1 of 20

What is CUI?�Understanding and Protecting Data for DoD Contractors

Presented by NCMEP/IES

1

Industry Expansion Solutions

2 of 20

Webinar Details

30 minutes to cover CUI basics

IES background and why we care about CUI
Why contractors should be aware of CUI
Defining CUI
Protecting CUI

Resources:

Free Online Course
Q&A/Ask An Expert
Online Resource List

Industry Expansion Solutions

3 of 20

IES was founded in 1955 to help North Carolina industries grow and prosper
Engineering-based, solutions-driven, client-focused unit of NC State University
Collaboration with DoD, NIST, NC State
Emphasis on supporting manufacturers in North Carolina
Working with NIST and local organizations to improve manufacturer awareness of cybersecurity risk and defense

Who We Are: IES Background

Industry Expansion Solutions

4 of 20

Why Should the DIB Care About CUI?

The weakest link is the best place to attack
Foreign adversaries understand the US government is a difficult target, contractors operating in the DIB are less equipped to defend data
Big breaches get big coverage

OPM Hack- 2013-2015
Sea Dragon- 2018
SolarWinds (not contractor attributed)- 2020
Colonial Pipeline (unknown attack vector at this time)- 2021
Lincoln Law- October 2021 (False Claims Act) DOJ announces use of FCA to pursue contractors

Industry Expansion Solutions

According to the former Director of National Intelligence Daniel Coats, “most of the detected hacks from China on US industry are focused on defense contractors or tech firms supporting the government”
Attacks are constant, increasingly complex, and automated. These attacks are targeted at the least protected part of the DIB, in an attempt to bypass more rigorous security found at government controlled networks
Foreign adversaries have successfully breached contractor networks in the past with devastating impact. Some of those attacks have left millions of government employees and contractors at risk.
Here are just a few of the highly publicized attacks that we know about:

Office of Personnel Management, or OPM, suffered one of the largest attacks on record. Jeopardizing the personal data of over 22 million Americans. The breach was the result of poor security by two contractors providing background check services, and included detailed information family, financial, and health. It was a disaster, and started a national conversation of data theft and security, and its full impact is still unknown
The Sea Dragon attack was another example of contractors who had access to government data, and were not able to secure that data. The theft included R&D related to submarines, cryptographic information, experimental weapon programs, and more which the US Navy will not disclose in order to protect national security. What we do know is that China was behind the attack, the attack was aimed at a contractor, and the data, when aggregated would be considered classified. A theft of this nature is very different than the OPM hack, but may cost the US even more when you consider the nature of the data stolen

Just in the past month a new initiative was announced which should concern contractors. The DOJ announced it will be using the False Claims Act to pursue contractors who: knowingly (1) provide deficient cybersecurity products or services, (2) misrepresent their cybersecurity practices or protocols, or (3) violate obligations to monitor and report cybersecurity incidents and breaches.

5 of 20

Small Business and CUI

CUI is governed the same for businesses large and small
Smaller businesses struggle with requirements because:

They have limited or no IT infrastructure
Less experience in cyber defense/compliance
Smaller or no dedicated cyber defense budget

Industry Expansion Solutions

6 of 20

Defining CUI

CUI is non-classified information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and government wide policies
Anything other than COTS (Commercial Off-The-Shelf) software
Any manufacturer who provides a product or solution that is designed for government or modified for government, the information associated with such would be considered CUI

Industry Expansion Solutions

Here’s a quote from DEVIN CASEY, lead for agency implementation and oversight activities for the Controlled Unclassified Information (CUI) Program: “So everything from tax information, personally identifiable privacy Information, health information, all the way to unclassified naval nuclear information falls into this huge umbrella of controlled unclassified information. The CUI program standardizes the safeguarding, marking, handling and baseline requirements to identify and protect that information that is being used throughout the entire executive branch, as opposed to agencies having all of their own programs and markings and different standards.”
What can we take away from this vague statement? That CUI is a diverse, varied set of information, that is not easily defined with one sentence

7 of 20

CUI Life Cycle

Identify

Safeguard

Share

Decontrol

Identify: The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category
Safeguard: Appropriate protections must be implemented to protect CUI once identified
Share: Sharing should be restricted to the least amount of people possible. Sharing should be based off of all applicable labels and requirements
Decontrol: Not all CUI can be decontrolled, applicable laws should be followed before decontrolling

Industry Expansion Solutions

Identify: There is no one fits all answer to identifying CUI. One thing is clear, if CUI is not properly identified, protection, labeling, and decontrol are much more challenging. The first step in identification is looking for any specific mention of CUI in a contract.

Safeguard: Safeguarding CUI boils down to implementing NIST SP 800-171 requirements. If met, your company can say they properly safeguarding CUI. If your in-house IT staff is unable to assess their compliance with these requirements, external IT assistance may be required.

Share: System Security Plans (SSPs) require contractors to document relationships or connections with outside systems as well as periodic reviews of these shared connections. To limit attack surfaces, contractors should share with as few outside systems and people as possible, and remove shares once deemed unnecessary.

Decontrol: When control is no longer needed, CUI should be decontrolled as soon as possible. As long as the information no longer requires safeguarding or dissemination controls, unless doing so conflicts with the underlying law, regulation, or government-wide policy. Reducing the amount of CUI on your network reduces the burden on safeguarding, and in turn, reduces attack surfaces and responsibility your company to protect CUI.

8 of 20

Standards Requiring Protection of CUI: DFARS

DFARS/NIST SP 800-171: the Defense Federal Acquisition Regulation Supplement states that contractors and subcontractors working with the Department of Defense (DoD) are in scope of DFARS
NIST 800-171 is a globally accepted standard which includes 110 controls across 14 domains
Once these requirements have been met, organizations can bid on and win RFPs (request for proposal) with the DoD

Industry Expansion Solutions

9 of 20

Standards Requiring Protection of CUI: CMMC (CMMC 2.0)

CMMC: Cybersecurity Maturity Model Certification (CMMC) is a standard published in 2020 for implementing cybersecurity across the defense industrial base (DIB)
CMMC differs from other standards governing CUI because it mandates third party assessment and verification of policies and procedures

Industry Expansion Solutions

CMMC builds upon and is not duplicative of NIST 800-171 by adding a certifiable element of the framework
CMMC is being rolled out in phases, which has caused some confusion and delays
CMMC was intended to apply to all DoD solicitations and contracts by October 2025
CMMC 1.0 included five levels which demonstrate a progression of cybersecurity maturity
A big change in CMMC is the requirement for assessments by Third Party Assessment Organizations (or C3PAOs)
Regardless of the turmoil surrounding CMMC, it is a requirement and must be adhered to in order to operate in this space in the near future
A final note- this is an evolving situation. Just last week John Sherman, the nominee to lead the Pentagon’s Cyber department, told the Senate Armed Services Committee Oct. 28 that he would seek to update the Cybersecurity Maturity Model Certification (CMMC) program to be "not onerous" for small and medium-sized businesses, if confirmed. Additionally, Sherman said he would work with the National Security Agency and U.S. Cyber Command to provide a "cybersecurity-as-a-service" model that would give businesses "templates and guides on how to do this so they don't have to reinvent the wheel."

10 of 20

Where Does CUI Live

CUI is data, data can be stored, sent, received, and destroyed
CUI can reside on a electronic storage media (hard drive, flash drive, CD, DVD)
CUI can be on a physical printout or piece of mail
CUI can found in an electronic communication (email)

Industry Expansion Solutions

11 of 20

Identifying CUI

External Origin:

Does the contract or RFP mention CUI?
Does an item received (physically or electronically) contain CUI cover page, banner or other CUI marking?

Internal Origin:

Start from yes, work backwards
Consider common types of CUI

PII
Technical information
Network diagrams
Patent applications

Industry Expansion Solutions

One of the most challenging aspects of the CUI program is the minimal guidance surrounding CUI identification
Although the CUI registry is available, it contains less than ample information for each category
So how do you identify CUI?
The answer is layered:

First- always look for CUI banners/marking (remember the burden is on the authorized holder of CUI at creation to label it as such!)
Next- look for any specific mention of CUI in a contract, proposal, RFP- remember the burden is on the DoD or Prime to identify
When evaluating your own network, start with the assumption the answer is, “yes I have CUI” and work backwards to determine if the answer might be no
If you are currently engaged in defense work or plan to bid on this work, many common data types you likely already store/process/transmit are considered CUI, such as:

PII, technical information, network diagrams and information, financial information, visa status, patent applications, health data, and much more. It would be hard to run a business without one or more of these items on your network, so the safe starting point is assuming you DO have CUI, and not the other way around.

12 of 20

Examples of CUI

DFARS compliance applies to any business that collects, stores, or transmits CUI on behalf of the DoD. Some examples include:
Privacy data

Personally Identifiable Information (PII)
Protected Health Information (PHI)
Financial records

DoD CUI

Contract information

Research/engineering data

Proprietary technical information about tools or engineering solutions

Technical reports
Technical data sets

Computer software code and programs
Critical infrastructure data

Power grid
Communications networks

Cutting edge technology

Stealth
Weapons systems
Components of technology

Industry Expansion Solutions

13 of 20

Labeling CUI

NIST 800-171 and Cybersecurity Maturity Model Certification require Department of Defense (DoD) contractors to “mark media with necessary CUI markings and distribution”
Paper documents must be marked with a Banner Marking and a CUI Designation Indicator. Agencies may choose to use Portion Markings
Storage media (CDs, DVDs, Flash Drives, etc.) must be marked as CUI and include CUI Designation Indicator (which agency determined it to be CUI)

Industry Expansion Solutions

14 of 20

Reducing CUI Burden- Less CUI, Less Work

Although CUI may be inevitable as part of Federal contracting, it should be minimized whenever possible:

Use traditional mail (postal service) instead of email for “one-off” communication
Request that prime contractors deliver only required information (nothing more than is needed to complete the job)
Decommission CUI when it is no longer in use
Keep CUI on work devices, and keep the work network segmented from the internet if possible

Industry Expansion Solutions

While the goal should be to prioritize protection, there are ways to reduce the burden of protection by reducing the amount of CUI you encounter

Rather than emailing large amounts of CUI, in some instances, a one-off physical transfer may suffice. Reducing the number of systems and users involved
Always request that a Prime contractor provide only required CUI, and avoid processing, storing, or transmitting CUI that is out of scope for your involvement in the project
Reduce CUI protection burden by properly decommissioning CUI when no longer required. This includes both physical as well as electronic data
Refrain from using personal devices and physical locations to store CUI. Segment networks, delete unused accounts, and regularly evaluate the number of users who have access to locations containing CUI, both electronically and physically

15 of 20

The Bottom Line

All DoD contractors will eventually be required to obtain a CMMC 2 certification (timeline is fluid)
Protecting CUI is your responsibility, audits will be conducted (changes to CMMC will dictate who is audited)
Contracts are the first place to check for CUI requirements, the originator of CUI is responsible for labeling as such
CUI requirements will change over time, manufacturers should be looking for updates
In the end, defending your business and data isn’t just a government mandate, it is a cornerstone of a well run company in 2021!

Industry Expansion Solutions

16 of 20

Free Online CUI Course

Intro level course
Designed by IES
Free to all
Focus on DoD contractors
No login required
Demo!

Industry Expansion Solutions

17 of 20

Ask An Expert

Meet Our Expert: Laura Rodgers

Leading member of the NCMBC’s business development team
Identifies federal prime and subcontracting opportunities
Identifies and notifies companies of these opportunities
Provides one-on-one assistance to help companies bid on and win contracts
Hosts free cyber chat/workshops for NC businesses looking for cybersecurity/compliance information and support

The North Carolina Military Business Center (NCMBC) is a statewide business development and technology transition entity of the State of North Carolina, headquartered at and supported by Fayetteville Technical Community College (FTCC). The mission of the NCMBC is to leverage military and other federal business opportunities to expand the economy, grow jobs and improve quality of life in North Carolina

Industry Expansion Solutions

18 of 20

NCMBC Resources

Free Resources

Courses
Blog
Cyber Chats
DFARS/CMMC training and updates
In a Box solutions

Experts with military/cyber expertise and experience
NCMBC Website

Industry Expansion Solutions

19 of 20

Q&A

Industry Expansion Solutions

20 of 20

Industry Expansion Solutions