How civilian-agency obligations actually arrive
The National Archives' CUI program (32 CFR Part 2002) defines the categories, the marking rules, and the expectation that CUI on nonfederal systems is protected to NIST SP 800-171. But NARA doesn't sign your contract — an agency does, through its own clause, directive, or authorization process. That's why two contractors holding identical data for different agencies can face different revisions, different parameters, and different verification mechanisms.
What we do in this lane
- Clause and applicability analysis — every instrument read for what it actually imposes: CUI designation, security requirements, reporting duties, and verification expectations.
- CUI discovery and boundary — the categories you hold, where they live, and the smallest defensible boundary — same discipline, any agency.
- 800-171 implementation as the spine — the standard implemented once, at objective-level evidence discipline, with per-agency mapping layers for specific parameters and deltas.
- Verification-ready packaging — SSP and evidence structured for whatever your agency runs: self-attestation, government review, authorization, or independent assessment.
- Watch the rulemaking, don't wait for it — as standard government-wide clauses mature, contractors with real implementations absorb them as deltas. Contractors with binders start over.
Questions contractors ask us
Our agency isn't GSA, NASA, or DOE. Do CUI rules still apply to us?
If your contract designates information as CUI, yes. The government-wide CUI program (32 CFR Part 2002) sets the framework and points to NIST SP 800-171 for CUI on nonfederal systems; agencies impose it on contractors through their own clauses and policies. A standard government-wide FAR CUI clause has been in rulemaking — but today, your obligation arrives through the specific language in your contract.
Our contract's security language is vague. What do we do?
Treat vagueness as risk, not relief. We inventory what the contract does say, identify the CUI you actually hold, implement to the 800-171 baseline as the defensible default, and document the interpretation — so if the agency later sharpens its expectations (or a dispute arises), your position is engineering plus a paper trail, not a shrug.
Can one program cover contracts from several civilian agencies?
That's the model. One control implementation with objective-level evidence, plus a per-agency mapping layer for each instrument's specific requirements, parameters, and verification mechanism. It's the same dual-baseline discipline we use for Rev. 2/Rev. 3 coexistence, applied across agencies.
Send us the clause. We'll send back the program.
Whichever agency it is, the first step is the same: read the instrument, map the obligation, scope the program. That's a strategy call. Or email rj@indirectit.com directly.