Controlled Unclassified Information (CUI)

Controlled Unclassified Information, or CUI, is a category of U.S. Government information that requires safeguarding under specific security standards to prevent its public release and limit its distribution to only those with a lawful government purpose.

These security standards are set forth by the National Institutes of Standards and Technology (NIST) in NIST Special Publication 800-171.

CUI may be identified by clear markings/labels that alert recipients that special handling may be required to comply with law, regulation, or Government-wide policy.

USU’s Research Enclave is a CMMC Level 2-compliant virtual environment for handling Controlled Unclassified Information (CUI) and other federally governed sensitive data under NIST SP 800-171 security controls. The Enclave is open to USU researchers on sponsored awards from DoW and its subagencies, NASA, and other federal sponsors that impose CUI, CMMC Level 2, or equivalent NIST SP 800-171 requirements. Projects governed by federal data access agreements may also qualify (for example, NIH controlled-access data such as the ABCD Study), as may export-controlled projects where ITAR or EAR requirements necessitate a Technology Control Plan (TCP) and a secure environment for controlled technical data.

The Enclave is a virtual-only environment—there is no physical CUI space at USU. It is delivered as a cloud-hosted Windows 11 virtual desktop. Because of this, USU can only currently support projects where CUI resides exclusively within the Enclave’s virtual boundary and is generally Windows 11-compatible. Projects that require CUI to interact with external equipment, or to exist in physical form, are not currently compatible with USU's resources. Software and compute requirements beyond a standard session, including a Linux environment, are considered through an accommodation review rather than ruling out the Enclave.

Not always. The Enclave is a virtual desktop, so it fits projects whose restricted data can stay on a screen.

Work that requires CUI on paper or physical media, CUI loaded onto instruments or test equipment, or physical deliverables returned to a sponsor would require a physical CUI space, which USU does not currently operate. Software or compute that will not run on a standard Windows 11 desktop is handled separately through an accommodation review and does not by itself rule out the Enclave.

The guide “Determining Project Compatibility with the USU Research Enclave” walks through these questions and includes a short checklist to bring to the Office of Research.

CMMC, short for Cybersecurity Maturity Model Certification, is the Department of War’s framework for handling sensitive contract and research information.

CMMC certifications encompass three levels. USU is presently self-certified at CMMC Level 2, which encompasses the U.S. government’s requirements for housing or transmitting CUI.

While not explicitly considered CUI, National Institutes of Health (NIH) controlled-access data, like CUI, requires adherence to the standards in NIST SP 800-171. For more information, see the NIH Security Best Practices for Users of Controlled-Access Data.

CUI is most common in projects sponsored by the Department of War (DoW) and its branches and subagencies, such as the U.S. Air Force or DARPA. CUI is also a feature of certain NASA awards.

Controlled Technical Information (CTI), referenced in some DoW projects, is a form of CUI.

In order for a researcher to work with CUI on DoW projects, the DoW requires that the researcher's institution be compliant with Level 2 of its Cybersecurity Maturity Model Certification (CMMC) Program. CMMC Level 2 aligns with the controls outlined in NIST SP 800-171.

Beyond DoW and NASA, the Office of Research expects that more federal agencies will soon begin to use the CUI label to designate certain sensitive research data.

While not explicitly considered CUI, National Institutes of Health controlled-access data, as with CUI, requires adherence to the standards in NIST SP 800-171. For more information, see the NIH Security Best Practices for Users of Controlled-Access Data.

Yes. At times, federal agencies may reference any of the above CUI indicators even when the contract or subcontract does not actually feature CUI. Given USU's institutional inability to utilize CUI, it is crucial that PIs and SPO work together to confirm with the sponsor that a specific project will in fact feature CUI.

The use of USU’s network or information systems to access CUI may violate federal controls on sensitive information that could result in adverse consequences to both USU and the individual researcher.

You should immediately report any (including inadvertent) exposure to CUI that occurs on USU's network or information systems (with the exception the Space Dynamics Laboratory) to compliance@usu.edu.

When reporting the possible exposure to CUI, do not include any of the potentially sensitive data in your report.

No. Although the National Archives and Records Administration (NARA) includes export-controlled information within its CUI Registry, export-controlled information on a federal award need only be considered CUI when the sponsoring agency designates it as such. In addition, proprietary research that is not funded by the federal government, despite being subject to U.S. export control regulations, is not CUI.

Having a Technology Control Plan in place on your project does not indicate the project is also CUI compliant.

No. As with export-controlled information, although the National Archives and Records Administration (NARA) may include an information type in its CUI Registry, that information need only be considered CUI when the sponsoring agency designates it as such in its contract with researchers. While NARA is a government authority on CUI, it does not have a regulatory role, and USU PIs should reference the documentation issued by a contract’s sponsoring agency to determine CUI involvement in an award.

No. A TCP is designed to help PIs ensure compliance with export controls that apply to a specific project. While TCPs may provide for a certain level of research data security, they are not designed to ensure compliance with the NIST SP 800-171 controls for CUI.