Per DoDI 5200.48, what specific requirements are there for DoD contractors?

• Contractors must identify whether any of the information is CUI via the contracting vehicle, in whole or part, and mark such documents, material, or media in accordance with this issuance.

• Whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls are to be articulated in the contract, grant, or other legal agreement, as appropriate.

• DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. 

• DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

• DoD personnel and contractors are to submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

• All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities. 

Source:https://www.dodcui.mil/Portals/109/Documents/Policy%20Docs/DoDI%205200.48%20CUI.pdf  

Need to Implement a DoD CUI Program? Talk to Arlington

DoD contractors - and other contractors providing services to federal agencies - need to have in place established policies, procedures, and processes regarding CUI that’s resident within their information systems. What federal contractors need is a CUI Program. Arlington can help, as we offer the following CUI services and solutions:

• CUI Scoping & Gap Assessments

• CUI Policy Development

• CUI Identification

• CUI Contractual Language Review

• CUI Marking (Digital)

• CUI Marking (Physical)