National Institute of Standards and Technology (NIST) Special Publication (SP)

• NIST SP 800-171r2 - Protecting CUI in Nonfederal Systems and Organizations (DoD CMMC)
• NIST SP 800-171r3 - Protecting CUI in Nonfederal Systems and Organizations

Federal Acquisition Regulations (FAR)

• FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information Systems

Department of Defense

• DoDI 5200.48 – Controlled Unclassified Information
• DFARS 252.204-7000  - Disclosure of Information
• DFARS 252.204-7008 - Compliance with Safeguarding Covered Defense Information Controls
• DFARS 252.204-7012 - Safeguarding Covered Defense Information and Cyber Incident Reporting
• DFARS 252.204-7019 – Notice of NISTSP 800-171 DoD Assessment Requirements
• DFARS 252.204-7020 - NIST SP-171 DoD Assessment Requirements
• DFARS 252.204-7021 - Cybersecurity Maturity Model Certification Requirements

In addition to applicable Federal and State laws, regulations, and policies, UTEP employees who will be interacting with or otherwise handling CUI must comply with the University CUI Policy, UTEP Standard 25 – Controlled Unclassified Information (link forthcoming).

Download this quick reference for more information: CUI Quick Reference