Explainer
CUI, CMMC and Technical Manuals
The Short Answer
Three Markings, Three Questions
Contracts for defense technical manuals now cite acronyms that sit beside the content standards: CUI, DFARS 252.204-7012, NIST SP 800-171, CMMC. They sound like an IT concern, and for a publications team they are a document concern first. They decide how a manual is marked and where its files may live while it is being written.
The useful frame is that one manual can carry three separate markings, and each answers a different question.
- The CUI banner and designation indicator
- Says the document is Controlled Unclassified Information, under which category, and who designated it. The banner appears on every page that contains CUI. The designation indicator names at least the designating agency and may sit on the cover.
- The distribution statement
- Says who may receive the document: a letter from B through F in the usual case, set by the controlling DoD office under DoDI 5230.24.
- The export-control notice
- Says the data may be subject to the ITAR or the EAR, so release to a foreign person can need authorization whether or not anything crosses a border.
None of the three replaces another. The distribution statements page covers the access rule, and ITAR technical data covers the export rule. This page is about the third layer and the contract clauses that hang on it.
What CUI Is
The Program Behind the Banner
32 CFR Part 2002 defines Controlled Unclassified Information as information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, where a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. Classified information is outside it. The National Archives maintains the CUI Registry of categories, and the DoD implements the program through DoD Instruction 5200.48.
Two terms matter on a contract. CUI Basic follows the uniform controls in the rule. CUI Specified is the subset where the underlying law or policy sets its own handling, which may be stricter or merely different. The part is written for agencies; it reaches a contractor through the contract. Agencies are directed to use a formal agreement when they share CUI with a non-executive branch entity, and the minimum terms are handling in line with the rule and the Registry, penalties under applicable law, and reporting of non-compliance back to the disseminating agency.
Technical Data
Controlled Technical Information
The Registry category that most defense manuals fall under is Controlled Technical Information, banner marking CUI//SP-CTI. It is a Specified category. The Registry describes it as technical information with military or space application that is subject to controls on access, including technical data and software, and excludes information that is publicly available without restrictions.
The same entry ties the category to the distribution statements: controlled technical information is to be marked with one of Statements B through F under DoDI 5230.24. That is the link between the two systems. A manual cleared for public release under Statement A is not in the category; a manual under B through F usually is, once the controlling office has made that call. The publisher does not make it.
On the page, the marking rules in Part 2002 are short. The control marking in the banner is either “CUI” or “CONTROLLED”, and agency policy may require one. Specified category markings are mandatory in the banner, and the banner is identical on every page that contains CUI. A designation indicator naming at least the designating agency is mandatory, and may appear only on the first page or cover. Portion marking is permitted and encouraged. The exact syntax is in the Registry and in the customer's own marking instructions, which win where they are more specific.
The Contract Clauses
DFARS 7012, NIST SP 800-171 and CMMC
DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) applies where a contractor holds covered defense information, which is unclassified controlled technical information or other Registry information that is marked in the contract or collected or used by the contractor in performing it. It requires the contractor's system to meet NIST SP 800-171 as in effect when the solicitation was issued or as the Contracting Officer authorizes, and it requires reporting a cyber incident to DoD within 72 hours of discovery. The clause must be included in subcontracts that involve covered defense information, without alteration except to identify the parties, and that includes commercial subcontracts.
DFARS 252.204-7021 (clause date November 2025) is the CMMC clause. The Contracting Officer fills in the required level, and the contractor must hold a current status at that level or higher for every information system that processes, stores or transmits Federal Contract Information or CUI, and maintain it for the duration of the contract. An affirming official affirms continued compliance each year in SPRS. Before awarding a subcontract, the prime must confirm that the subcontractor has the status appropriate to what is flowed down.
32 CFR Part 170 is the CMMC program rule, effective 16 December 2024. It defines the levels and sets the phase-in. Level 1 is the set of requirements in the FAR basic safeguarding clause, and Level 2 is identical to the requirements in NIST SP 800-171 Revision 2.
The phase-in, as the rule counts it
- Phase 1
- Began 10 November 2025, the effective date of the DFARS rule. DoD intends to require a Level 1 (Self) or Level 2 (Self) status as a condition of award, and may require Level 2 (C3PAO) in its place.
- Phase 2
- Starts one calendar year after Phase 1, which is 10 November 2026 by that count. DoD intends to add Level 2 (C3PAO) as a condition of award, may move it to an option period, and may require Level 3 (DIBCAC).
- Phases 3 and 4
- Each starts one calendar year after the one before (10 November 2027 and 10 November 2028 by the same count). Phase 4 is full implementation: CMMC requirements apply to all applicable solicitations and contracts, including option periods on earlier awards.
The dates for Phases 2 to 4 are the rule's one-year spacing counted from the 10 November 2025 start; the rule itself ties Phase 1 to the DFARS rule's effective date and does not print the later dates. The words “intends” and “may” in the phase text are DoD's, so the level your solicitation requires is the one in the solicitation.
For a Publications Supplier
What Handling Looks Like
- Read the contract for the three things that decide your obligations: which data clauses it includes, whether it names CUI or covered defense information, and which CMMC level the solicitation requires.
- Ask the program office, in writing, which deliverables are CUI, under which category, and which distribution statement and export-control notice go with each. Do not infer the category from the subject matter.
- Mark to the instruction you are given. Every page of a CUI document carries the same banner; a document with mixed content needs the portion-marking rule the customer specifies.
- Look at where the files live: authoring tools, review copies, translation vendors, backups, email. CUI on a system that processes, stores or transmits it brings that system into the assessment scope.
- Flow the clauses down. A subcontractor or freelancer who touches CUI needs the same clause, and the prime is expected to confirm status before award.
- Plan for removal. Legacy markings the rules no longer permit are to be discontinued, and decontrol follows a date or event the designator sets, so keep the marking history with the document.
Rights and markings are different questions that use similar-looking legends. Who owns and may reuse the data is covered in technical data rights and the delivery clauses in DFARS technical data delivery clauses. A data-rights legend, a CUI banner, a distribution statement, and an export notice can all appear on one title page, and each has a different owner and a different way of being wrong. The technical manual contract review checklist is a place to log which of these a given contract actually requires.
This page is background, not legal advice. Which clauses and which CMMC level apply to you is a matter for the text of your contract and your counsel.
FAQ
Questions We Hear
What is CUI?
Controlled Unclassified Information is unclassified information the government creates or possesses, or that an entity holds for or on behalf of the government, where a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. 32 CFR Part 2002 sets the program and the National Archives CUI Registry lists the categories. CUI Basic follows the uniform controls; CUI Specified is the subset where the authorizing rule sets its own handling, which may be stricter or simply different.
Is a technical manual CUI?
Some are and many are not; the controlling office decides, not the publisher. The Registry category that fits most defense manuals is Controlled Technical Information, marked CUI//SP-CTI: technical information with military or space application that is subject to controls on access, including technical data and software, but excluding information that is publicly available without restrictions. A manual approved for public release under Distribution Statement A does not fit that description. Ask the program office; the answer is a determination, not a guess from the content.
Does a CUI marking replace the distribution statement?
No. The Registry entry for Controlled Technical Information says it is to be marked with one of distribution statements B through F, so the two travel together on the same document. The CUI marking says the document is controlled and why; the distribution statement says who may receive it. Our guide to distribution statements covers the six statements and why each one is an access rule your delivery system must enforce.
Does CUI mean the data is ITAR-controlled?
Not by itself. CUI is a government-wide handling category; export control is a separate question decided under the ITAR or the EAR. A manual can be CUI and export-controlled, one without the other, or both. Each needs its own marking and its own handling, and none of the three markings authorizes anything the others forbid. See ITAR technical data for how the definition reaches a publications library.
Does CMMC apply to a publications supplier?
It can. DFARS 252.204-7021 requires a contractor to hold and maintain a current CMMC status, at the level the Contracting Officer specifies, for the information systems it uses to process, store or transmit Federal Contract Information or CUI, and to flow the right level down to subcontractors. A supplier that receives CUI to write or convert a manual is in that chain. Read the clauses and the solicitation; this page is background, not legal advice.
Which version of NIST SP 800-171 applies?
It depends on the contract. DFARS 252.204-7012 refers to the version in effect when the solicitation is issued, or as the Contracting Officer authorizes. NIST published Revision 3 in May 2024 and lists it as superseding Revision 2, but 32 CFR 170.14 sets CMMC Level 2 as identical to the requirements in Revision 2. Check the revision your contract and the CMMC level in it actually cite.
Get In Touch
Know the Markings Before You Write
Send us the data clauses and marking instructions on your program and we will talk through how they bear on the publications work.