Controlled Unclassified Information

Some research data must be controlled at a higher level to comply with federal regulations – this data is referred to as Controlled Unclassified Information (CUI). 

CUI is information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls.

There are 20 different organizational groupings for CUI that are then broken down into specific categories. The National Archives and Records Administration (NARA) lists these categories in the CUI Registry. 

Documents and electronic files containing CUI must be marked in accordance with the federal CUI Marking Handbook. Those working with CUI are required to complete an online training specific to the CUI used by researchers at Ohio State, provided by the Department of War.

At Ohio State, CUI is controlled via our information systems and the physical environments where it is viewed. These information systems are unique and not the same systems used for most administrative or research computing. 

If you have a need to handle CUI, you will need access to information systems that are controlled following the NIST SP 800-171 controls. The Export Control Team works with Ohio State researchers to make sure they are set up with technology control plans (TCPs) for handling CUI data and connecting them with their IT support groups to access those controlled IT systems properly. 

The university uses Virtru, an email encryption service, in conjunction with our email system to fully encrypt CUI emails at rest and in motion. This service is provided to those under research data control restrictions. The Export Control Team can grant a Virtru license to users that may handle CUI by emailing exportcontrol@osu.edu. 

Research and business done with the Department of War (DoW) makes Ohio State part of the defense industrial base. The defense industrial base is facing increasingly frequent and complex cyber attacks – and to increase security, the DoW) has developed the Cybersecurity Maturity Model Certification (CMMC) Program. CMMC assesses defense contractor compliance with existing information safeguarding requirements for federal contract information (FCI) and CUI.