Overview
Controlled Unclassified Information, or CUI, is government information that is sensitive but not classified. The hard part is not marking it — it is keeping it under control once engineers, subcontractors, and assessors need to read it. In most CUI programs the leak is not a hack; it is a copy that should never have existed.
What counts as CUI — and what does not
CUI is defined by the CUI Registry, which groups information into categories such as privacy, law enforcement, procurement, and technical data. A contractor rarely sees the abstract definition. It sees drawings marked distribution-limited, test results that must not leave the program, and acquisition-sensitive schedules. A CUI protection program starts with the documents engineers actually exchange, not with the policy binder. For DoD suppliers, this CUI guide starts with the documents engineers and subcontractors actually exchange.
Three labels get confused in practice: classified, controlled, and public. Classified information has its own regime. CUI sits in the middle — sensitive enough that mishandling is a contractual and sometimes legal problem, but unclassified, which is precisely why it circulates in ordinary business tools.
The obligation flows down. When a prime contractor shares technical data with a subcontractor, the controls are expected to follow the document, not stop at the prime's firewall. That flow-down is where copies multiply, and where most assessments find the gap. CUI is a US framework; UK and Canadian teams should map the same custody questions to their own protected-information rules.
- Sensitivity without classification — CUI is not secret, but it is not shareable either.
- Flow-down obligations — subcontractors inherit the handling requirements, not just the file.
- Marking is not a control — a banner on the page does not stop a download.
Why the downloaded copy breaks the model
Every access-control model assumes a boundary. The moment a user downloads the original, the boundary moves to that user's laptop, personal cloud, or email — places where the contractor has no policy, no logging, and no revocation.
Engineering workflows make this worse. Drawings are exchanged with tooling vendors, test data is sent to a lab, a subcontractor needs a model file for a simulation. Each handoff is legitimate; each one also creates a new copy that no longer appears in any access system. CUI protection is an access-control problem before it is a labeling problem.
The alternative is to change what reaches the endpoint. If the server renders pages to pixels and streams only those pixels, the user gets the information without the file. Server-side rasterization is the mechanism; forensic watermarking and live revocation are what make it defensible.
NIST SP 800-171 and CMMC in practice
The NIST SP 800-171 control families that touch documents are familiar to anyone who has run an assessment: access control, audit and accountability, media protection, and incident response. CMMC assesses whether those controls are actually implemented, and Level 2 aligns with the 800-171 requirements.
The important shift is from documents to outcomes. Access control means an explicit decision per user and document. Audit means a log an assessor can read. Media protection means the sensitive file does not travel on removable media. Incident response means you can reconstruct what was exposed.
- Access control — default-deny, explicit grants, and a policy that can be simulated before it ships.
- Audit and accountability — immutable, exportable records of who viewed, downloaded, or changed a document.
- Media protection — the original stays on infrastructure you control, not on endpoints.
- Incident response — session-level evidence to scope an exposure quickly, which is where deterministic document policies pay off.
Evidence that survives an assessment
Assessors are trained to ask for artifacts, not intentions. A policy statement proves what you meant to do; a log export proves what happened. If the two cannot be reconciled, the assessment pauses.
What a reviewer needs to see is a complete record: which user opened which document, when, from where, and which policy allowed it. Ideally the same record shows that the original could not be downloaded at all.
Honesty matters here. A document platform can support control objectives; it cannot certify the contractor. The system security plan, the assessment, and the accountability stay with your organization — and any vendor who implies otherwise is selling you a shortcut that will not survive an audit.
- Immutable logs — append-only, exportable, and filtered by user, document, and date.
- Policy decision trace — the exact rule behind every allow or deny.
- Session attribution — watermark and identity bound to the same session record.
- Clear scope — a written boundary of what the platform covers and what it does not.
Where Aegis fits — and where it does not
Aegis Secure View is an on-premise and air-gapped document viewer built around custody: deterministic access policies, server-side rendering, forensic watermarking, and an audit trail. It fits programs where CUI cannot leave the enclave and the endpoint must never hold the original.
- Supports control objectives — access, delivery, traceability, and deployment evidence for your SSP.
- Runs inside the boundary — on-premise or air-gapped, so the document never depends on a third-party cloud.
- Does not replace the program — CMMC assessment, CUI marking, and contractual flow-down remain yours.
- Built for evidence — the same logs that help an assessor help you investigate a real incident.
CUI protection is a program, not a product, and the programs that hold up are the ones where the technical controls produce evidence instead of promises. If your team is mapping document flows to 800-171 or preparing for a CMMC assessment, request a demo and we will trace the same document from a prime contractor to a subcontractor and back. For the wider public-sector context, read document security for government, and for the procurement angle see protecting public procurement documents.