged, and it tells your security team which systems must meet NIST SP 800-171 before they receive any controlled data.
Does information you create during performance count as CUI?
Information you generate while performing a contract can become CUI, but only when a law or policy in the CUI Registry covers it and the contract's purpose brings it into scope. The cards below walk through the decision points that determine whether created information carries CUI obligations.
The four verbs that define covered information
DFARS 252.204-7012 reaches information your organization collects, develops, receives, transmits, uses or stores in support of performing the contract. Each verb is a separate trigger, so a working file you develop for a deliverable can qualify even if no agency ever sent it to you. Check each information flow in the contract, not only the documents the agency hands over.
Registry category is the first filter
Created information is covered only when it falls within a category listed in the CUI Registry. A design drawing for a defense system may qualify, while your internal HR records do not. Before treating anything as CUI, identify the specific Registry category and confirm that the contract's purpose connects to it.
Purpose of the contract sets the boundary
The same technical data can be CUI on one contract and ordinary business information on another, depending on what the work is for. Read the statement of work and deliverables to see whether the created information supports the government's program. Record that reasoning in your scoping file so an assessor can follow it.
The proposed FAR exception for unprotected information
The June 2026 FAR overhaul proposed rule would exclude information a contractor creates or possesses when no law, regulation or Governmentwide policy specifically requires safeguarding or dissemination controls. This rule was proposed, not final, as of October 2026, so do not rely on the exception without confirming its status. Ask the contracting officer how the final text would apply to your deliverables.
Information you own versus government information
Your own proprietary information, such as internal processes, pricing and corporate planning, is generally outside CUI even when it appears in a bid or contract file. The risk arises when your proprietary material is combined with government-provided CUI or used to build a government deliverable. Separate and label these sources in your data inventory.
Documenting the determination
Record for each created information set whether it is covered, the Registry category relied on, the contract clause or marking that supports the decision, and who approved it. If the answer is unclear, ask the contracting officer in writing before creating more material. A written determination protects you if an assessor later asks why a repository was or was not in scope.
How primes decide what flows down to subcontractors
Under DFARS 252.204-7012(m)(1), a prime contractor must include the clause in subcontracts that involve covered defense information, and must flow it down without alteration. The only permitted change is to identify the parties. The prime also has to decide whether information needed for subcontract performance keeps its identity as covered defense information. That decision is part of the prime's own compliance work, so it cannot be left to the subcontractor to guess. When the prime is unsure, the clause directs it to consult the contracting officer.
- Clause text stays intact: Only the party names may change. Adding, removing or softening requirements in the flowed-down clause is not allowed.
- Scope decision for each subcontract: The prime reviews what information the subcontractor will receive and generate, and records whether it is covered defense information.
- Marked and identified information: Information the contract marks or otherwise identifies as CUI is the clearest case for flow-down, so the prime should trace it through the statement of work and attachments.
- Information the subcontractor creates: Work product generated in performance can be covered defense information even when nobody marked it, so the prime should define that expectation in the subcontract.
- Documented reasoning: Keep a written record of each flow-down decision so the prime can explain it to the contracting officer, a DCMA assessor or a reviewer later.
Before issuing any subcontract, confirm with the contracting officer in writing wherever the flow-down decision is unclear.
A subcontractor does not make the prime's flow-down decision, but it does need enough information to comply with what it receives. The subcontractor should not assume that silence in a subcontract means no covered defense information is involved. A written question to the prime creates a record and shifts the question to the party with the obligation to answer it. The answers also determine which safeguards, reporting duties and system boundaries apply to the subcontractor's own environment.
- Whether the clause applies: Ask the prime to state in writing whether DFARS 252.204-7012 is included in the subcontract, and whether the subcontract involves covered defense information.
- Which information is covered: Ask the prime to identify the specific documents, data or categories the subcontractor will receive, and whether any are marked or otherwise identified as CUI.
- What the subcontractor must generate or store: Ask whether work product the subcontractor creates will be treated as covered defense information, and where it must be stored.
- Reporting path: Ask who the subcontractor reports cyber incidents to, and how quickly the prime expects notice.
- Escalation if the answer is unclear: If the prime cannot answer, ask it to consult the contracting officer and to confirm the answer in writing.
Keep the prime's written answers with the subcontract file, since the subcontractor may need to show later which information it was told to protect.
The contracting officer is the escalation point when a prime cannot decide whether information keeps its covered defense information identity. The contracting officer represents the agency and can say which information the contract identifies as CUI and which information it does not. Escalation should happen before the subcontract is issued, because a later dispute about flow-down is harder to resolve once work has started and data has moved.
- Written question: The prime should send a specific question that names the subcontract, the information in question and the proposed flow-down position.
- Identify the information: The question should list the documents, data types and generated work product, not a general request for guidance.
- Ask for a written answer: Request that the contracting officer confirm the decision in writing, and keep that response with the prime's compliance file.
- Ask about marking: If information appears to be mismarked or unmarked, the contracting officer may need to notify the disseminating entity or designating agency and request a properly marked document.
- Follow the answer through: Once the contracting officer responds, the prime should update the subcontract, the flow-down terms and the system scope to match.
Confirm with the contracting officer which party will document the final decision, and whether the agency expects a revised statement of work or a contract modification to reflect it.
What to do with unmarked information you think is CUI
When information looks controlled but carries no marking, the first step is to write down why you think it is CUI before you decide how to handle it. Record the document or data set, the contract and contract line item it relates to, who created or sent it, and the specific features that point to a CUI category, such as technical data on a defense article, personally identifiable information from a government system, or a distribution statement that suggests controlled technical information. A short written basis lets you show later that the decision was reasoned rather than casual, and it gives the contracting officer something concrete to answer. Keep the note with the contract file, and do not rely on memory or a verbal impression from the project team.
Next, ask the contracting officer to identify the information in writing. Under the DFARS and the CUI rules in 32 CFR Part 2002, the contract and the agency decide which information is covered, so the question belongs with the government side, not with your own judgment. Frame the question around specifics: name the item, state the CUI category you believe applies, and ask whether the information is covered defense information, whether it carries any dissemination limits, and which safeguards apply. If the information came from an agency with an incorrect marking, 32 CFR 2002.20(a)(3) directs the receiving agency to notify the disseminating entity or designating agency and request a properly marked document. Confirm with your contracting officer how that request should be routed, and ask whether a revised marking or a written determination will be issued.
While you wait, handle the information under the safer reading. Store it on systems that meet NIST SP 800-171 controls, limit access to people with a need to know, and keep it out of unapproved cloud services or personal email. The cost of over-protecting for a short period is usually lower than the cost of a reportable incident involving information that later turns out to be CUI. Do not decontrol or destroy anything on your own initiative, and do not treat silence from the contracting officer as confirmation that the information is outside scope. Document each interim decision, and if the contract or your subcontract terms require a response within a set period, plan around that deadline and confirm the timing in writing rather than assuming it.
What the proposed SF XXX form would tell you
The June 2026 FAR overhaul proposal would use a Standard Form, SF XXX, to state a contract's CUI obligations in one place. The form is a proposal and is not in effect, so the four elements below describe what it would contain, not what your current contract must include. Ask the contracting officer whether a form will accompany your contract and which elements it will carry.
Which CUI categories apply
The form would list the CUI categories the contract involves. This is the first thing to compare against your own work. If a category appears, the information it covers is CUI for that contract, and you need to know which of your systems, documents and subcontracts will hold it. If no category is listed but your team still receives or creates sensitive technical data, ask in writing whether that information falls under the contract's CUI requirements before you assume it does not.
Safeguarding or dissemination authority
The form would name the law, regulation or Governmentwide policy that sets the safeguarding or dissemination rules for each category. The authority tells you whether the handling rules come from the baseline or from something stricter. Read the cited authority for each listed category and record which handling rules apply. Where the form names no authority, confirm the basis with the contracting officer rather than inferring it from the category name.
Where to report CUI incidents
The form would state where contractors report CUI incidents under the contract. Reporting channels must be known before an event occurs, because the clock for a required report starts when the incident is discovered. Confirm the named reporting location, record it in your incident response plan, and check whether it differs from the cyber incident reporting path already required by DFARS 252.204-7012 for covered defense information.
NIST SP 800-171 Rev. 3 ODP values
The form would supply the organization-defined parameter values that apply to the NIST SP 800-171 Rev. 3 requirements for this contract. NIST does not assign ODP values, so without them a nonfederal organization must set its own to complete the requirement. Check whether the form lists values for every ODP your system security plan depends on, such as review frequencies and password or session settings, and document any values you still need to set yourself.
Who owns the CUI determination
The organization that holds the contract owns the CUI determination and the controls that follow from it. Under DFARS 252.204-7012, covered defense information is information that is marked or otherwise identified in the contract, or that the contractor collects, develops, receives, transmits, uses or stores in support of performing the contract. Deciding which information falls in that category is therefore a contractual and operational judgment made inside the company, and the company answers for the result.
- Contract review: Read the contract, its statement of work, attachments and any CUI identification to list which information categories it names.
- Information inventory: Record what the company creates, receives and stores during performance, including data that may not be marked.
- Flow-down decisions: Decide which subcontractors receive covered information and confirm with the prime or contracting officer where identity is unclear.
- Documented rationale: Keep a written record of each determination so that it can be reviewed by the agency, a customer or an assessor.
- Accountable sign-off: Assign a named executive or security owner to approve the determination and revisit it when the contract changes.
Before relying on any determination, confirm with your contracting officer or prime which categories the contract names and whether a CUI identification form accompanies it.
An implementation partner supports the organization's analysis but does not make the determination or sign for it. A partner such as DeployOpen can help the organization read contract language, map how information moves through its systems, and prepare the system documentation and evidence that show how it handles the information. Those outputs feed the organization's decision. They do not replace it, and they do not confer any certification or status.
- Contract language review: Help identify clauses, attachments and identifiers that point to CUI, and list open questions for the contracting officer.
- Information flow mapping: Trace where contract-related data is created, stored, transmitted and shared across cloud accounts, endpoints and subcontractors.
- Evidence preparation: Organize configuration records, access reviews and logs that show how the organization's controls operate.
- Scoped remediation: Build and document the systems that process the information the organization has decided to protect.
- Clear boundaries: Agree in writing which tasks the partner performs and which decisions remain with the organization.
Ask any partner to state in writing that it does not issue determinations, reports or certifications, and that the organization retains ownership of its controls.
An independent assessor is the party that tests and reports on whether the controls are in place, and the contracting agency is the party that resolves questions about what a contract requires. Neither role belongs to the implementation partner. Where the organization and its customer disagree about whether information is CUI, the agency's answer governs the contract. Where a third party must verify compliance, that third party is independent of the team that built the systems.
- Agency authority: The contracting agency or contracting officer settles disputes over marking, identification and scope.
- Independent testing: Assessors examine evidence, interview staff and test controls against the assessment procedures that apply to the requirement.
- Formal reports: Only an independent auditor, assessor or certification body issues a report or certificate that a third party can rely on.
- Separation of duties: An assessor should not be the same firm that designed or operated the controls it tests.
- Scope confirmation: Confirm early with the agency or assessor which systems and information are in scope.
Before engaging anyone to assess, confirm which body will accept the result and get that expectation in writing.
Common questions about CUI in contracts
Can a contract with no CUI clause still involve CUI?
Yes. A contract can involve CUI without a clause that names it, because the DFARS 252.204-7012 definition of covered defense information reaches information that is marked or otherwise identified in the contract, and also information your organization collects, develops, receives, transmits, uses or stores in support of performing the contract. The absence of a clause is a signal to check, not proof that nothing is covered. Start with the statement of work, the data deliverables, the distribution statements on technical documents, and any CUI Registry categories the agency names. Then confirm the answer in writing with the contracting officer, since the contract text and its attachments are what you can point to later.
What does a contract review cost, and who pays for it?
The review is paid for by the organization that holds the contract, and its cost is mostly staff time from contracts, legal, security and the program team. No fee is stated in the supplied sources, so confirm what your own review will take before you commit. The main drivers are the number of contract vehicles, the number of subcontracts and the number of technical data sets you hold, along with how many documents are unmarked. Expect a one-time review for each contract and a recurring check whenever a modification, task order or new deliverable is added. Ask any outside party for a written scope that lists the documents reviewed, the people interviewed and the written determination you will receive.
Can an implementation partner make the CUI determination for us?
A partner can prepare the analysis, map where information lives in your environment and draft questions for the contracting officer, but the determination is your organization's decision and its contracting officer's to confirm. DeployOpen prepares systems, controls and evidence for compliance work and does not issue determinations, reports or certifications. Only the agency decides what it has marked or identified as CUI, and only an independent assessor issues assessment results. Ask a partner to show which parts of the review it will perform, which parts you keep, and which outputs go to the contracting officer in writing.
What should we ask the contracting officer about CUI?
Ask a short set of specific questions that the answer can settle in writing. Ask which CUI categories, if any, the contract involves, and whether any information is marked or identified in the contract. Ask whether the agency expects you to handle controlled technical information, and which distribution statements apply. Ask which safeguarding or dissemination authority governs the information, where incidents must be reported, and whether any NIST SP 800-171 organization-defined parameter values are specified. Under 32 CFR 2002.20(a)(3), an agency that receives an incorrectly marked document is expected to request a properly marked one, so ask for corrected markings where the current ones look wrong.
What do we do if a prime will not confirm flow-down?
Put the question to the prime in writing, cite the flow-down duty in DFARS 252.204-7012(m)(1), and ask for its determination of which subcontract information retains its identity as covered defense information. Under that paragraph the prime must flow the clause down without alteration, except to identify the parties, and must determine whether information needed for subcontract performance keeps its covered status. If the prime cannot answer, it is expected to consult the contracting officer. Keep a record of each request and response. Until the question is settled, plan as though the information is covered, because the cost of a wrong guess falls on the subcontractor.
Does the proposed SF XXX change current obligations?
Not yet. The SF XXX form, Controlled Unclassified Information (CUI) Requirements, appears in the June 2026 FAR overhaul proposed rule, which was not final as of October 2026. As proposed, it would tell contractors which CUI categories a contract involves, the safeguarding or dissemination authority, where to report CUI incidents and which NIST SP 800-171 Rev. 3 organization-defined parameter values apply. Current obligations come from the contract and the DFARS clause in force. The proposal would also add an exception to the FAR definition of CUI for information a contractor creates that no law, regulation or Governmentwide policy requires it to safeguard. Confirm the final text and its effective date before you change internal rules.
How DeployOpen helps scope CUI before the work starts
Before any system is built for a contract that may involve CUI, the organization needs a written answer to which information is covered and where it lives. DeployOpen helps prepare that answer by scoping the systems, documenting the data flows and preparing the evidence, while the organization keeps ownership of its contract interpretation and controls.
How we scope
- Map every contract clause, marking and data source that may bring CUI into your environment.
- List the systems, accounts and people that create, receive, store or transmit the information in question.
- Agree the scope in writing before work starts, with deliverables and timelines fixed in advance.
How we build
- Configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- Separate covered information into a defined boundary so that only the systems that need it fall within scope.
- Test the boundary and access paths with security testing before the environment is handed to users.
How we hand over
- Document the data flow diagrams, system inventory and boundary decisions your contracting officer or assessor will ask for.
- Record each open question about marking or flow-down with the source it depends on, for your legal and contracts team to resolve.
- Walk your team through the documentation so the boundary can be maintained after the engagement ends.
How we support
- Engagements are fixed-scope, and ongoing support, upgrades and continuous testing are available as retainers.
- Revisit the boundary when a contract is modified, a subcontract is added or a new CUI category appears.
- Confirm with your contracting officer, counsel or an independent assessor any interpretation that affects your obligations.
