CUI Fundamentals: NIST SP 800-171 and DFARS 7012

Controlled Unclassified Information (CUI) is the most misunderstood compliance scope in federal contracting. The confusion is understandable: CUI is not classified, but mishandling it carries the same contractual and financial consequences as a security breach. The authoritative control baseline is NIST SP 800-171, and for DoD contracts the contractual hook is DFARS 252.204-7012.

The clause you already have

If you have a DoD contract that generates or handles CUI, DFARS 7012 is almost certainly already in your contract. It requires you to implement NIST SP 800-171, report cyber incidents within 72 hours, and flow the same requirements to your subcontractors. You do not need to wait for CMMC to be obligated — 7012 binds you today.

What CUI actually is

CUI is information the government creates or owns that requires safeguarding or dissemination controls but is not classified. Examples in practice include unclassified design specs, operational details, certain personnel data, and export-controlled technical data. The CUI Registry maintained by NARA defines the categories. Mis-scoping — either over-scoping everything as CUI or under-scoping and missing it — is the most common failure.

NIST SP 800-171 in practice

SP 800-171 organizes 110 controls across 14 families. The hard ones for most contractors are not the technical controls — they are the boundary definition, the asset inventory, and the system security plan. You cannot implement controls across systems you have not enumerated, and an assessor will not accept controls applied to an undefined boundary.

The recurring traps:

• Cloud services that are not FedRAMP-authorized for CUI hosting. Commercial SaaS that lacks a FedRAMP authorization generally cannot host CUI under 7012 without a documented exception.
• Contractor-owned CUI repositories with no SSP, no access controls, and no incident response plan.
• Missing SPRS reporting. DoD contractors must submit their NIST SP 800-171 score to the Supplier Performance Risk System (SPRS).

The 72-hour clock

DFARS 7012 requires cyber incident reporting to DoD within 72 hours of discovery. That means your incident response process, your media preservation, and your point of contact for DoD Cyber Crime Center (DC3) must be defined before an incident, not during one.

The bottom line

Whether or not your contract is CMMC-applicable yet, if you handle CUI on a DoD contract, the 7012 obligation is live. Build the SSP, enumerate the boundary, score yourself honestly, and document it. GovCon Architect's CMMC module supports self-assessment against SP 800-171, evidence collection, POA&M tracking, and SSP drafting so this runs as a controlled program.