2024 is a big year for heat treaters who work for the DoD. As Joe Coleman, cybersecurity officer at Bluestreak Consulting, explains, Controlled Unclassified Information is a key topic you need to understand if you want to maintain or grow contracts with the DoD this year.
This Cybersecurity Corner installment was released in part in Heat Treat Today’s March 2024 Aerospace print edition.
If you are a prime contractor for the Department of Defense (DoD) or a subcontractor, then you have CUI in one form or another whether it is in paper or digital format. Learn what is, and is not, considered Controlled Unclassified Information (CUI).
What Exactly Is Considered CUI?
The DoD handles CUI in many forms across its operations. CUI includes sensitive information that requires safeguarding but does not meet the criteria for classification as classified information. Examples of DoD CUI include:
- Export Controlled Information (ECI): Information that is subject to export control laws and regulations, such as technical data related to defense goods and services.
- For Official Use Only (FOUO): Information that is not classified but still requires protection from unauthorized disclosure for official government use.
- Critical Infrastructure Information (CII): Details about critical infrastructure elements like facilities, systems, networks, and assets that are essential for national security, economy, or public health.
- Privacy information: Personal information of individuals (e.g., Social Security numbers, medical records) that needs to be protected under privacy laws and regulations.
- Sensitive But Unclassified (SBU) Information: Information that, although unclassified, is sensitive and requires protection due to its potential impact if disclosed.
- Contract-related information: Non-public details within contracts, such as proprietary information, financial data, or technical specifications.
- Proprietary information: Data owned by an entity and protected by intellectual property rights or confidentiality agreements.
In the heat treating industry, DoD CUI might include various sensitive details related to heat treatment processes, materials, or specifications used in defense-related applications. Here are some potential examples of DoD CUI within the heat treating industry:
- Material specifications: Specifications for heat treated materials used in defense equipment, weapons systems, or components. This could include details about specific alloys, heat treatment methods, tempering, or hardening processes required for certain applications.
- Process documentation: Detailed procedures and technical information regarding heat treatment processes employed in the production of defense-related materials or components. This might involve specific temperature ranges, cooling rates, or other proprietary methods used in heat treating.
- Quality control data: Information related to quality control measures specific to heat treating in defense-related manufacturing. This could involve data on testing methodologies, inspection techniques, or standards compliance for heat treated materials used in critical defense systems.
- Research and development (R&D) information: Research findings, experimental data, or proprietary knowledge related to advancements in heat treatment technologies tailored for defense applications. This may include innovative heat treatment methods for enhancing material properties, durability, or performance in defense systems.
- Supplier information: Details about suppliers providing heat treatment services or materials to the defense industry, including contractual agreements, proprietary processes, or specifications specific to DoD projects.
- Cybersecurity measures: Information about cybersecurity measures employed within heat treatment facilities that handle DoD contracts or projects to safeguard sensitive data from cyber threats.
- Facility security protocols: Details regarding security protocols, access controls, and clearance requirements within heat treating facilities handling defense-related projects to prevent unauthorized access to sensitive information.
Other items that may be identified as CUI provided by the DoD or generated in support of fulfilling a DoD contract or order include, but are not limited to (in both paper and digital formats):
- Research and engineering data
- Engineering drawings and lists
- Technical reports
- Technical data packages
- Design analysis
- Specifications
- Test reports
- Technical orders
- Cybersecurity plans/controls
- IP addresses, nodes, links
- Standards
- Process sheets
- Manuals
- Data sets
- Studies and analyses and related information
- Computer software executable code and source code
- Contract deliverable requirements lists (CDRL)
- Financial records
- Contract information
- Conformance reports
What Is Not Normally Considered CUI?
Here are several examples of items that may not typically fall under DoD CUI for the heat treating industry:
- General industry standards: Information related to commonly accepted industry standards, processes, or procedures that are widely available and not specific to defense-related applications.
- Non-proprietary heat treatment techniques: Basic information about standard heat treatment methods or techniques that are publicly known and not proprietary to a particular organization or application within the defense sector.
- Publicly available research: Scientific or technical research findings, publications, or data that are publicly accessible, not subject to proprietary rights, and not specifically tied to defense-related advancements.
- Commonly shared best practices: Information regarding widely accepted best practices in heat treating that do not involve proprietary or classified techniques applicable solely to defense-related materials or components.
- Non-sensitive business operations: Routine business operations, administrative documents, or general non-sensitive communications within the heat treating industry that do not pertain to defense contracts or projects.
- Information approved for public release: Data that has been officially approved for public release by the DoD or other relevant authorities, ensuring it does not contain sensitive or classified details.
- Basic material specifications: Information about materials, alloys, or heat treatment processes widely used in commercial applications and not specifically tailored or modified for defense-related purposes.
I hope this information has been helpful to you. Please contact me with any questions and for a free consultation, with a complimentary detailed compliance ebook.
