Controlled Unclassified Information (CUI)

CUI Regulations

The CUI security controls must be compliant with the federal regulations specified in 32 CFR Part 2002 and by the National Archives and Records Administration (NARA), who acts as the CUI Executive Agent (EA) to oversee the federal agency CUI compliance. The most commonly encountered Federal CUI requirements and guidelines include:

National Institutes of Standards and Technology (NIST) Special Publication (SP)

• NIST SP 800-53r5 - Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 800-171r2 - Protecting CUI in Nonfederal Systems and Organizations (DoD contracts)
• NIST SP 800-171r3 - Protecting CUI in Nonfederal Systems and Organizations (Federally-sponsored grant/contracts other than DoD)
• NIST SP 800-172 - Enhanced Security Requirements for Protecting CUI: Supplement to 800-171 Rev. 2

Federal Acquisition Regulation (FAR) Security Requirements

• FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information Systems

Department of Defense Federal Acquisition Regulation (DFARS)

• DFARS 252.204-7012 - Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7020 - NIST SP-171 DoD Assessment Requirements
• DFARS 252.204-7021 - Cybersecurity Maturity Model Certification Requirements

Other requirements and guidance as directed in agency-specific regulations and certain legal documents may also apply.

"Information" as defined by the Federal CUI Program may include research data and other project information, including non-public Federal Contract Information (FCI).  FCI is normally protected in accordance with FAR 52.204-21 when a research team receives, possesses, or creates FCI in the performance of a sponsored contract.

“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems may include electronic media, non-electronic media, and physical environments.

About the Research Information Security Oversight (RISO) Program

A research project at the University of Michigan (U-M) may require implementation of CUI security controls when the Federal contract/grant contains language/clauses (e.g., FAR, DFARS, NIST SP) requiring such controls.  OVPR's Research Information Security Oversight Program (RISO) reviews the contracts during negotiations with the contract sponsor to determine which information system security clauses may apply to a given contract. 

A research project may be subject to CUI regulations if:

• It is using data acquired under a Data Use Agreement (DUA) or similar legal document, and the data is information classified by the Federal government as CUI or FCI.


• It includes information system security requirements under NIST SP 800-53r5, NIST SP 800-171r2, and/or NIST SP 800-172, even if no CUI is expected within the scope of a contract.

RISO notifies ORSP, the Principal Investigator (PI), and designated project team members (including staff maintaining relevant information systems) of the security requirements.

Required Training

The Federal CUI program requires training in several areas of CUI security. 

All project team members identified by the PI and RISO who have existing or anticipated access to CUI or to information systems containing or handling CUI must complete the U-M PEERRS Controlled Unclassified Information (CUI) Protections training in My LINC.  Failure to complete the mandatory training may result in loss of access to the affected research project.

Researcher Roles and Responsibilities

If CUI compliance is required for a research project, the PI and their unit Information Technology (IT) contact(s) will work with U-M's RISO to:

• Verify the research project will receive, possess, and/or create CUI/FCI, or is otherwise required to implement security controls based on the CUI regulations.

• Identify, with assistance from ITS-IIA and ARC-TS, the appropriate information security system/technology solution to secure and store the information.  

• Create the required system security plan (SSP) for the research project.  The SSP plan establishes the security controls, policies, and procedures the research team will follow (e.g., information access restrictions, laboratory security, etc.) to comply with CUI/FCI and other Federal requirements.

• Identify all project members to RISO that have or may have access to CUI and/or the information systems used to receive, transmit, generate, or maintain CUI for any given research project.  Any changes to a project member’s CUI access for an affected research project must be identified to RISO.

• Be available to assist with internal (U-M) and external (Federal and/or third-party) security audits of CUI and CUI -designated information systems under their purview for any given contract/award.

• Complete the required training, and renew that training, as appropriate.  

Program Monitoring

U-M's RISO program is monitored by the U-M CUI Governance Committee.  The Committee issues policies, coordinates issues, coordinates solutions, approves system security plans (when applicable), ensures all affected research projects are in compliance with federal CUI/FCI rules, and continually monitors the effectiveness of the program.