Controlled Unclassified Information (CUI) is a relatively new requirement in all defense contracts where the Department of Defense (DoD) has determined that the information must be handled specially, to protect national security. Control of the information is not as strict as classified information where access is limited to “need to know” and each individual must have a clearance to access said data. If a defense contract requires special handling of CUI, then the contractor must adhere to the the DoD’s requirements relating to the safeguarding and handling of CUI.

In general, the information that falls into the CUI category is information that must be controlled and not disseminated as its release could be a threat to national security, although not to same level as classified information. Examples of CUI are many but frequently relate to components used in the production or maintenance of military aircraft, ships, ground vehicles, weapons systems, and critical military infrastructure.

The designation CUI was initially developed by Executive Order 13556 in 2010. While the regulations are continually being updated, at this time the latest DoD guidance on CUI is contained in DoD policy document 5200.48 (a link to this DoD publication is provided below), which describes the basic set of requirements for CUI.

Being CUI compliant, can be costly and require a level of expertise that typically does not exist within smaller defense contractors. Protecting the security of our defense industrial base (DIB) has become ever more challenging, especially as nation states advance their level of aggression and sophistication in cyberattacks as industry becomes ever more digitally dependent and interconnected. Cybersecurity is paramount in today’s world and the DoD wants to ensure that critical information is well protected from attack throughout the entire DIB, including the smallest and most vulnerable suppliers.

The proper handling of CUI by sellers is now a priority issue on every buyers’ due diligence list. If you are an owner of a smaller supplier to the DIB and considering selling your company in the next few years, please invest today in the people, processes and systems necessary to ensure compliance with the latest DoD requirements on CUI. Not only will you be doing the right thing by helping to protect your company and the United States, you will also get an excellent financial return on your investment.

Link to DoD CUI policy document:
https://www.dodcui.mil/Portals/109/Documents/Policy%20Docs/DoDI%205200.48%20CUI.pdf

Have a Great Day!

Bruce Andrews
Managing Director, Defense