The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework establishes clear distinctions between Controlled Unclassified Information (CUI) and non-CUI information, which determines cybersecurity requirements for defense contractors.
CUI is information created or possessed by the government or entities on the government’s behalf that requires safeguarding or dissemination controls according to laws, regulations, and government-wide policies. Examples include technical specifications, engineering data, research and development information, financial details related to contracts, and controlled technical information.
Non-CUI (sometimes called Federal Contract Information or FCI) is information provided by or generated for the government under contract that is not intended for public release. While it requires basic protection, it doesn’t need the stringent controls applied to CUI.
The primary differences include:
- Protection requirements: CUI requires implementation of NIST SP 800-171 controls (Level 2 in CMMC 2.0), while non-CUI only requires basic safeguarding measures (Level 1).
- Marking and handling: CUI must be clearly identified, marked, and handled according to specific procedures, while non-CUI has minimal marking requirements.
- Storage and transmission: CUI requires encryption during transmission and secure storage, whereas non-CUI has fewer restrictions.
- Access controls: CUI access must be limited to authorized personnel with a legitimate need, while non-CUI has less restrictive access requirements.
Understanding these distinctions is crucial for compliance, as mishandling CUI can result in significant penalties, loss of contracts, and potential security breaches that impact national security.
