Home Agencies

Agency CUI Programs

CUI obligations reach past the DoD, and so does our work.

GSA, NASA, DOE, DOJ, and other civilian agencies impose CUI protection through their own clauses, directives, and authorization processes. We translate the requirements incorporated into your specific contract, agreement, agency policy, or authorization process into an operational security program, using the same production line that carried our own CMMC Level 2 assessment.

One production line, agency-specific outcomes

Every agency lane runs the same Factory sequence (scope, architect, implement and document, evidence and sustain), and the output is aimed at that agency's verification mechanism: an authorization decision, a government review, an independent assessment, or contract-specific acceptance. Agencies differ in the imposing instrument, the 800-171 revision and parameters it references, and who signs off. The engineering underneath is the same for all of them.

Agency Lane

GSA CUI Authorization

Authorization-lifecycle support under GSA's CUI security requirements (CIO-IT Security-21-112): SSP and evidence built to the process, showstopper remediation, and continuous monitoring.

Explore →
Agency Lane

NASA Contractor CUI

NPR 2810.7 directs NASA to apply NIST SP 800-171 in agreements protecting NASA CUI on nonfederal systems. We turn the clause in your agreement into an operating program.

Explore →
Agency Lane

DOE Contractor CUI

DOE O 470.7 and existing incorporated requirements need contract-specific review. We map CUI and UCNI safeguards, boundary, SSP, and evidence to your actual obligations.

Explore →
Agency Lane

DOJ & FBI Contract Security

Contract-specific programs for CUI, privacy, and law-enforcement-sensitive information. Where CJIS applies, we handle it as a separate security regime from NIST 800-171.

Explore →
Agency Lane

Other Civilian Agencies

The government-wide CUI framework (32 CFR Part 2002) reaches contractors through agency-specific clauses. We translate whatever yours says into an operational security program.

Explore →

We put this caution in writing: no agency's contracts are uniform. We never assume your NASA agreement, DOE contract, or GSA order imposes a particular revision or process until we've read it, because your clause decides what applies, whatever the agency usually does. Reading the contract is the first station of every engagement.

Federal CUI & NIST 800-171 Rev. 3 Transition Rev. 2 vs. Rev. 3 guide What counts as CUI?
Which lane?

Tell us the agency and we'll map the obligation.

Send the agency, the contract type, and where you are. A practitioner will identify the imposing instrument, the applicable baseline, and the assurance outcome you're being asked for. Or email rj@indirectit.com directly.