CUI PROGRAM DEVELOPMENT
DEFENSE. SECURITY. CONTROL.
Per the Defense Counterintelligence and Security Agency, Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or dissemination controls consistent with applicable laws, regulations, and Government-wide policies but is not classified under Executive Order 13526 "Classified National Security Information" or the Atomic Energy Act, as amended.
Federal agencies and federal contractors supporting such agencies to have in place a structured CUI Program, one that includes measures for identifying, marking, sharing/transmitting, protecting, storing/transporting, decontrolling, reproducing, and destroying CUI. Additionally, measures are to be in place for reporting incidents relating to CUI. Metis Defense can help your organization build and implement a well-rounded CUI Program from the ground up.
Our CUI Program Development Includes the Following Measures:
1. Identifying CUI: We’ll work with your organization in identifying what is considered CUI in your environment. Examples of CUI include the following:
CONTROLLED TECHNICAL INFORMATION (CTI)
-
Provided by a confidential source (person, commercial business, or foreign government) on condition it would not be release
-
Related to contractor proprietary or source selection data
-
That could compromise Government missions or interests
PERSONALLY IDENTIFIABLE INFORMATION (PII)
-
Personally Identifiable Information (PII) is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. PII includes, but is not limited to:
-
Social Security Number, Date and Place of Birth
-
Mother’s Maiden Name
-
Biometric Records, Protected Health Information
-
Passport number
PROTECTED HEALTH INFORMATION (PHI)
-
Is a subset of PII requiring additional protection
-
Is health information that identifies the individual
-
Is created or received by a healthcare provider, health plan, or employer, or a business associate of these
Relates to:
-
Physical or mental health of an individual
-
Provision of healthcare to an individual
-
Payment for the provision of healthcare to an individual
2. Marking, Protecting, Controlling and Disposal: We can assist with the mandatory marking for all DOD CUI is the CUI Banner/Footer with the CUI Designation Indicator (DI) Block. This is the main marking that appears at the top and bottom of all documents containing CUI. Additionally, Metis Defense can help in developing policies and procedures for protecting and disposing of CUI.
3. Incident Response: We can assist in developing incident response measures should an issue arise with the safeguarding and handling of CUI. Note, per DCSA: You must report all known or suspected CUI incidents to your supervisor and/or security manager as soon as you become aware of a possible CUI incident. A CUI incident can come in many different forms. Examples include:
Finding papers with CUI markings left unattended
Knowing information in a document or system is CUI but is not marked properly
Emailing unencrypted CUI outside of your network.
TRUSTED
Trusted Advisors to both Federal Agencies and Federal Contractors
RESPECTED
Well-known and Respected Throughout the Federal Agency Apparatus
UNIQUE
A Unique Combination of Knowledge, Expertise, and Capable Manpower
