Protecting CUI Nonfederal Organizations

Last Updated on January 19, 2024

Got Hardcopy CUI? NIST SP 800-171 Requirements Apply.

Prime contractors have been flowing down the DFARS 252.204-7012 clause, “Safeguarding Covered Defense Information and Cyber Incident Reporting” (aka DFARS 7012) for years. Many primes have received the DFARS 7012 clause from other primary contract owners. The focus has been protecting the confidentiality of Controlled Unclassified Information (CUI) while the restricted information resides within the prime’s information system boundaries.

Some primes have sought to enhance their supply chain risk management by ensuring their suppliers adhere to a set of controls or meet an acceptable level of cyber hygiene before sharing CUI with them. If the supplier’s cyber risk is too high, some primes strategically only share hardcopies of CUI. This ensures suppliers’ IT networks are out of scope for CUI… right?

Maybe. But even hardcopy CUI must be protected per NIST Special Publication 800-171 requirements. The applicable security requirements may go well beyond Section 3.10 Physical Protection.

Hardcopy CUI is still CUI

NIST SP 800-171 provides nonfederal organizations with recommended security best practices for protecting the confidentiality of CUI when the information is within the contractors’ operating environment, or those of its subcontractors. Having only hardcopy of CUI does not relieve contractors and subcontractors from meeting the applicable NIST SP 800-171 security requirements. Additionally, having only hardcopy CUI does not negate the need for a system security plan (SSP).

Sharing CUI via conventional postal delivery services is one of the many strategies leveraged by prime contractors and the defense supply chain. The idea is to reduce the risk of unauthorized disclosure if the subcontractor does not meet the prime’s security posture, or to further reduce a supplier’s potential financial impact and other burdens in the event of a data breach or compliance issue involving CUI.

However, the responsibility to safeguard CUI is not limited to nonfederal IT information systems; it includes nonfederal organizations, the physical boundary defined by the contractor/subcontractor, and the controlled environment. The NIST Glossary defines information systems as “a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.”

It’s about the overall CUI controlled environment

Hardcopies of CUI, as well as the personnel collecting, creating, editing, distributing, or destroying of that dataset are all considered asset types that may be within the scope of the subcontractor’s CUI operating environment or controlled environment. The CUI program defines the CUI controlled environment as “any space or area with adequate physical or procedural controls to limit unauthorized access to CUI.”

Some of the obvious NIST 800-171 security requirement families that apply to this use case include but are not limited to Access Control, Physical Protection, and Media Protection. Besides these, there are potentially a number of not-so-obvious additional requirements that could apply in your situation (see table below).

Summary of applicable NIST 800-171 requirements

The following summary and accompanying table of NIST 800-171 requirements are tailored to help nonfederal organizations safeguard any hardcopy CUI they may process, store or transmit on behalf of prime contractors and the US Department of Defense (DoD).

If the organization converts the CUI hard copies into digital format, then the organization must meet all application security requirements listed within NIST SP 800-171.

Here’s a summary of how the security requirements apply, in accordance with the CMMC Level 2 Assessment Guide:

• Risk Assessments and Vulnerability Remediation: Any newly established or enhanced CUI program should include a risk assessment to help identify the mission, operations, regulatory, and contractual risk associated with the in-scope assets and individuals affected by the potential change. Receiving CUI via traditional mail is not different. Organizations need to define, manage, and/or remediate the associated risks.
• Authorized Access Control, Control CUI Flow, Privacy and Security Notice, Mobile Device Connection, Control Public Information, and Access Restriction to Change: Limiting physical access to CUI is key. As such, establishing a controlled environment and physical access control mechanisms are critical to controlling the flow of CUI and to successfully running any CUI program. Controlling the flow of CUI may include prohibiting mobile devices from capturing audio, recording video, or taking pictures in your CUI controlled environment.
• Media Protection, Markings, and Accountability: As part of controlling the flow of CUI, the hardcopy of CUI is a core practice element. The contractor/subcontractor must handle CUI in accordance with its marking. If reproduced, then the contractor has to ensure personnel handle it in accordance with its sensitivity. The contractor may also need to inventory hardcopy of CUI and maintain audit logs of who is authorized access to the controlled environment. Lastly, contractors must ensure their end users dispose of CUI following authorized destruction methods, and only once it has served its purpose.
• Physical Protection, Limit Physical Access, Escort Visitors, Physical Access Log, Alternate Worksite, and Monitor: Once the physical controlled environment has been defined, the contractor/subcontractor must limit, control, and monitor access to this environment. If end users are allowed to work from home, and/or transport CUI outside the controlled environment, the contractor must ensure these users are made aware of their responsibility with the restricted data and these users must be identified in an access-controlled list.
• Awareness and Training, Security Plan, Security Control Assessment, and Controls Monitoring: Contractors/Subcontractors must train their users on how to handle CUI. Similarly, personnel performing physical security activities must be trained on how to properly achieve the organizational security goals surrounding CUI. In short, everyone with direct and indirect access to the controlled environment is responsible for understanding their role and responsibility and for helping achieve the organizations’ objectives, securely. The System Security Plan (SSP) is the document that defines the CUI controlled environment and describes how the applicable controls have been implemented. Contractors must continuously monitor and periodically assess the controls’ effectiveness, and document any identified gaps/improvement opportunities within a POA&M.

Reference table: Subset of NIST SP 800-171 security requirements potentially applicable to hardcopy CUI

Next steps

Need to meet CMMC or other CUI compliance requirements? Contact PPS’ Federal Risk and Compliance Practice for assistance establishing, expanding, or managing your CUI program.