---
title: "CUI and Zero-CUI practices for teaming and capture"
canonical: "https://teamingindex.com/knowledge/cui-and-zero-cui-practices"
lastReviewed: "2026-11-08"
markdown_url: "https://teamingindex.com/knowledge/cui-and-zero-cui-practices.md"
topic: "CMMC & cybersecurity"
summary: "What Controlled Unclassified Information is under 32 CFR Part 2002, how it differs from FCI, what DFARS 252.204-7012 requires when you handle it, and how capture teams can work with partners and tools without spreading CUI."
---
# CUI and Zero-CUI practices for teaming and capture

> What Controlled Unclassified Information is under 32 CFR Part 2002, how it differs from FCI, what DFARS 252.204-7012 requires when you handle it, and how capture teams can work with partners and tools without spreading CUI.

- Topic: CMMC & cybersecurity
- Last reviewed: 2026-11-08
- Canonical URL: https://teamingindex.com/knowledge/cui-and-zero-cui-practices

**Controlled Unclassified Information (CUI)** is information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation or Government-wide policy requires or permits to be handled with safeguarding or dissemination controls (**32 CFR 2002.4**). It is not classified information, but it is not public either. For defense contractors, CUI is the reason NIST SP 800-171, DFARS 252.204-7012 and CMMC Level 2 exist, and it shapes how you can share information with teaming partners and which tools you can use during capture.

## CUI and FCI are not the same

| | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| --- | --- | --- |
| What it is | Information not intended for public release that is provided by or generated for the Government under a contract, other than public or simple transactional information (FAR 52.204-21) | Information in a category of the CUI Registry that law, regulation or Government-wide policy says must be controlled (32 CFR Part 2002) |
| Baseline protection | The 15 basic safeguarding requirements in FAR 52.204-21 | NIST SP 800-171 for covered contractor information systems (DFARS 252.204-7012) |
| CMMC level | Level 1 | Level 2, or Level 3 for some high-priority programs |

The executive-branch CUI program comes from Executive Order 13556 and 32 CFR Part 2002, and the National Archives maintains the **CUI Registry** of categories. Some categories are **CUI Specified**, which carry extra handling rules from their underlying law; the rest are **CUI Basic**. DoD contracts usually describe CUI through DFARS 252.204-7012's term **covered defense information**: CUI that is marked or otherwise identified in the contract and provided by or for DoD, or that you collect, develop, receive, transmit, use or store in support of performing the contract.

> **Watch out:** "Not marked" does not always mean "not CUI." Information you develop in performance can be covered defense information if the contract identifies it, and older documents may carry legacy markings. When in doubt, ask the contracting officer how the information should be handled before you share it.

## What DFARS 252.204-7012 requires

When the clause is in your contract and you handle covered defense information, you must:

- Provide **adequate security**, including implementing NIST SP 800-171 on covered contractor information systems
- **Report cyber incidents** to DoD within 72 hours of discovery, which requires a DoD-approved medium assurance certificate
- **Preserve images** of affected systems and relevant monitoring data for at least 90 days after reporting, and submit malicious software you find
- Ensure that any **external cloud service provider** storing, processing or transmitting covered defense information meets security requirements equivalent to the **FedRAMP Moderate** baseline and the clause's incident requirements
- **Flow the clause down** to subcontractors whose performance will involve covered defense information

DFARS 252.204-7019 and 252.204-7020 add the requirement for a current NIST SP 800-171 assessment in SPRS (see [assessment currency](https://teamingindex.com/knowledge/dfars-252-204-7019-assessment-currency)), and CMMC adds third-party or Government assessment where the contract requires it (see [CMMC 2.0](https://teamingindex.com/knowledge/cmmc-2-0-overview)).

## CUI in teaming and capture

Most capture work does not need CUI, but some pursuits touch it:

- **Solicitation attachments.** Some solicitations release technical data packages or other controlled attachments only to eligible offerors, for example contractors certified under the Joint Certification Program (DD Form 2345) for export-controlled military technical data.
- **Incumbent and program details.** Program documentation you saw on another contract is not yours to reuse in a proposal or share with partners.
- **Partner collaboration.** Solution development with partners can drift into controlled technical detail.

The rules are the same as in performance: share CUI only for a lawful Government purpose, only with people and organizations authorized to receive it, and only through systems that meet the required protections. A **non-disclosure agreement protects proprietary information; it does not authorize anyone to receive CUI** or export-controlled technical data. Export-controlled technical data adds ITAR or EAR licensing questions on top (see [ITAR and EAR](https://teamingindex.com/knowledge/itar-and-ear-export-controls)).

## Zero-CUI practices for capture teams

- [ ] Keep directories, CRM systems, shared drives, chat, email and AI tools used for capture free of CUI unless they are authorized for it
- [ ] Describe experience at the level of public facts: customer, scope, size and results, not controlled program details
- [ ] Before a partner receives CUI, confirm the subcontract flows down DFARS 252.204-7012 and the partner's NIST SP 800-171 assessment and CMMC status meet the requirement
- [ ] Use only the Government's distribution channels for controlled solicitation attachments, and keep them inside authorized systems
- [ ] Keep markings intact on anything derived from CUI, and follow your contract's procedures if CUI ends up somewhere it should not be
- [ ] Train capture and proposal staff, not just engineers, to recognize CUI and its markings

## Common pitfalls

- **Pasting controlled attachments into email or consumer AI tools.** Neither is authorized for CUI by default, and the cloud requirements of DFARS 252.204-7012 apply wherever covered defense information goes.
- **Treating an NDA as permission.** It is not.
- **Over-marking.** Marking everything as CUI makes real CUI harder to protect and partners harder to work with. Follow the Registry and the contract.
- **Forgetting subcontractors.** If a partner will handle covered defense information, its systems need the same protections as yours.

## How TeamingIndex helps

- TeamingIndex is a **Zero-CUI platform**. There are no document uploads for security artifacts: system security plans, POA&M spreadsheets, CUI-marked files and DD Form 254s are never stored. Compliance verification records only metadata such as assessor, dates and certificate identifiers.
- Every free-text field passes a guard that rejects CUI banners and portion markings, classification markings and export-control legends, so controlled text cannot be posted by accident. Read more on [our security page](https://teamingindex.com/security).
- Find partners already prepared to handle CUI, for example [companies with a verified CMMC Level 2 (C3PAO) status](https://teamingindex.com/directory?cmmc=L2C3PAO&verified=1).

## Official sources

- [32 CFR Part 2002: Controlled Unclassified Information](https://www.ecfr.gov/current/title-32/part-2002)
- [DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting](https://www.ecfr.gov/current/title-48/section-252.204-7012)
- [FAR 52.204-21: Basic Safeguarding of Covered Contractor Information Systems](https://www.acquisition.gov/far/52.204-21)
- [32 CFR Part 170: CMMC Program](https://www.ecfr.gov/current/title-32/part-170)
- [DoD CIO: Cybersecurity Maturity Model Certification](https://dodcio.defense.gov/CMMC/)

Not legal advice. TeamingIndex guides are general information to help you plan, not legal advice. Regulations, clauses and program rules change and solicitations can tailor them: always work from the current regulation and the clauses in your solicitation, and confirm decisions with your contracting officer or counsel.