Abstract: This article covers the differences between the various types of sensitive information with respect to the Cybersecurity Maturity Model Certification. This article begins with going over the basics of sensitive information before moving into more complex topics. The basic information will cover what sensitive information is, the difference between different types of information, and how they are designated. The more advanced topics covers areas related to access along with their stipulations using official documentation pertaining to CMMC.
Identification of Sensitive Information………………….. 1
What is Considered Sensitive Information?…………………… 1
Federal Contract Information (FCI) & Controlled Unclassified Information (CUI)……………….. 2
Example: FCI That Is Not CUI………………………. 2
What CUI Includes……………………. 3
How CUI Is Designated……………………. 3
CUI Basic vs CUI Specific………………………….. 3
Who Is Allowed to Access the Information?…………………………. 4
Using Dissemination Controls……………………….. 4
DoDI 5200.48 and Authorized Holders…………………………….. 4
Access Decision Criteria………………………….. 4
One of the main reasons CMMC was created is to protect sensitive information and ensure compliance with DoD security regulations. But to protect sensitive information, first you must know what sensitive information includes and how to identify it. The National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, defines sensitive information as:
Information where the loss, misuse, or unauthorized access or modification could adversely affect the national interest or the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act); that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept classified in the interest of national defense or foreign policy. (NIST Joint Task Force, 2013)
In short terms, this definition means that even if information is not labeled as classified under the Federal Government, it may still be considered sensitive if its release could have a negative effect on national security or federal operations.
There are several types of sensitive information that fall under the scope of the CMMC. The first type of information that CMMC aims to protect is Federal Contract Information (FCI). As described in Title 48 of the Code of Federal Regulations (48 CFR), FCI is defined as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government” (48 CFR 52.204-21, n.d.). Overall, FCI is the broadest definition of the information that requires protection. FCI does not involve any information that is available to the public. If the information is intentionally public in any way by the government, it is not and cannot be considered as FCI. As this is any information not intended for public release, this involves all DoD contracts. This means that if an organization accepts a contract from the DoD, then they will at least need some level of CMMC. This means that any organization that is currently or plans to accept a contract from the DoD will at least need to achieve certification under Level 1 of the CMMC.
Controlled Unclassified Information (CUI) is the second type of information CMMC aims to protect. NIST Special Publication 800-171 Revision 3 defines CUI as “information that law, regulation, or governmentwide policy requires to have safeguarding or disseminating controls” (Ross and Pillitteri, 2024). While all CUI is FCI, not all FCI is CUI. A square is always a rectangle, but a rectangle is not always a square. In the context of CMMC, one example is a DoD technical drawing of a weapons system marked as Controlled Technical Information (CTI) and shared with a contractor during contract initiation. Because the information is included in the contract, it is considered FCI. It is also CUI because it is marked as CTI, meaning it requires additional safeguarding under CUI rules.
An invoice submitted for payment by a federal contractor is an example of information that may be FCI but not CUI. It is FCI because it is generated in support of a federal contract and is not intended for public release. However, it is not CUI unless it contains information that requires special handling or safeguarding.
CUI generally includes technical information related to design, performance, manufacturing, or operation of covered systems. In simpler terms, CUI includes government-created, government-possessed, or government-related information that must be protected from unauthorized access, use, or disclosure.
Examples of CUI include:
CUI may be identified in two ways. First, information may inherently qualify as CUI because it meets the definition and description of a CUI category as defined by the National Archives CUI Registry. Second, information may be designated as CUI by an authorized holder. An authorized holder is an organization or individual that has been granted permission to access, handle, or use CUI, typically through a contract.
Controlled Unclassified Information (CUI) is categorized as either CUI Basic or CUI Specified. Both are CUI, but they may have different handling and dissemination requirements. These requirements are guided by CUI Notices, which define what qualifies as CUI and how it must be handled. CUI Notices are created and managed by the National Archives and Records Administration (NARA) and its Information Security Oversight Office (ISOO). ISOO also maintains the CUI Registry, which lists CUI categories, subcategories, marking rules, dissemination controls, change logs, and related policy guidance.
Using ISOO CUI categories, federal agencies determine whether information belongs in a CUI category and apply the appropriate markings. DoD contractors generally do not mark original CUI shared with them, but they must mark any CUI they create or transfer into another document under their control.
The NARA CUI Registry includes 20 organizational index groupings for CUI Specified, including Defense and Export Control. For example, the Defense grouping includes Controlled Technical Information (CTI), defined as “technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination” (252.204-7012, n.d.). Technical information is not automatically CTI unless ISOO identifies it as such or it is marked accordingly. CUI Basic is broader and includes CUI that is not assigned to a specific CUI Specified category. In practice, most CUI encountered will be CUI Basic unless marked otherwise. Questions about whether or how information should be safeguarded should be directed to the prime contractor or, if you are the prime, to the contracting officer.
After sensitive information is collected and marked, the organization should identify the dissemination controls that apply, especially for CUI. These controls indicate broad groups that may receive or view the information. However, they do not determine every individual who should have access. Organizations must also make a risk-based decision about who needs access, both inside and outside the organization.
The main DoD policy for protecting CUI is DoD Instruction 5200.48, Controlled Unclassified Information (CUI). This instruction establishes the DoD CUI program, including policy, responsibilities, identification, handling, storage, marking, sharing, and transmission requirements. Its purpose is to “establishes policy, assigns responsibility, and prescribes procedures for CUI throughout the DoD” (DoDI 5200.48, 2020).
DoDI 5200.48 also explains the role of the authorized holder. The authorized holder is responsible for determining whether information qualifies as CUI when it is created, deciding whether it falls under a CUI Specified category, and applying the proper markings and dissemination instructions.
The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly. (DoDI 5200.48, 2020)
However, DoDI 5200.48 does not provide a fixed list of who may access CUI besides a lawful government purpose. A lawful government purpose is defined in 32 CFR 2002.4 as “any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes as within the scope of its legal authorities or the legal authorities of non-executive branch entities (such as state and local law enforcement)” (32 CFR 2002.4, n.d.).
Before sharing or transmitting CUI, the authorized holder should confirm that the recipient:
In practice, access to CUI should be based on a risk-based decision by the authorized holder, supported by dissemination controls, lawful government purpose, and a reasonable expectation that the recipient can safeguard the information appropriately.
This not only applies to sharing or transmitting CUI with external individuals or organizations but internally as well. When deciding who within your own organization should have access, the principle of least privilege or minimum access should be applied. Meaning that employees should be granted access only to the information required to perform their job responsibilities. You should also take into account that if access is needed only for a limited period, it should be granted only for that duration. Regardless of the length of access, employees must still meet the organization’s established access authorization criteria.
Sharing or transmitting CUI within your organization also means where that information is stored, processed, and transmitted. CUI should be kept as limited as possible throughout your environment, both horizontally and vertically, to reduce the size of your system boundary while maintaining operational efficiency. Finding a balance between restricting CUI’s movement and maintaining operational efficiency not only makes managing CUI easier but also reduces the scope of your CMMC assessment. One of the best ways to accomplish this is by creating a network diagram that shows how CUI moves through your environment and helps define where your CMMC system boundary should begin and end.
BTI has been assisting organizations implement, comply with, and be measured against government standards, including cybersecurity standards. We have helped organizations for over 21 years with:
BTI has directly assisted the government in implementing these standards for some of the government’s most sensitive programs. BTI has been certified multiple times by the government itself through the Defense Industrial Base Cybersecurity Assessment Center. We have the knowledge, skills, and tools to help anyone implement cybersecurity efficiently, cost-effectively while helping companies maintain their operations and competitive advantage.
