Common Cyber
When Technical Data From a Prime Contractor Becomes CUI
Not every file a prime sends you is CUI. Whether it becomes controlled depends on the contract, the markings, and the government program behind it.
What is CUI and who decides?
CUI is government-created or government-owned information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy.
The government information owner, contract terms, authorized markings, and direction from the prime determine whether a specific item is controlled. Do not guess from the file name.
What forms can CUI take in aviation work?
Drawings, technical orders, repair specifications, maintenance procedures, performance data, engineering changes, and data packages can all carry CUI designations.
How does controlled technical data arrive?
It arrives through contract deliverables, prime portals, email, secure file exchanges, engineering tools, and sometimes physical media. The channel does not change the obligation.
How can you tell whether a file is CUI?
Look at markings, contract language, and distribution statements. When those conflict or are missing, ask the prime or government information owner for a written determination.
Guessing is not a compliance strategy. Document the question and get it answered.
What changes once you handle CUI?
Safeguarding, access control, incident reporting, evidence, and CMMC obligations can enter the contract boundary once CUI is present.
The exact obligations depend on the applicable clauses, information flow, and rules in force at the time of award.
What should you do if you are unsure?
Preserve the evidence, stop distributing it further than necessary, review your contract, map the information flow, and ask the information owner for clarification.
A fixed-fee path to a clear boundary.
The assessment clarifies applicability, maps scope, establishes a readiness baseline, and builds a prioritized statement of work.
CMMC Readiness and Scope Assessment
A defined first step that establishes scope, readiness, and a practical remediation path.
Frequently asked questions
Is every drawing from a prime contractor CUI?
No. A drawing is not automatically CUI because a prime sent it. Review markings, distribution statements, contract clauses, and the information owner's direction.
Can unmarked technical data still be CUI?
It can be, depending on the source, contract, and applicable marking rules. Treat unclear status as a question to resolve with the information owner rather than making an unsupported assumption.
Does CUI status follow a file into email and shared drives?
Safeguarding obligations follow the controlled information through the systems and workflows that store, process, or transmit it. That information flow helps define the boundary.
What is the first step when CUI may be present?
Identify the source, contract language, markings, recipients, systems, and downstream copies, then obtain clarification from the prime or government information owner when needed.
A clear next step
Define the boundary before you build.
The fixed-fee assessment clarifies what is in scope and turns the findings into a practical statement of work.
Start an Assessment