Log In

Come Join Us!

Are you an
Engineering professional?
Join Eng-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!
  • Students Click Here

*Eng-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here


Controlled Unclassified Information (CUI)

Controlled Unclassified Information (CUI)

Controlled Unclassified Information (CUI)

Looking for feedback from people who are EXPERIENCED in defining Controlled Unclassified Information (CUI).
Applicable standards include:
  • 32 CFR §2002
  • DFAR 252.204-7012
  • FAR 52.204-21
  • NIST SP800-171 Rev 1
  • FIPS Publication 199
  • FIPS Publication 200
My questions are:
1. If our ERP only contains textural data (no files), would things like the BOM be considered a Technical Data Item? If so how could it be "Marked" as CUI?
2. There has been much debate related to, at what point an item "looses it's identity". In other words, if we are contracted to design an assembly for the DOD, the top level assembly is definitely considered CUI, but would a shim used on that assembly also be considered CUI?


Chris Wilson
Engineering Services Manager

Certified SolidWorks Professional
Certified Enterprise PDM Administrator

RE: Controlled Unclassified Information (CUI)

A BOM is essentially a report of sorts, so yes, it can be technical data item

CUI is a bit nebulous at best, because it's often tied to "compilation" classification, i.e., when a compilation of unclassified information might reveal some classified information. For example, say your top level assembly is actually classified, but that the individual components within are not. Thus, the BOM might be CUI, as someone might potentially reverse-engineer what your top level assembly does, based on the components within the BOM. Your DD254 or security classification guide should give you general guidelines on classification.

TTFN (ta ta for now)
I can do absolutely anything. I'm an expert! https://www.youtube.com/watch?v=BKorP55Aqvg
FAQ731-376: Eng-Tips.com Forum Policies forum1529: Translation Assistance for Engineers Entire Forum list http://www.eng-tips.com/forumlist.cfm

RE: Controlled Unclassified Information (CUI)

Anecdotal story,
Some years ago I was working in a DECAS certified shop , we had a bunch of nondescript parts with deliberately vague titles , the acceptance inspector from the major aerospace company came in to check the parts , and assembled the thing right there on the inspection bench. We could instantly see what it was and what it was for.
There was a lot of scrambling and butt covering over that one, and I still cannot tell you what it was.

You are judged not by what you know, but by what you can do.

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Eng-Tips Forums free from inappropriate posts.
The Eng-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Eng-Tips forums is a member-only feature.

Click Here to join Eng-Tips and talk with other members!


Close Box

Join Eng-Tips® Today!

Join your peers on the Internet's largest technical engineering professional community.
It's easy to join and it's free.

Here's Why Members Love Eng-Tips Forums:

Register now while it's still free!

Already a member? Close this window and log in.

Join Us             Close