Core service · Government & Defense · Controlled Unclassified Information (NIST SP 800-171)
Issued by
NIST / US Department of Defense
Typical timeline
3-9 months
Assessed by
Self-assessment / CMMC
Validity
Ongoing obligation
Overview
Who needs CUI?
- 01Defense contractors and subcontractors handling CUI
- 02Universities and research labs on federal contracts
- 03Manufacturers receiving controlled technical drawings
Requirements
What the auditor looks for.
- 01CUI identificationKnowing which information is CUI, how it is marked, and where it flows through your systems.
- 02NIST SP 800-171The security requirements for protecting CUI in contractor systems; the 110 requirements of Rev. 2 are what CMMC Level 2 assesses.
- 03System Security PlanHow each requirement is met, for every system that stores, processes or transmits CUI.
- 04Incident reportingCyber incidents affecting covered defense information reported to the DoD within 72 hours under DFARS 252.204-7012.
- 05Cloud servicesCloud services holding covered defense information must meet the FedRAMP Moderate baseline or equivalent.
- 06Flow-downThe same requirements passed on to subcontractors who handle CUI.
Our approach
From scoping to auditor sign-off.
FAQ
Questions, answered.
The CUI rules are the requirements; CMMC is how the DoD verifies that you meet them. Getting your CUI program right is most of the work toward CMMC Level 2.
Typical timeline: 3-9 months, depending on scope, maturity and team availability. We'll give you a firm plan after a two-week scoping and gap assessment.
Yes, that's our specialty. CUI shares substantial control overlap with CMMC and ITAR, so we build one control set and map evidence across all of them.
Next framework
NIST 800-53
End of the thread
A 30-minute call with a senior practitioner. You leave with a plan either way.
We handle audit readiness and auditor coordination. Your SOC reports and ISO certificates are always issued by independent, accredited auditors.