CMMC and NIST SP 800-171
CUI Handling and Marking
Recognize controlled unclassified information, mark it correctly and handle it safely
Awareness · 1.5 hours · Certificate does not expire
Controlled unclassified information (CUI) is the technical data, procurement information and export controlled material that flows through every defense supply chain. Drawings, models, process sheets, test reports and the emails that carry them are all covered. Mishandling it breaches your contract, can be an export violation and can turn into a cyber incident your company must report to DoD.
This awareness course teaches the person who actually touches CUI: the buyer, the machinist, the inspector, the document controller, the engineer. You learn to tell federal contract information, CUI and classified information apart, to read and apply the banner line, category markings and designation indicator, and to store, share, carry, print and destroy CUI without losing control of it. The final module covers cyber incidents and spills, the company's 72-hour duty to report to DoD and your duty to report within minutes.
The course is awareness level. It is anchored on 32 CFR Part 2002, the NARA CUI Registry, DoDI 5200.48, DFARS 252.204-7012 and NIST SP 800-171. It does not give legal advice and does not replace your company's procedures; where the two differ, follow your security officer and empowered official.
The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course content and your certificate. The certificate does not expire.
What people learn
- Distinguish federal contract information, CUI Basic, CUI Specified and classified information, and name the categories a supplier meets most.
- Explain who designates and decontrols CUI and what lawful government purpose and need to know mean for your access.
- Read and apply a CUI banner line, category markings, limited dissemination controls and designation indicator, and treat legacy markings such as FOUO correctly.
- Mark emails, documents, drawings, models, program files and physical media that contain or derive from CUI.
- Store, access, transmit, share, print, carry and destroy CUI in line with 32 CFR Part 2002 and NIST SP 800-171.
- Recognize a cyber incident or spill and carry out your reporting and evidence preservation duties under DFARS 252.204-7012.