How civilian-agency obligations reach contractors
The National Archives' CUI program (32 CFR Part 2002) defines the categories, the marking rules, and the expectation that CUI on nonfederal systems is protected to NIST SP 800-171. NARA doesn't sign your contract, though. An agency does, through its own clause, directive, or authorization process, so two contractors holding identical data for different agencies can face different revisions, parameters, and verification mechanisms.
What we do in this lane
- We read each instrument for what it imposes: CUI designation, security requirements, reporting duties, and verification expectations.
- CUI discovery finds the categories you hold and where they live, then sets the smallest boundary we can defend. The method doesn't change from one agency to the next.
- NIST SP 800-171 is the spine of the program. We implement it once, with evidence kept at the assessment-objective level, and add a mapping layer for each agency's specific parameters and deltas.
- The SSP and evidence are packaged for whatever verification your agency runs: self-attestation, government review, authorization, or independent assessment.
- We follow the rulemaking as it happens. When standard government-wide clauses mature, contractors with working implementations absorb them as deltas, and contractors with only binders start over.
Questions contractors ask us
Our agency isn't GSA, NASA, or DOE. Do CUI rules still apply to us?
If your contract designates information as CUI, yes. The government-wide CUI program (32 CFR Part 2002) sets the framework and points to NIST SP 800-171 for CUI on nonfederal systems; agencies impose it on contractors through their own clauses and policies. A standard government-wide FAR CUI clause has been in rulemaking, but for now your obligation arrives through the specific language in your contract.
Our contract's security language is vague. What do we do?
Treat vague language as a risk. We inventory what the contract does say, identify the CUI you hold, implement to the 800-171 baseline as the defensible default, and document our interpretation. If the agency later sharpens its expectations, or a dispute arises, you can point to the engineering and the paper trail behind it.
Can one program cover contracts from several civilian agencies?
Yes, that's how we build it: one control implementation with objective-level evidence, plus a mapping layer for each instrument's specific requirements, parameters, and verification mechanism. It's the dual-baseline method we use to run Rev. 2 and Rev. 3 side by side, applied across agencies.
Send us the clause and we'll send back the program.
For any agency, the first step is a strategy call where we read the instrument, map the obligation, and scope the program. Or email rj@indirectit.com directly.