#UPDATE: Final version available from the CMMC Information Institute website (https://lnkd.in/eSN5NEdU) and in the comments below. The United States Department of Defense recently published a memo that updates their Controlled Unclassified Information ("CUI") program, as reflected in DODI 5200.48, to be more consistent with certain aspects of 32 CFR 2002. As you may know, 32 CFR 2002 is the authorizing legislation that created the CUI program and applies to the entire Executive Branch, so removing some of the inconsistencies is a great step toward the agency-agnostic approach envisioned for the CUI program! More specifically, the memo (link below) removes DODI 5200.48's requirement regarding the need for review of CUI before it can be released by a federal agency to a foreign entity. DoDI 5200.48 now (properly) only requires review when the CUI is subject to export controls or a limited dissemination control like NOFORN. The memo can be found here: https://lnkd.in/gbUfrcCX The memo has created a bit of a stir in the government contractor space. Some are interpreting it as applying to government contractors, and that is not the case. The memo applies to the release of CUI by DoD, as an agency of the federal government, to a foreign entity (which has a specific definition in 32 CFR 2002). The unfortunate side-effect of the memo is that it seems to have created much more confusion about how and when CUI can be disclosed to non-US persons. The CMMC Information Institute has prepared the flowchart, below, to help people with this analysis. A higher resolution version will be available on our website tomorrow. Thank you to all those who weighed in on early drafts! We hope it is helpful!
We all know that Mary in no way should ever want access to that CUI ?? Run Mary Run!
Dave Miller
4 个月
Must know when to tell Mary no!
Thank you to Scott Edwards for pointing out that the initial version, above, does not address the scenario where the disseminator has a license to export the CUI. This has been corrected in the version below.