What is Controlled Unclassified Information (CUI)?
CUI is defined as “information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls”. CUI categories and subcategories cover a range of data types. The responsibility for categorizing data as CUI lies with the government agency supplying the data.
Why Does CUI Matter to the University?
The University of Illinois Urbana-Champaign receives federal funding through grants and contracts and is therefore considered an entity that acts on behalf of the government and has an obligation to properly handle and protect CUI. Illinois investigators and administrators generate, receive, store, and manipulate data types that may be CUI.
Campus Policy on Controlled Unclassified Information
The university’s policy on CUI is published here: https://cam.illinois.edu/policies/use-of-controlled-unclassified-information-in-research-projects-new/ and includes a pointer to detailed procedural guidance.
Addressing CUI in Research Proposals and Agreements
Sponsored research and unfunded agreements may require certain cybersecurity measures to safeguard CUI and the measures may differ across funding agencies and projects.
A research project may be subject to CUI regulations if:
- It uses data acquired under a Data Use Agreement or similar legal document, and the data is information classified by the Federal government as CUI or FCI.
- It includes information system security requirements under NIST SP 800-53r5, NIST SP 800-171r2 , and/or NIST SP 800-172 , even if no CUI is expected within the scope of a contract.
- DFARS 70 series (7012, 7019, 7021) is mentioned in pre or post award.
SPA and Technology Services will work with the Principal Investigator (PI) and designated project team members (including staff maintaining relevant information systems) to ensure that proper security requirements will be met. It is important to note that any CUI controls required to perform the research may need to be part of the budget of the research proposal, if such controls are not already part of the campus infrastructure.
For More Information
Contact cui-support@Illinois.edu