• Home
  • Controlled Unclassified Information Policy

Controlled Unclassified Information Policy

Policy
Purpose: 

This policy outlines requirements for receiving, collecting, developing, handling, storing, processing, and maintaining information that falls into at least one of the Controlled Unclassified Information (CUI) registry categories, as listed on the National Archives and Records Administration (NARA) website. University employees who access CUI must safeguard this information as outlined by the National Institute of Standards and Technology (NIST) “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” standards (NIST 800-171), NARA, applicable Presidential Executive Orders, and contract clauses. NIST 800-171 defines the requirements for the protection of CUI data to reduce or eliminate inappropriate release of CUI. NARA provides all other pertinent information needed to properly handle CUI. These standards include physical and information technology (IT) security controls including access control, physical security standards, and IT system security.

Applies to: 

The following requirements apply to all University of Kansas faculty, staff, and students who receive federally sponsored funding and will have access to, store, and process CUI.

Campus: 
Edwards
Lawrence
Juniper Gardens
Parsons
Yoder
Topeka
Policy Statement: 

Proposals submitted for federal funding (including those submitted to federal prime contractors) that contain or have the potential to involve CUI program components must include appropriate budget line(s) to underwrite the cost associated with meeting NIST 800-171, contract, and NARA compliance requirements. This requirement applies regardless of the anticipated contracting vehicle that will be issued to the University (i.e., contract, grant, cooperative agreement, or subaward). The KU Office of Research, KU Global Operations and Security (GOS), and proposal or award information are resources for determining if sponsored funds require CUI compliance.

If the contracting vehicle supporting the collaboration does not include funding, such as unfunded Cooperative Research and Development Agreements (CRADA), researchers should correspond with the KU CUI contact by email at cui@ku.edu for a consultation on how much funding to request.

System Security Plan

The University maintains a Controlled Unclassified Information System Security Plan (SSP) in compliance with federal standards. KU Information Technology (KU IT) and GOS are responsible for maintaining, updating, and controlling the SSP.

Researchers who receive federal funding subject to CUI security requirements shall:

  • Complete a Technology Control Plan (TCP) with the TCP Assessment Team. The TCP Assessment Team includes staff from Global Operations and Security, the KU IT Security Office, the Kansas Applied Research Lab, and the KU IT Network Engineering team. TCPs are reviewed by the Principal Investigator (PI), Department Chair, and Dean. TCPs must be approved by the Director of GOS prior to beginning work on the project and spending funds.
  • Use University approved CUI computing services and equipment for all information classified as CUI. Use of standalone computer systems or networks or systems not part of the University approved CUI program is prohibited.
  • Store, process, and handle CUI data and materials in environments documented and approved in the TCP. Storing and handling CUI data and materials in areas not defined and approved in the TCP is prohibited.
  • Email GOS at gos@ku.edu and the KU Information Technology Security Office (ITSO) at itsec@ku.edu for questions regarding TCP and information technology security requirements.

Awareness and Training

Each researcher participating in a CUI project shall complete the appropriate training prior to engaging in research. Training requirements will be outlined in the TCP. Training must be completed annually. Training topics include, but are not limited to, proper handling of CUI, general cyber security topics, export control compliance, and insider threat training.

Monitoring and Auditing

The TCP Assessment Team shall conduct monitoring and audit reviews of any CUI-funded project. These reviews will cover both physical and information security.

Physical security: The TCP Assessment Team shall conduct annual reviews of the activities covered by the TCP for each project. Reviews may include, but are not limited to, the following:

  • Implementation of physical security controls;
  • Implementation of information security controls;
  • Personnel review to ensure all researchers are listed in the TCP as participants; and
  • Review of training compliance for all participants.

The TCP Assessment Team shall produce a report following the review and provide a copy to the PI and Department Chair. If deficiencies are found, the TCP Assessment Team shall work with the PI and unit to address the deficiencies. The specifics of self-assessment activities are outlined in each TCP.

In addition to the annual review, the PI is responsible for conducting periodic self-reviews throughout the life of their TCP. If there are changes in the project or individuals participating in the research, the PI must inform GOS immediately. The PI is responsible for informing the Director of GOS at gos@ku.edu of any violations of the TCP immediately upon recognizing the issue. 

Information security: Information logs must be collected and stored for continuous monitoring by the ITSO. The information logs include, but are not limited to, activities concerning management, resource and system security, and diagnostics. The activities to be logged must be specified in the TCP. The ITSO and GOS shall investigate in the case of anomalies or other concerns.

Exclusions or Special Circumstances: 

Any exceptions to this policy will be considered on a case-by-case basis by emailing the Director of GOS at gos@ku.edu. The researcher requesting an exception will be required to provide a justification for the exception with concurrence of the Chair, Dean, and Vice Chancellor for Research.

Consequences: 

Violation of this policy may result in the full range of sanctions, including loss of privileges to access KU’s approved CUI computing service without notice, a hold on research funding, disciplinary action, suspension, termination of employment, dismissal from the University, and legal action. Some violations may constitute criminal offenses under local, state, and federal laws. If appropriate, the University will carry out its responsibility to report such violations to the appropriate authorities.

Additionally, students could be subject to disciplinary action under the Code of Student Rights and Responsibilities.

Contact: 

Office of Global Operations & Security
2029 Becker Drive, Room 139
Lawrence, KS 66047
gos@ku.edu
785-864-1859

Approved by: 
Provost and Executive Vice Chancellor
Approved on: 
Thursday, September 30, 2021
Effective on: 
Thursday, September 30, 2021
Review Cycle: 
Annual (As Needed)
Keywords: 
NIST 800-171, CUI, Controlled Unclassified Information, DFARS, ITAR, CMMC, Technology Control Plan (TCP), Export Control, Information Security, Physical Security
Change History: 

09/30/2021: New Policy published in the Policy Library.

Information Access & Technology Categories: 
Privacy & Security
Research and Sponsored Projects Category: 
Research and Sponsored Projects

Can't Find What You're Looking For?
Policy Library Search
KU Today
One of 34 U.S. public institutions in the prestigious Association of American Universities
Nearly $290 million in financial aid annually
44 nationally ranked graduate programs.
—U.S. News & World Report
Top 50 nationwide for size of library collection.
—ALA
23rd nationwide for service to veterans —"Best for Vets," Military Times