Selection of Sources Category: Choosing Sources to Use
Controlled Unclassified Information (CUI) is a category of data that requires specific safeguards to prevent unauthorized access. This information is marked with the banner "CUI" and, for certain authorities, "CUI//SP-SSEL".
The primary source for understanding CUI and its associated categories can be found in the National Archives and Records Administration (NARA) regulations implementing Executive Order 13556, which governs the CUI program. NARA provides the official policies and implementing regulations that define the CUI categories, including any specified subcategories like CUI//SP-SSEL.
In addition to NARA, the Defense Federal Acquisition Regulation Supplement (DFARS) outlines requirements around safeguarding CUI in defense contracts. Particularly, clause 252.204-7012 of the DFARS specifies security controls to protect CUI, referencing National Institute of Standards and Technology (NIST) Special Publications such as NIST SP 800-171.
For DoD-related contracts, the DoD CUI Program Registry catalogs relevant CUI categories applicable to defense information. This registry is crucial for understanding CUI//SP-SSEL and other specialized DoD CUI categories.
To access these source documents:
- Visit the NARA CUI Registry on the NARA website, which lists approved CUI categories and their implementing rules.
- Review FAR and DFARS clauses on acquisition.gov or the Defense Acquisition Regulations System site for regulatory language regarding CUI and handling requirements.
- Consult NIST publications, particularly NIST SP 800-171, for mandated cybersecurity standards required when handling CUI under DFARS 252.204-7012.
- For DoD-specific CUI categories like CUI//SP-SSEL, refer to the DoD CUI Program Registry or relevant DoD instructions that may be identified in attachments to DFARS clauses or referenced by DoD contracting officers.
It is important to note that no specific standalone document labeled exactly as "CUI//SP-SSEL" was located directly in the search results. However, this would typically be a specified subcategory of CUI governed by NARA’s regulations or DoD CUI policy. Confirming the exact interpretation may require consulting the latest NARA CUI Registry or contacting the DoD contracting authority managing the CUI designation.
In summary, the authoritative source documents for CUI and associated categories like CUI//SP-SSEL are:
- The NARA CUI Program and Registry (implementing E.O. 13556)
- FAR and DFARS regulations, especially DFARS 252.204-7012
- NIST Special Publication 800-171 for security controls on CUI handling
- DoD CUI Program Registry and guidance for specialized DoD CUI categories
Reviewing these sources will provide the official regulatory and procedural framework to identify, handle, and protect CUI categories referenced in FAR regulations. The marking is according to Federal Acquisition Regulation 2.101 and pertains to agency procurement contracts.
- Within the business sphere, the Finance industry should be mindful of Controlled Unclassified Information (CUI) and its associated categories, as neglecting specific safeguards to prevent unauthorized access may lead to severe consequences.
- To safeguard business interests, it's essential for industries such as Business and Finance to maintain a comprehensive understanding of CUI programs and policies, as outlined by the NARA CUI Program and Registry, Defense Federal Acquisition Regulation Supplement (DFARS), and National Institute of Standards and Technology (NIST) Special Publications, especially NIST SP 800-171, and the DoD CUI Program Registry for defense-related Contracts.
