• General Process for working with Controlled Unclassified Information (Updated)
• Reproducing CUI (printing, copying, scanning, faxing, etc.)
• ISO Approved Mandatory CUI Training
• Safeguarding Improperly Received CUI (Forcoming)
• Safeguarding Unsolicited CUI
• Sponsored Projects with CUI Requirements (Under revision)
• Determining CUI Requirements at Proposal Development (Under revision)
• Determining if an Award will Involve Access to CUI (Under revision)
• How to address CUI Incidents (Forthcoming)

For more information or assistance on specific training requirements, contact either of the following:

• security@utep.edu
• rso@utep.edu

What is Unsolicited CUI?

Unsolicited Controlled Unclassified Information (CUI) refers to information that is shared or received without a specific request and is designated as CUI according to federal regulations. 

How is Unsolicited CUI obtained?

Unsolicited CUI might be received through various means, such as emails, faxes, regular mail, or verbal communications. Handling such information requires

1. Adherence to established protocols to ensure its protection and proper dissemination
2. Proper training

Lookout for potential indicators of CUI

1. Are you receiving any communication from a Federal Agency or Federal Flowdown (e.g. DoD, DoT)?
2. Do any attachments have CUI in the file name?
3. Is the Email Marked CUI in the header or footer?

How to Safeguard Unsolicited CUI

If you have received or believe you have received unsolicited CUI via Outlook Email in a non-compliant environment (i.e. a workstation that does not meet NIST 800-171 requirements):

1. Reach out to the sender to determine if what was sent is actual CUI. If it is, inform the sender that it was improperly sent. The originator will need to report the mishandling of CUI to their appropriate next level contact. Contact your RSO for guidance on how to proceed.
2. Do not delete any CUI email messages.
3. Do not open any attachments.
4. Do not save attachments to your workstation.
5. If you do open or download an attachment, do not delete it and do not empty your recycle bin
6. Contact your research security officer (RSO) at   rso@utep.edu  to report the incident. Be sure to include the following information

• Office Location
• UTEP Tag Number
• Who you have shared the CUI with

7. The RSO will coordinate with the Information Security Office to

• Securely delete any CUI from your system
• Provide you with a secure environment for properly handling CUI

8. If it is determined that you have a lawful government purpose to store, process, or otherwise transmit any unsolicited CUI, you will be required to take mandatory CUI training and gain access to a compliant environment for doing so.

CUI Training

If access to CUI is required in the conduct of your work, you will be required to take approved training before you access any type of controlled unclassified information. The training modules and instructions for certifying completion can be found on the   Controlled Unclassified Training  webpage. Upon reporting an unsolicited CUI training incident, you will also receive an email notification with instructions on how to complete the training and how to submit your training certificates.

A federally funded sponsored project (or flow down) with CUI requirements should generally follow this process:

1. A solicitation or contract review identifies clauses and/or the federal sponsor indicates a proposal or project has CUI restrictions. These reviews are conducted by the PI, RA, and/or Research Protections (RP).
2. The PI identifies or is notified of such restrictions by the RA/RP.
3. The PI completes the   CUI Scope Form  (this form specifies the intended controlled environment for safeguarding CUI) and submits the form to RP for review and approval. For assistance completing the form, contact RP ( rso@utep.edu).
4. Upon certification of the   CUI Scope Form  by RP, an Information Security Office review of the proposed controlled environment is initiated.

1. Upon completion of the steps above

      6. Auditing and monitoring occur to ensure compliance with the ISO approved protection plan.

Note: All personnel identified in the   CUI Scope Form  who will be working on the project are required to take   CUI training  and each individual must be certified by the Information Security Office (ISO) before beginning any work that involves CUI.

When developing a proposal for submission to a federal agency or flow down, researchers are advised to,

1. Conduct a thorough review of the CUI implications before proposal submission. Things to do include:
   A. Review the funding announcement or agency guidelines.
   B. Contact the agency sponsor.
   C. Indicate CUI is part of the proposal in the Notice of Intent.
2. If CUI protections are outlined by the agency
   A. Clearly define the CUI Scope, including all systems, networks, storage, facilities, and personnel that will store, process, or transmit CUI.
   B. Identify any CUI data that will be used or generated and ensure that the proposal includes appropriate security measures.
   C. Consult with the RSO for guidance on addressing CUI requirements to ensure all appropriate safeguards are addressed. If applicable, the RSO will initiate a request for ISO guidance on identifying CUI safeguards during the proposal phase.
   D. When applicable, include a CUI compliance statement within the proposal. This statement should outline the steps the research team will take to safeguard CUI in accordance with federal regulations.

Research Protections advises that any project involving CUI must have a designated CUI coordinator who is responsible for overseeing compliance throughout the research lifecycle. In the absence of a CUI coordinator, the PI is responsible for overseeing compliance.

Follow this process to determine if an award requires access to CUI. It may be necessary to search various documents (contracts, questionnaires, exhibits, addendums, etc.) for keywords that may indicate access to CUI is required. Refer to the   Quick Reference Guide for Identifying FCI and CUI  for guidance on what to look for.

1. Does the award originate from a Federal Agency (or flow down)?

• Yes: proceed to step 2.
• No: Stop. If the sponsor is not a Federal agency or federal flow down, it cannot be CUI.

2. Does the information meet the standards for classification according to instruction DoDM 5200.01, Volume 1?

• Yes:
  a. Stop and refer to DoDM 5200.01, Volume 1, for guidelines on processing classified information.
  b. Report immediately to the campus FSO.
• No: proceed to step 3.

3. Does the information fall within a current Federal law, regulation, or government policy or do any of the contract documents contain CUI Clauses? Refer to the CUI Quick Reference Document for examples of clauses.

• No: the information cannot be designated CUI and is therefore not subject to NIST 800-171.
• Yes: proceed to step 4.

4. Can the CUI requirements be negotiated or do fundamental research exclusions exist? Work with your RA, RSO, and/or the sponsor to make this determination.

• Yes: Clarify in contract documents CUI negotiated out and/or fundamental research exclusions.
• No: proceed to step 5.

5. Fill out the following document and submit to the RSO, rso@utep.edu. Upon approval the RSO will trigger an ISO CUI review. (This step is under revision).

Tips:

• The DoD offers access to its online CUI Registry, which lists specific categories of information that the government requires to be protected. The list includes critical infrastructure, defense, export control, financial, immigration, intelligence, international agreements and law enforcement.
• The DoD CUI Registry goes on to specify additional categories of information, including legal, natural and cultural resources, NATO, nuclear, privacy, procurement and acquisition, proprietary business information, provisional, statistical and tax information.

References

• Managing Controlled Unclassified Information (CUI). NSF.ORG