In the modern world it is easy to see how information became the most important resource out there, since the overwhelming majority of companies would be under the threat of shutting down completely if their data somehow gets corrupted or stolen. However, that\u2019s not to say that this principle only applies to commercial companies.<\/p>\n\n\n\n
Governments are a great example of that, having a wealth of incredibly sensitive information in all shapes and forms \u2013 data that no one but a specific group of people should be able to see in the first place. As such, it is fairly common to see governments issuing data security standards to make sure that both the government itself and companies that work with it as contractors know how to handle this kind of sensitive information.<\/p>\n\n\n\n
The Department of Defense is one such government structure, issuing standards in terms of handling CUI (Controlled Unclassified Information) for its Defense contractors. The origin of this kind of approach to sensitive information as a whole can be traced back to DFARS 252.204-7012 (Defense Federal Acquisition Regulation Supplement), which has been effective since 2017, and has been expanded upon with newer standards multiple times.<\/p>\n\n\n\n
CUI itself is information that is either owned or created by the government itself \u2013 if that information has safety or disposal requirements in accordance with laws or regulations. These regulations and policies include the aforementioned DFARS clause 252.204-7012, as well as ITAR (International Traffic in Arms Regulations), CMMC 2.0 (Cybersecurity Maturity Model Certification) and NIST 800-171 (National Institute of Standards and Technology).<\/p>\n\n\n\n
The idea behind these standards and the concept of CUI is that there can be some information that is not classified on its own \u2013 but it has an extremely high level of sensitivity, being extremely valuable for national security interests and sought out by various adversaries and competitors. The goal of CUI as a policy is to make one unified standard for marking this information type throughout the entire Federal Government \u2013 since right now there are quite a lot of markings that are specific to just one agency, such as SBU, LES, FOUO, and so on.<\/p>\n\n\n\n