Adam Strange, Global Marketing Director at Titus, by HelpSystems, talks us through the 5 steps towards effective CUI classification
Prior to the U.S. government’s National Archives and Records Administration’s (NARA) implementation of the CUI (Controlled Unclassified Information) protection framework, government agencies employed ad hoc agency-specific policies, procedures, and markings to safeguard and control all information that did not meet the criteria required for classification. The rule was designed to primarily safeguard sensitive government data that had not been assigned as confidential or secret, whilst it was shared between different government and commercial entities.
This confusing patchwork resulted in inconsistent marking and safeguarding of documents, which led to unclear or unnecessarily restrictive dissemination policies and the creation of barriers to authorised information sharing. CUI didn’t have much of an established profile before the framework was implemented and yet, this kind of material falling into the wrong hands could mean something as serious as national security being put at risk.
Success in winning a government contract could depend on how your organisation addresses CUI. Whilst it isn’t classified data, the data is still sensitive enough to require controls and as such its release could still pose a threat to national security. It is critical for organisations wishing to work with the government to ensure they are compliant with CUI standards. To achieve this there are five key steps to master the principles of data classification, involving the categorisation and labelling of data.
What exactly is CUI?
CUI covers data that is created or possessed by, or on behalf of, the government when it resides in non-federal information systems and is handled by non-federal organisations. And its most critical element – the standardised labelling of CUI to ensure that appropriate protections can be implemented and consistently enforced – makes the rule actionable by those handling CUI.
The CUI framework is more about people than technology. CUI registry, which specifies, by category and subcategory, which marking must be applied to a particular data subject, also details critical procedures relating to the handling, safeguarding and control of the data as it moves through non-federal systems.
Across ‘CUI Basic’, ‘CUI Specified’ and ‘Limited Dissemination’, the marking/labeling is central to ensuring that CUI data is handled and secured in appropriate ways, and is only accessible to users who need to work with it, with appropriate downstream security controls across all IT systems, devices and databases.
Today, as a matter of strict compliance, both federal and non-federal organisations must evidence that they comply with NARA’s guidelines, to meet both legal and contractual obligations. This includes demonstrating a comprehensive information security and classification program that ensures that all points where data travels or resides are treated as locations where CUI must be controlled.
This must address 14 key areas of technical security and compliance including audits, training, access control, configuration management, identification and authentication, incident response, maintenance, media protection, physical protection, personnel security, risk assessment, security assessment, system and communications protection and system and information integrity.
The 5 steps to effective CUI classification
With the right tools and training, organisations can demonstrate they have the capabilities in place to recognise and handle any type of CUI classification and labelling, and also produce evidence where necessary. This breaks down into five key steps:
-
Identify
Know the CUI you create, process, store and disseminate. Understand your contracting security obligations or partner organisation’s security policies and what you need to do to comply with both these and the new framework. This includes understanding the types of information that needs to be marked, what language must be used and what the markings mean.
-
Discover
Get visibility of what CUI you are required to process, where it comes from, where it resides, where it is sent and who might have access to it. From here establish what controls you need to put on it.
-
Classify
Select a technology solution that will enable users to consistently apply the classification scheme, add critical metadata to the file and, via clear labeling, control who should have access to each type of CUI. Start with classifying ‘live’ data including emails, files and documents that are being received, created and handled right now. Then move on to labeling existing and legacy CUI that is stored and held around the organisation.
-
Secure
Employ the tools that will control and protect CUI through its journey. The metadata label will enable higher grade controls such as DLP solutions, security incident and event monitoring (SIEM) tools, access control tools and data governance tools to safeguard data when it’s accessed or used later.
-
Monitor
CUI frameworks evolve over time so use monitoring and reporting tools to track how CUI is being accessed, used and classified in your organisation, and keep the background intelligence needed to evolve the approach in line with regulatory changes constantly available.
Failing to adequately protect CUI has considerable implications. A data leak that exposes a client or breaches a regulation could lead to a damaged reputation and brand, penalties and the possible loss of business. By adopting the CUI framework, organisations can demonstrate the ability to protect federal government information and enhance their ability to respond to opportunities to work with the U.S. government.
