to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

Not federal information. Out of scope.

Your own business information is yours to protect as you see fit. Nothing in CMMC or 800-171 reaches it, though it may still be your most valuable data.

What to do

  1. Keep it out of your CUI enclave so it does not expand your assessment scope.
  2. Re-run this for any data set that touches a contract deliverable.
  3. Protect it because it matters to you, not because a clause says so.

DFARS 252.204-7012(a), definition of covered defense information.

Not the outcome you expected?

Run the worksheet again for one specific set of information, or read the other outcomes.

Whether information is CUI is the government's decision. This page sorts your situation; it does not designate anything. See FCI, CUI and CDI.