Prior to the US government’s National Archives and Records Administration’s (NARA) implementation of the CUI (Controlled Unclassified Information) protection framework, government agencies employed ad hoc agency-specific policies, procedures, and markings to safeguard and control all information that did not meet the criteria required for classification. The rule was designed to primarily safeguard sensitive government data that had not been assigned as confidential or secret while it was shared between different government and commercial entities.
This confusing patchwork resulted in inconsistent marking and safeguarding of documents. It led to unclear or unnecessarily restrictive dissemination policies and the creation of barriers to authorized information sharing. CUI didn’t have much of an established profile before the framework was implemented. However, if this kind of material fell into the wrong hands, it could mean something as serious as national security being put at risk.
Success in winning a government contract could depend on how your organization addresses CUI. Whilst it isn’t classified data, the data is still sensitive enough to require controls. As such, its release could still pose a threat to national security. It is critical for organizations who want to work with the government to ensure compliance with CUI standards. There are five key steps to master the principles of data classification. These involve the categorization and labelling of data.
What exactly is CUI?
CUI covers data that is created or possessed by, or on behalf of, the government when it resides in non-federal information systems and is handled by non-federal organizations. Its most critical element is the standardized labelling of CUI. It ensures that appropriate protections can be implemented and consistently enforced. This makes the rule actionable by those handling CUI.
The CUI framework is more about people than technology. The CUI registry specifies, by category and subcategory, which marking must be applied to a particular data subject. It details critical procedures relating to the handling, safeguarding and control of the data moving through non-federal systems.
Across ‘CUI Basic’, ‘CUI Specified’ and ‘Limited Dissemination’, the marking/labelling is central to ensuring that CUI data is handled and secured appropriately and is only accessible to users who need to work with it, with appropriate downstream security controls across all IT systems, devices and databases.
As a matter of strict compliance, both federal and non-federal organizations must provide evidence that they comply with NARA’s guidelines. It also ensures they meet both legal and contractual obligations. This includes demonstrating a comprehensive information security and classification program that ensures that all points where data travels or resides are treated as locations where CUI must be controlled.
It must address 14 key areas of technical security and compliance, including audits, training, access control, configuration management, identification and authentication, incident response, maintenance, media protection, physical protection, personnel security, risk assessment, security assessment, system and communications protection and system and information integrity.
The 5 Steps to Effective CUI Classification
The right tools and training enable organizations to demonstrate they have the capabilities to recognize and handle CUI classification and labelling. It also ensures they can produce evidence where necessary. It breaks down into five key steps:
1. Identify
Know the CUI you create, process, store and disseminate. Understand your contracting security obligations or partner organization’s security policies. Ensure you can comply with both these and the new framework. This includes understanding the types of information that needs to be marked, what language must be used, and the markings.
2. Discover
Get visibility of what CUI you are required to process, where it comes from, where it resides, where it is sent and who might have access to it. From here, establish what controls you need to put on it.
3. Classify
Select a technology solution that enables users to consistently apply the classification scheme, add critical metadata to the file and, via clear labelling, control who should have access to each type of CUI. Start with classifying ‘live’ data. That includes emails, files and documents that are being received, created and handled right now. Then move on to labelling existing and legacy CUI that is stored and held around the organization.
4. Secure
Employ the tools that will control and protect CUI through its journey. The metadata label will enable higher grade controls such as DLP solutions, security incident and event monitoring (SIEM) tools, access control tools and data governance tools to safeguard data when it’s accessed or used later.
5. Monitor
CUI frameworks evolve. Use monitoring and reporting tools to track how CUI is being accessed, used and classified in your organization. Also, ensure you keep the background intelligence needed to evolve the approach in line with regulatory changes constantly available.
Failing to protect CUI adequately has considerable implications. A data leak that exposes a client or breaches a regulation could lead to a damaged reputation and brand, penalties and the possible loss of business. By adopting the CUI framework, organizations can demonstrate the ability to protect federal government information and enhance their ability to respond to opportunities to work with the US government.
Titus is synonymous with world-class data classification and our solutions are key components of HelpSystems’ robust data security portfolio.
Titus solutions are trusted by millions of users in over 120 countries around the world, including top military, government and Fortune 100 organizations. With the addition of data identification and advanced machine learning technologies, Titus has evolved into a global leader in enterprise-grade data protection solutions.
