CUI and Zero-CUI practices for teaming and capture

Controlled Unclassified Information (CUI) is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation or Government-wide policy requires or permits to be handled with safeguarding or dissemination controls (32 CFR 2002.4). It is not classified information, but it is not public either. For defense contractors, CUI is the reason NIST SP 800-171, DFARS 252.204-7012 and CMMC Level 2 exist, and it shapes how you can share information with teaming partners and which tools you can use during capture.

CUI and FCI are not the same#

The executive-branch CUI program comes from Executive Order 13556 and 32 CFR Part 2002, and the National Archives maintains the CUI Registry of categories. Some categories are CUI Specified, which carry extra handling rules from their underlying law; the rest are CUI Basic. DoD contracts usually describe CUI through DFARS 252.204-7012's term covered defense information: CUI that is marked or otherwise identified in the contract and provided by or for DoD, or that you collect, develop, receive, transmit, use or store in support of performing the contract.

What DFARS 252.204-7012 requires#

When the clause is in your contract and you handle covered defense information, you must:

• Provide adequate security, including implementing NIST SP 800-171 on covered contractor information systems
• Report cyber incidents to DoD within 72 hours of discovery, which requires a DoD-approved medium assurance certificate
• Preserve images of affected systems and relevant monitoring data for at least 90 days after reporting, and submit malicious software you find
• Ensure that any external cloud service provider storing, processing or transmitting covered defense information meets security requirements equivalent to the FedRAMP Moderate baseline and the clause's incident requirements
• Flow the clause down to subcontractors whose performance will involve covered defense information

DFARS 252.204-7019 and 252.204-7020 add the requirement for a current NIST SP 800-171 assessment in SPRS (see assessment currency), and CMMC adds third-party or Government assessment where the contract requires it (see CMMC 2.0).

CUI in teaming and capture#

Most capture work does not need CUI, but some pursuits touch it:

• Solicitation attachments. Some solicitations release technical data packages or other controlled attachments only to eligible offerors, for example contractors certified under the Joint Certification Program (DD Form 2345) for export-controlled military technical data.
• Incumbent and program details. Program documentation you saw on another contract is not yours to reuse in a proposal or share with partners.
• Partner collaboration. Solution development with partners can drift into controlled technical detail.

The rules are the same as in performance: share CUI only for a lawful Government purpose, only with people and organizations authorized to receive it, and only through systems that meet the required protections. A non-disclosure agreement protects proprietary information; it does not authorize anyone to receive CUI or export-controlled technical data. Export-controlled technical data adds ITAR or EAR licensing questions on top (see ITAR and EAR).

Zero-CUI practices for capture teams#

Common pitfalls#

• Pasting controlled attachments into email or consumer AI tools. Neither is authorized for CUI by default, and the cloud requirements of DFARS 252.204-7012 apply wherever covered defense information goes.
• Treating an NDA as permission. It is not.
• Over-marking. Marking everything as CUI makes real CUI harder to protect and partners harder to work with. Follow the Registry and the contract.
• Forgetting subcontractors. If a partner will handle covered defense information, its systems need the same protections as yours.

How TeamingIndex helps#

• TeamingIndex is a Zero-CUI platform. There are no document uploads for security artifacts: system security plans, POA&M spreadsheets, CUI-marked files and DD Form 254s are never stored. Compliance verification records only metadata such as assessor, dates and certificate identifiers.
• Every free-text field passes a guard that rejects CUI banners and portion markings, classification markings and export-control legends, so controlled text cannot be posted by accident. Read more on our security page.
• Find partners already prepared to handle CUI, for example companies with a verified CMMC Level 2 (C3PAO) status.