Where Does CUI Enter Your Company? A Practical Way to Scope It

Before you can protect Controlled Unclassified Information (CUI), you need to know where it is. Here is a practical way to find it.

CUI comes through the contract

DFARS 252.204-7012 defines the information it protects ("covered defense information") two ways:

• Information marked or otherwise identified in the contract and provided to you by or on behalf of DoD- Information collected, developed, received, transmitted, used or stored by you or on your behalf in support of performing the contractSo CUI is not only what your customer sends you. It is also what you create from it. The clause lists examples of technical information such as engineering drawings, specifications, process sheets, manuals and technical reports. ## Check every way it reaches you Walk each path CUI can take into your company:
• Email: drawings, specs and contract documents from your customer or prime- Portals: customer and prime sites where you download files- File shares and cloud storage: where those files land after download- Files you create: process sheets, reports and other work built from CUIIf you store CUI with a cloud provider, DFARS 252.204-7012 requires that provider to meet security requirements equivalent to the FedRAMP Moderate baseline. ## Map it, then draw the line
• List every place CUI arrives.- Follow where it is stored, shared and printed.- Draw the boundary. Every system that stores, processes or transmits CUI is a covered contractor information system, and NIST SP 800-171 applies to it.Your scope decides what your CMMC work covers. A clear map keeps your System Security Plan (SSP), your self-assessment and your SPRS score tied to the systems that actually handle CUI. ## Where CMMC stands today DoD suspended the CMMC Phase 2 rollout in July 2026. CMMC Level 1 (Self) and Level 2 (Self) assessments remain, and DFARS 252.204-7012 still requires NIST SP 800-171 for systems that handle CUI. You still need to know where your CUI is. ## About Cyberneza Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance consultancy in Orlando, Florida. We map where CUI enters, where it lives and where it leaves, and build your CMMC work around that scope: https://cyberneza.com/cmmc Sources: DFARS 252.204-7012, DoD CIO CMMC resources