ALGORITHMIC WARFARE: CUI or Not CUI? That Is the Question
A major source of confusion as industry prepares for implementation of the Defense Department’s Cybersecurity Maturity Model Certification program is the nature of controlled unclassified information. A recent proposed rule seeks to standardize how government agencies identify this type of information in contracts.
Controlled unclassified information, or CUI, is a broad category of information that a law, regulation or government-wide policy requires agencies and contractors to handle using dedicated safeguards or dissemination controls.
The Defense Department, along with the General Services Administration and NASA, on Jan. 15 released a proposed rule to revise the Federal Acquisition Regulation to implement the National Archives and Records Administration’s federal CUI program as it relates to performance under federal contracts.
In the proposed rule, the agencies introduced a new standard form to be included in solicitations and contracts that will “enable a uniform process for communicating the information contractors must manage and safeguard as well as identify where a CUI incident must be reported.”
“Currently laws, federal regulations and government-wide policies already mandate these protections, but there is not a standard way these requirements are identified and shared with contractors,” the proposed rule stated.