CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

This one goes to your contracting officer.

You have reached the point where the answer is not yours to give. Unmarked information you suspect is CUI is a question for the person who issued the contract, and their written answer is the record that protects you.

What to do

  1. Write one short email naming the exact document, its origin, and the date you received it.
  2. Ask two questions: is this CUI, and if so what category and markings apply.
  3. Ask whether DFARS 252.204-7012 applies to this data.
  4. Until they reply, protect it as if it were CUI. Over-protecting is recoverable. Under-protecting is not.
  5. File the reply with your system security plan.

32 CFR 2002.20 on designation and marking responsibilities; DoD Instruction 5200.48.

Which category?

When you write to the contracting officer, ask them to name the category. These are the ones a defense contractor is usually told:

Every category, with NARA's definition and authorities, is in the registry. How the banner is built is in 32 CFR 2002.20.

Requirements this outcome points you to

  1. 3.12.4 Keep a system security plan CA Level 2 Not scored
  2. 3.8.4 Mark media MP Level 2 1 pt
  3. 3.1.3 Control where CUI is allowed to travel AC Level 2 1 pt

Not the outcome you expected?

Run the worksheet again for one specific set of information, or read the other outcomes.

Whether information is CUI is the government's decision. This page sorts your situation; it does not designate anything. See FCI, CUI and CDI.