There’s been a lot of confusion lately around Controlled Unclassified Information (CUI), especially when it comes to distinguishing CUI Basic from CUI Specified and understanding what those markings mean for CMMC compliance. A recent wave of LinkedIn debates only added to the noise, so let’s get back to the facts.
CUI Basic vs. CUI Specified: What’s the Difference?
Not all CUI is handled equally. Understanding the distinction between CUI Basic and CUI Specified is critical.
– CUI Basic follows baseline protections under NIST SP 800-171.
– CUI Specified is subject to additional handling requirements outlined in laws, regulations, or government-wide policies.
Important: “Specified” does not mean more sensitive, it just means there are specific handling rules beyond the NIST baseline.
For example, overprotecting CUI (e.g., applying NOFORN unnecessarily) can be just as problematic as under-protecting it. Dissemination restrictions should reflect actual contract requirements, not assumptions.
Common Misconceptions in the Ecosystem
Here are some persistent misunderstandings we regularly encounter:
– Not all DoD CUI is export-controlled.
– Not all CUI requires NOFORN.
– ITAR/EAR-regulated data is outside the scope of CMMC, as confirmed in the CMMC rule (32 CFR 170).
– CUI markings alone do not dictate classification or dissemination restrictions.
Dissemination Rules Are Not Classification Rules
There’s a critical distinction between classification controls and dissemination controls.
For DoD contractors, unless your contract or data markings specify otherwise, DoD CUI is generally governed by NIST SP 800-171 protections, alongside the requirements in DFARS 252.204-7012. These include:
– Providing “adequate security” for covered defense information
– Using a FedRAMP Moderate or Equivalent cloud service provider
– Implementing NIST SP 800-171 as soon as practical
– Reporting cyber incidents within 72 hours
– Preserving incident data for 90 days in case DoD requests access
See full DFARS text here: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
Limited Dissemination Controls (LDCs)
Restrictions like NOFORN, REL TO [USA, XXX], or DISPLAY ONLY fall under what’s called Limited Dissemination Controls (LDCs). These controls apply only if explicitly required in the contract or data markings.
– NOFORN – Not releasable to foreign nationals
– REL TO [USA, XXX] – Releasable only to specified countries
– DISPLAY ONLY – May not be downloaded, copied, or printed
If your data doesn’t include these LDCs, they don’t apply.
If DISPLAY ONLY or REL TO Applies. Here’s a Solution:
When dissemination controls are part of your contract, you need to enforce access accordingly.
The Cuick Trac Managed Enclave (CTME) supports these scenarios by offering:
– End-to-end FIPS-validated encryption
– Display-only access enforcement (no copy, download, or print)
– U.S.-only data residency
In fact, under the ITAR Interim Final Rule (March 2020), properly configured environments like CTME can help avoid triggering a “deemed export.”
Need Reliable Sources? Start Here:
– NARA Registry – Limited Dissemination Controls: https://www.archives.gov/cui/registry/limited-dissemination
– DoD CUI LDC Registry: https://www.dodcui.mil/Limited-Dissemination-Controls/
– Country Trigraph Codes (PDF): https://www.archives.gov/files/cui/registry/policy-guidance/registry-documents/20161214-country-trigraph-codes.pdf
– DFARS 252.204-7012: https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
Final Takeaway
We all want to protect CUI, but when guidance gets lost in translation, the entire DIB suffers. Stay grounded in policy, not assumptions.
Written by:
George Perezdiaz
USAF-Vet | MSIT | Lead CCA | CISA | CRISC | CCSK