Do we handle CUI?

2. Read the instructions and markings

1. Sit down with the people doing the work. Read the contract, subcontract, task instructions, and customer guidance together. Check what you must deliver, including reports and other information your team creates.
2. Look at the item and its accompanying instructions. Check for CUI or CONTROLLED banners, category markings, and details about who designated the information. Older FOUO labels, distribution statements, and export warnings need a closer look. None of those labels alone tells you to relabel an item as CUI.
3. Find the rule behind the category. Read the relevant entry in the official CUI Registry alongside the customer's instructions. A matching word, file type, or category name alone does not tell you whether this particular item is CUI.
4. Write down what you cannot resolve. Name the person who will ask for an answer. Direct the question to the person or agency that supplied the information, or to the government office responsible for the contract. If you are a subcontractor, use the appropriate route through your prime contractor or customer.

NARA says to take questions about marked or unmarked information back to its originator or the government contracting activity. While you wait for an answer, keep following the protection and reporting instructions that already apply. This guide does not give you permission to change markings, remove controls, or move the information to another service. Read NARA's guidance on asking for clarification.

4. Follow where an item is stored, used and shared

Ask someone who does the work to walk you through one item. Use references you are authorized to review. Keeping a copy is storing it. Opening, viewing, editing, or creating information are examples of processing it. Sending or sharing it between people or systems is transmitting it. These examples help you follow the work; they do not decide an asset's formal assessment category.

Include files viewed in a customer portal. Even if no one clicks Download, the device may process the information or keep a cached copy. Ask IT to check what actually happens in that setup.

Made-up example with sample data: where a CUI technical package goes

1. Step 1

   Receive

   The package arrives through an approved customer portal. List the portal, the account used to receive it, and any copies downloaded or cached on a device.

2. Step 2

   Use and create

   An engineer uses an authorized workstation to open the package and create the report described in the sample instructions. List the application, workstation, and working files.

3. Step 3

   Store and copy

   The engineer saves the work in an approved restricted workspace. Check whether copies also go to synced folders, backups, exports, removable media, or a printer.

4. Step 4

   Send and retain

   The team returns the report through the approved route. List who receives it, the service used to send it, and the copies kept afterward. Record the instructions for keeping and disposing of those copies.

Ask whether the work uses email attachments, shared workspaces, chat, engineering tools, synced folders, backups, outside providers, or paper. In the log, record where authorized staff can find an item without copying its contents. Follow your approved instructions for how long to keep it and how to dispose of it.

Use this record when deciding which systems belong in an assessment. You may also need to include systems and services that provide security, even if they do not directly handle CUI. Use the Level 2 Scoping Guide to make that separate decision.

5. Record what you know and what needs an answer

Open the Excel log in your existing Office tools. Describe each information type in general terms and note where to find its instructions. Write down whether CUI has been confirmed or a question remains, who will follow up, and what they need to do. Use the Data flow tab to list the systems and services the item passes through. You enter each status yourself; the workbook does not decide it.

Do not put CUI, contracts, diagrams, credentials, or evidence contents into the template or send them to this site. Save your completed log in a restricted location your organization has approved. Its references and descriptions may also be sensitive. Before using a synced folder or online editor, check where it sends and stores the file.

Subject: Please clarify which information is CUI and how to handle it

Hello [contract or customer point of contact],

We are checking the information we receive and create for [approved contract or work reference]. We need help confirming whether [general description or restricted reference] is CUI, or which handling instructions apply.

Please answer the questions below or forward them to the appropriate government originator or office responsible for the contract.

1. Which information you supply and which deliverables we create are identified as CUI?
2. Which CUI categories apply, and which laws, regulations, or government-wide policies provide the basis for protecting the information? Please include the marking instructions and references to the contract or supporting documents.
3. Who should we ask about items with no markings, older markings, or markings that may be incorrect?
4. How should we protect and send the information while we wait for an answer?

Please reply in writing through our approved communication route. We can share restricted references through that route if you need them.

Thank you,
[authorized company contact]

Template instructions: Save and edit your copy on your computer. Replace the placeholders and send the request through your approved customer or prime-contractor route. Do not send the request, contract records, CUI, or supporting evidence to Purposeful Security. Keep meeting the protection and reporting duties that already apply while you seek an answer.

Once you have confirmed that an item is CUI, work out which systems need review and begin the readiness worksheet. If a question is still open, keep following up for an answer. If one item is not CUI, you still need to check the other information your company handles and meet your other contract duties.