CONTROLLED UNCLASSIFIED INFORMATION
Who is responsible for CUI designation, Government or Contractors?
DoD contractors are required to identify and protect all forms of CUI.
However, a lot of information provided to contractors in support of performance of the contract lack CUI designation. Who has the obligation to designate CUI classification for data generated in performance of the contract?
SOS has reached out to the appropriate DoD office for clarification and based on their response, it is the responsibility of contractors to determine whether CUI classification applies. This is inconsistent with current practice of classified information designation, which is solely the responsibility of the government.
Contractors ability to comply with DFARS will significantly improve if DoD provides official guidance on this topic.