NASA CUI readiness: from agreement clause to operating program.

The five readiness steps

• 1. Inventory the instruments. List your contracts, grants, cooperative agreements, Space Act agreements, and subcontract flow-downs, and read each for the CUI and security terms it actually incorporates. NASA's directive shapes what agreements say, but the agreement is what binds you.
• 2. Find the NASA CUI. Identify what you hold that NASA designates as CUI (technical data, research results, pre-decisional information), where it enters your environment, and everywhere it travels. In research settings this is the hardest step, and the one that pays off most.
• 3. Draw the smallest defensible boundary. Research environments sprawl by default, with shared lab infrastructure, collaboration platforms, and access for students and visiting researchers. A deliberate enclave for NASA CUI (see enclave architecture) usually costs less and is more credible than bringing the whole institution into scope.
• 4. Implement and document to the incorporated baseline. Implement 800-171 at the revision your agreement incorporates, write the SSP from the live environment, and keep evidence at the objective level, so you are ready for whatever demonstration the agreement anticipates.
• 5. Operate for agreement churn. NASA work arrives as a stream of agreements with varying terms. A program with a maintained obligations matrix handles each new award as a review of what changed.

The research-institution trap

Universities and research organizations often try to satisfy NASA terms with campus-wide general IT controls. In an assessment, a boundary you can't enumerate is a boundary you can't defend. Containment works better: a defined environment where NASA CUI lives, with the full control set implemented in depth there instead of thinly everywhere.