Email and CUI: What Can Go in Outlook and What Cannot

You can send and store Controlled Unclassified Information in Outlook only if the email system behind it is part of the environment you protect under NIST SP 800-171, and only if every recipient has a lawful government purpose to receive it. Outlook is the window you look through. The rules attach to the mailbox, the tenant that hosts it, the device that opens it and the person on the other end.

This week's commentary on the FAR overhaul, including a Dentons alert on the new FAR Part 40, points again toward a government-wide CUI framework for contractors. That framework is still pending. The FAR CUI rule is a proposed rule, not a final one. Email is still worth getting right now, because it is where CUI most often escapes, and because your contract or agency may already require NIST SP 800-171 protections whatever happens with the FAR.

Does a civilian contractor have to follow CMMC rules for email?

No. CMMC is a Department of War program. It applies to defense contracts through the DFARS, including clause 252.204-7012 and the CMMC clauses. If your work is with civilian agencies under GSA Schedules or similar vehicles, CMMC does not govern your email, and the DFARS cloud requirements that come with clause 7012 do not apply to you automatically.

That does not leave civilian contractors without obligations. The executive branch CUI program is set out in 32 CFR Part 2002, which the National Archives administers. It tells agencies that when CUI is processed on a contractor's systems, they should require NIST SP 800-171 protections through the contract or agreement. The proposed FAR CUI rule would standardize this across civilian agencies, but it has not been finalized, and its final text, timing and details are not settled. Today, your obligations come from the clauses and agreements in your own contract. Read them first.

It is also important to know what does not exist. There is no civilian certification for CUI handling, and no third party can certify your email as "CUI approved" for civilian agencies. What you can do is implement the controls, document them and be ready to show your agency how you meet them.

What has to be true before CUI can go through your email?

Think of it as a short set of conditions. If any one of them fails, CUI should not travel through that mailbox.

The mail system is inside your defined CUI boundary. Your system security plan should name the email service, the tenant and the devices that touch it.
The service provider is covered by your external service controls. NIST SP 800-171 Rev 3 includes requirements for external system services, which means you need to understand and document how your email provider protects CUI on your behalf.
Messages are protected in transit and at rest. Rev 3 requires cryptographic protection of CUI. It lets the organization define certain parameters, and your agency or contract may set them for you. FIPS-validated cryptography is the expectation most federal customers bring, so confirm what your provider uses and what your contract asks for.
Access is controlled. That means multifactor authentication, no shared accounts and access limited to people who need the information for the contract.
Devices that open the mailbox are managed. A personal phone with Outlook installed and no management or protection is a common gap.
The recipient is authorized. CUI may be shared only for a lawful government purpose and within any dissemination controls attached to it.

Microsoft 365 is a common example, but the same logic applies to any provider. Microsoft offers several cloud environments, including commercial, GCC and GCC High, and they differ in authorizations and data handling commitments. For defense work, GCC High is often discussed because of DFARS and export control expectations. For civilian work there is no single required environment. The right choice depends on your contract, the CUI categories you handle and what your agency expects. Check the provider's own documentation and the FedRAMP Marketplace for the specific service offering, not the brand name.

What should never go through Outlook, even in a protected tenant?

Some things are off limits regardless of how well your tenant is configured.

CUI sent to personal email accounts, including your own, for any reason.
CUI sent to anyone without a lawful government purpose to receive it, including teaming partners who are not on the contract or are not covered by an agreement.
CUI pasted into the body or subject line of a message to an outside party when the conversation could have stayed inside a controlled system.
CUI carrying dissemination controls or specified handling requirements that your email environment cannot meet. Some categories in the CUI Registry, such as export controlled information, have rules beyond the baseline. If a category has limits on who may access it, a general purpose mailbox may not be suitable.
CUI moved out through automatic forwarding rules, mail sync to unmanaged apps or shared mailboxes with broad membership.

The subject line deserves special attention. It appears in notifications, previews and server logs that people rarely think about. Keep CUI out of it.

How should CUI be marked in an email?

The National Archives publishes marking guidance through its CUI program. Under that guidance, an email that contains CUI should carry a CUI banner marking at the top of the message body, and attachments that contain CUI should be marked themselves. The banner tells the recipient they are handling controlled information before they read further.

If your agency provides CUI documents, follow the markings the agency applied. Do not remove them when you forward, quote or summarize. If you are unsure whether information you created on a contract counts as CUI, ask your contracting officer or the agency point of contact. Under the CUI program, the agency decides what is CUI, not the contractor.

A practical habit helps. When CUI must go to an authorized external recipient, many teams share a link to a controlled repository instead of attaching the file. The recipient authenticates, access is logged and you can revoke it later. An attachment, once sent, is out of your control.

What are the most common email mistakes with CUI?

Most CUI spills through email are ordinary mistakes, not attacks.

Autocomplete picks the wrong recipient with a similar name.
A reply all pulls in someone outside the contract.
An employee forwards a thread to a personal account to work from home.
A shared mailbox has members who left the project months ago.
A phone with the mail app installed is lost and was never enrolled in device management.

Each of these maps to controls you already need under NIST SP 800-171 Rev 3: access control, awareness training, configuration management and incident response. If CUI does go to the wrong place, treat it as a potential incident and follow your contract's reporting clause. The proposed FAR rule includes incident reporting expectations, but because it is not final, the clause in your current contract governs today.

Frequently Asked Questions

Can I send CUI through Outlook as a civilian federal contractor?

Yes, if the email system behind Outlook is inside your NIST SP 800-171 boundary, protects CUI with cryptography that meets your contract's expectations, enforces strong access control and is used only to send to authorized recipients. Outlook itself is just the client. The protections that matter are in the mail service, the tenant configuration and the devices.

Do civilian contractors need GCC High to handle CUI in email?

Not automatically. GCC High comes up most often in defense work because of DFARS and export control expectations, which do not apply to civilian contracts by default. The right environment for civilian work depends on your contract clauses, the CUI categories you handle and what your agency expects, so confirm those before choosing.

Is the FAR CUI rule in effect for civilian contractors?

No. The FAR CUI rule is a proposed rule and has not been finalized. Civilian contractors may still be required to protect CUI under NIST SP 800-171 through specific contract clauses or agency agreements, as directed by the executive branch CUI program in 32 CFR Part 2002.

Is there a certification that proves my email is safe for civilian CUI?

No. There is no civilian equivalent of CMMC certification for CUI handling. You show compliance by implementing NIST SP 800-171 controls, documenting them in your system security plan and being ready to explain them to your agency.

How do I mark an email that contains CUI?

Place a CUI banner marking at the top of the message body and mark any attachments that contain CUI, following the National Archives CUI marking guidance and any instructions from your agency. Keep CUI out of the subject line, and never remove agency markings when forwarding or quoting.

What should I do if CUI is emailed to the wrong person?

Treat it as a potential incident. Follow the incident response procedure in your security plan and the reporting clause in your contract, and contact your contracting officer or agency point of contact as the contract directs.

Sources

Want a second set of eyes on the CUI terms in your GSA Schedule contract or task orders? Talk to the GSA Ready Now team.

Talk to a Compliance Specialist