Controlled Unclassified Information (CUI) requires a minimum moderate confidentiality impact level, supported by appropriate system and network security controls. For many nonfederal organizations, NIST Special Publication 800-171 provides the security requirements used to protect CUI from unauthorized disclosure, modification, and exposure.
However, moderate confidentiality does not mean every organization must use identical security settings. The actual requirements depend on the information being handled, applicable federal regulations, contractual obligations, and the relevant version of NIST standards.
Protecting CUI involves more than installing a firewall or requiring strong passwords. Organizations must consider user access, network boundaries, encryption, system monitoring, vulnerability management, incident response, and security documentation.
This guide explains the required confidentiality level, essential technical safeguards, relevant compliance standards, and practical steps for establishing a secure CUI environment.
What Is Controlled Unclassified Information (CUI)?
Controlled Unclassified Information is information that the U.S. government creates or possesses, or that another entity creates or possesses for or on behalf of the government, and that requires safeguarding or dissemination controls under applicable law, regulation, or government-wide policy. Although CUI is not classified national security information, unauthorized disclosure can still create significant risks for government operations, organizational security, and sensitive activities.
Examples of information that may fall within designated CUI categories include:
- Controlled technical information associated with defense programs.
- Sensitive engineering drawings and specifications.
- Certain government procurement or contract information.
- Export-controlled technical data.
- Personally identifiable information subject to applicable safeguarding requirements.
- Certain law enforcement or critical infrastructure information.
Not every technical document, employee record, or government-related file automatically qualifies as CUI. Information must fall within an authorized CUI category and meet the applicable criteria.
The National Archives and Records Administration (NARA) oversees the government-wide CUI program, including the official CUI Registry.
What Level Of System And Network Configuration Is Required For CUI?
The direct answer is moderate confidentiality, but that term needs careful interpretation.Under the federal CUI framework, the confidentiality impact value for CUI is no less than moderate, consistent with Federal Information Processing Standards (FIPS) Publication 199.
A moderate confidentiality impact means unauthorized disclosure could reasonably be expected to cause serious adverse effects on organizational operations, assets, or individuals. This classification establishes the protection objective.
It does not mean an organization can demonstrate compliance simply by selecting a setting labeled “Moderate” in its security software. NIST SP 800-171 translates relevant safeguards into requirements for nonfederal systems handling CUI. Its requirements are derived from and tailored against the NIST SP 800-53 moderate baseline.
Importantly, some CUI categories have additional requirements, while federal contracts may specify particular assessments or security obligations.
NIST SP 800-171 Revision 3 also recognizes that CUI may require protections beyond the moderate baseline when applicable authorities prescribe them.
Moderate Confidentiality Vs. Actual Security Requirements
| Aspect | What It Means for CUI |
|---|---|
| Confidentiality impact | No less than moderate |
| Primary security reference | NIST SP 800-171 for applicable nonfederal systems |
| Access protection | Authorized access and least privilege |
| Network security | Controlled connections and protected boundaries |
| Authentication | Identity verification and applicable MFA requirements |
| Data protection | Appropriate cryptographic protection and secure handling |
| Monitoring | Audit records, security reviews, and incident detection |
| Compliance | Evidence that applicable contractual and regulatory requirements are satisfied |
The distinction matters because compliance is demonstrated through implemented safeguards and supporting evidence, not a confidentiality label alone.
Understanding NIST SP 800-171 And CUI Security Standards
NIST SP 800-171 provides security requirements designed to protect CUI in nonfederal information systems and organizations.
Its coverage includes the computers, servers, applications, network devices, and supporting services involved in processing, storing, transmitting, or protecting CUI.
NIST SP 800-171 Revision 2 Vs. Revision 3
Revision 2 organizes 110 requirements into 14 security families. Revision 3, published in May 2024, updated the framework and organizes requirements into 17 families, with closer alignment to NIST SP 800-53 Revision 5.
Revision 3 is the newer NIST publication, but organizations should not automatically assume that every existing contract has switched to it.
For example, the Department of Defense’s CMMC Level 2 assessment framework uses NIST SP 800-171 Revision 2 requirements.
The applicable contract and agency instructions determine which requirements must be met. Before changing security configurations, organizations should identify the exact standards and revisions required by their agreements.
Essential System Configuration Requirements For CUI
A compliant environment requires coordinated technical and administrative safeguards. The following areas are fundamental to protecting sensitive government information.
Access Control And Least Privilege
Access control determines who can view, modify, transfer, or manage information.
Organizations should restrict CUI access to authorized users, devices, and processes, allowing individuals to perform only their approved responsibilities.
Effective measures include:
- Assigning permissions according to job responsibilities.
- Reviewing access when employees change roles.
- Separating administrative accounts from ordinary user accounts.
- Preventing unauthorized access to sensitive directories.
- Removing unnecessary accounts and permissions.
For example, an engineering employee may need access to a technical drawing but not to unrelated procurement records. Restricting access limits potential exposure if an account is compromised.
Identification And Multifactor Authentication
Organizations must reliably identify users and authenticate access according to the applicable security requirements.
Multifactor authentication (MFA) strengthens account protection by requiring more than one authentication factor.
Security configurations should include unique user accounts, MFA where required, protected authentication credentials, and restrictions on unsuccessful login attempts.
Shared accounts should be avoided where individual accountability is necessary. Privileged accounts require particular attention because they can alter security settings and access large volumes of sensitive information.
Secure System Configuration
Default operating system and application settings are not necessarily suitable for systems containing CUI.
Organizations should establish documented, approved configuration baselines and maintain control over changes.
Typical hardening activities include disabling unnecessary services, closing unused ports, removing unsupported software, restricting unauthorized installations, and securely configuring remote administration.
Configuration changes should be reviewed and tested to avoid introducing vulnerabilities or interrupting critical operations.
System And Information Integrity
Protecting CUI also requires preventing malicious changes and identifying technical weaknesses. Organizations should use appropriate endpoint protection, vulnerability scanning, security updates, and monitoring capabilities.
A practical patch management process identifies vulnerabilities, evaluates their severity, establishes remediation priorities, and confirms that fixes were successfully deployed.
Unsupported operating systems and unpatched applications can introduce unnecessary risks, even when other security controls are functioning correctly.
Network Security Requirements For Protecting CUI
Network configuration is particularly important because CUI frequently moves between employee devices, servers, cloud platforms, and authorized external systems.
Firewalls And Boundary Protection
Firewalls help restrict unauthorized network traffic and control communication between trusted and untrusted environments.
Organizations should establish network boundaries that reflect where CUI resides and how it moves. Appropriate protections may include restrictive firewall rules, secure gateways, controlled external connections, and monitoring of traffic crossing security boundaries.
Rules should be reviewed periodically so outdated permissions do not remain active indefinitely.
Network Segmentation
Network segmentation separates systems into controlled areas based on their function and sensitivity.
For instance, an organization may isolate its CUI-processing environment from guest Wi-Fi, general office systems, and unrelated business applications.
Segmentation can reduce unauthorized movement between network areas and make the security boundary easier to manage.
However, segmentation alone does not establish compliance. Organizations must also consider identity controls, administrative access, data transfers, and shared infrastructure.
Encryption And Secure Communications
Encryption protects information by making it unreadable to parties without the appropriate cryptographic keys.
CUI should be protected during transmission and storage according to applicable requirements.
Common protections include encrypted network connections, secure file-transfer mechanisms, device encryption, and protected storage systems.
Where NIST SP 800-171 requires cryptography to protect CUI confidentiality, applicable Federal Information Processing Standards-validated cryptographic modules must be used.
Simply enabling a feature labeled encryption does not necessarily demonstrate that its implementation satisfies a specific federal requirement.
Remote Access Security
Remote employees and system administrators can introduce additional exposure if their connections are not properly controlled.
Remote access should be explicitly authorized, authenticated, monitored, and limited to approved systems.
Organizations may use secure remote-access gateways, encrypted connections, MFA, and restrictions on administrative sessions.
Personal devices should not receive access to CUI environments without meeting the organization’s applicable device-security and authorization requirements.
Audit Logging, Monitoring, And Incident Response
Preventing every attempted cyberattack is unrealistic. Organizations also need the ability to identify suspicious behavior, investigate security events, and respond effectively.
Audit And Accountability
Security audit logs provide records of activities occurring within an information system.
Depending on the system and applicable requirements, useful records may include authentication attempts, privilege changes, account modifications, configuration changes, and security-relevant events.
Organizations should:
- Define which events require logging.
- Protect audit records against unauthorized modification.
- Review security events for suspicious activity.
- Establish appropriate log retention periods.
- Investigate identified anomalies.
Centralized log management can help security personnel identify patterns across multiple devices and applications.
Incident Response Planning
An incident response plan establishes how an organization handles suspected security incidents.
It should define responsibilities, escalation procedures, communication channels, investigation activities, and recovery processes.
Consider an employee whose account begins transferring unusually large amounts of sensitive data outside normal working hours.
An effective response process enables security personnel to investigate the activity, restrict potentially compromised access, preserve relevant evidence, and determine whether information was exposed.
Organizations must also follow applicable contractual incident-reporting obligations, which may establish specific deadlines and notification procedures.
How To Implement CUI Security Requirements: Step-By-Step
Understanding the standards is useful, but organizations also need a practical implementation process.
Step 1: Identify And Locate CUI
Determine what information qualifies as CUI and identify where it is stored, processed, and transmitted.
Include relevant endpoints, file servers, applications, cloud services, backups, and external connections.
An accurate information inventory helps prevent overlooked systems from becoming security vulnerabilities.
Step 2: Define The System Boundary
Document which systems and components handle CUI or provide security protection for them.
Clearly defined boundaries help organizations determine where technical requirements apply and which supporting systems must be assessed.
Step 3: Identify Applicable Requirements
Review the relevant federal agreement, CUI category, agency guidance, and specified NIST publication.
Organizations supporting defense contracts should also determine whether DFARS and CMMC requirements apply.
Step 4: Implement Security Controls
Configure the environment according to the applicable requirements. Prioritize identity management, least privilege, secure configurations, network protection, cryptography, endpoint security, and logging. Ensure each control has an assigned owner responsible for implementation and maintenance.
Step 5: Document The Security Environment
Develop a System Security Plan (SSP) describing the system boundary, operating environment, implemented safeguards, and relevant connections.
When permitted, use a Plan of Action and Milestones (POA&M) to document outstanding deficiencies, corrective actions, responsibilities, and completion targets.
A POA&M does not automatically make an unmet requirement acceptable. Its use depends on the applicable assessment and contractual rules.
Step 6: Assess And Improve
Evaluate whether implemented controls operate as intended.
Testing may include configuration reviews, interviews, examination of supporting documentation, and technical assessments.
NIST SP 800-171A provides assessment procedures that can support this evaluation.
Security should then be maintained through ongoing reviews rather than treated as a one-time compliance project.
Common Mistakes Organizations Should Avoid
Even organizations with substantial IT resources can overlook important CUI protections.
Assuming moderate confidentiality means minimal security: Moderate is a formal impact designation, not permission to implement only basic consumer-grade protections.
Using outdated security documentation: An SSP that does not reflect current infrastructure may fail to demonstrate how security controls are actually implemented.
Ignoring third-party access: Contractors, external administrators, and service providers can affect the security boundary and require appropriate controls.
Overlooking cloud and backup environments: CUI does not stop requiring protection when moved into cloud storage, replicated systems, or backup repositories.
Treating compliance as a checklist: Documented policies are valuable, but organizations must also demonstrate that relevant controls operate effectively.
Practical CUI Security Configuration Checklist
Protecting Controlled Unclassified Information requires more than installing security software. Organizations must establish appropriate technical safeguards, maintain accurate documentation, and regularly assess their security practices.
The following checklist helps IT administrators, security teams, and compliance professionals review essential CUI protection measures.
Identify and Document CUI: Determine where Controlled Unclassified Information is stored, processed, and transmitted. Maintain an inventory of relevant systems, applications, and data locations.
Define System Security Boundaries: Identify all devices, servers, networks, cloud environments, and supporting components included in the CUI system boundary.
Verify Applicable NIST Requirements: Review the relevant version of NIST SP 800-171, federal regulations, and contractual obligations before implementing security configurations.
Implement Access Controls: Restrict access to authorized personnel using least-privilege principles and permissions appropriate to their responsibilities.
Enable Multifactor Authentication: Require MFA wherever specified by applicable security requirements, particularly for privileged accounts and relevant network access.
Harden Systems and Network Devices: Disable unnecessary services, remove unsupported applications, restrict unused ports, and establish secure configuration baselines.
Protect CUI Through Encryption: Implement cryptographic safeguards for sensitive information during storage and transmission, using compliant cryptographic mechanisms where required.
Maintain Security Logs and Monitoring: Record relevant system activities, monitor suspicious events, and protect audit logs against unauthorized modification.
Manage Vulnerabilities and Security Updates: Conduct vulnerability assessments, apply security patches, and address identified weaknesses according to their severity and applicable requirements.
Establish Incident Response Procedures: Develop documented procedures for identifying, reporting, investigating, containing, and recovering from security incidents.
Maintain Security Documentation: Keep the System Security Plan (SSP) accurate and updated. Document outstanding deficiencies through a Plan of Action and Milestones (POA&M) where permitted.
Conduct Regular Security Assessments: Evaluate implemented controls, document assessment findings, and track corrective actions to maintain ongoing security effectiveness.
Following this checklist can help organizations identify security gaps and establish stronger protection for CUI. However, completing these activities does not automatically demonstrate compliance. Organizations must verify that their security controls satisfy the specific federal regulations, contractual requirements, and NIST standards applicable to their environment.
Frequently Asked Questions
Is Moderate Confidentiality Required For All CUI?
Yes. The federal CUI framework establishes a confidentiality impact value of no less than moderate. Specific CUI categories, regulations, or agreements may require additional safeguards.
Does CUI Require A High-Security Network?
Not every CUI environment requires the FIPS 199 high confidentiality impact level. However, an organization must implement all safeguards applicable to its information, systems, and governing requirements.
Is NIST SP 800-171 Mandatory For Every Organization?
No. Its applicability depends on the organization’s relationship to the federal government, the information involved, and the relevant laws, regulations, or agreements. Other requirements may apply to federal systems or particular arrangements.
Can CUI Be Stored In The Cloud?
Yes, provided the cloud environment and related arrangements meet the applicable safeguarding requirements. An encrypted cloud service is not automatically CUI-compliant.
How Often Should CUI Security Configurations Be Reviewed?
Organizations should continuously manage relevant security risks and perform reviews according to applicable control frequencies, contractual obligations, system changes, and organizational risk.
Conclusion
Understanding what level of system and network configuration is required for CUI begins with the moderate confidentiality impact requirement, but meaningful protection depends on implementing the correct technical and organizational safeguards.
Access controls, authentication, secure network boundaries, encryption, monitoring, incident response, and documented assessments work together to reduce unauthorized disclosure risks. The most effective approach is to identify where CUI exists, determine which federal and contractual requirements apply, establish suitable security controls, and continually verify their effectiveness.
CUI security is ultimately about protecting sensitive information throughout its lifecycle-not simply achieving a compliance designation. For security teams revisiting the question what level of system and network configuration is required for CUI, the most important next step is to verify the specific requirements governing their environment rather than relying on a generic configuration template.
