CMMC and Controlled Unclassified Information (CUI): What Businesses Need to Know

Controlled Unclassified Information is one of the most important concepts in CMMC and NIST SP 800-171 planning.

Why CUI Affects CMMC Scope

Systems that process, store or transmit CUI—and systems that provide security protection—can affect compliance scope.

Map CUI Flows

Document how CUI enters the organization, where it is stored, who accesses it, how it is shared and how it leaves or is destroyed.

Control Access

Access should be limited according to business need and applicable requirements.

Protect CUI in Microsoft 365

Evaluate licensing, configuration, data location, permissions and security requirements before placing CUI into a service.

See CMMC and Microsoft 365 and Microsoft 365 consulting.

CUI and the SSP

Your System Security Plan should accurately describe relevant systems and boundaries.

Start With Scope Before Buying Tools

Understand the CUI environment and applicable requirements before choosing technology.

Our CMMC compliance consulting approach starts with environment, scope, requirements and gaps.