One Page CUI Handling Procedure for Civilian Contractors

If your firm handles Controlled Unclassified Information on a civilian contract, the most useful document you can write this quarter is one page long. It tells every person who touches CUI what it looks like, where it may live, how to share it, how to get rid of it and who to call when something goes wrong.

Long policies have their place, and NIST SP 800-171 Rev 3 does expect documented policies and procedures. But the document that protects information day to day is the one people can read in two minutes and keep pinned next to their monitor.

Why does a civilian contractor need its own CUI procedure when most of the advice is about CMMC?

Much of what was published this week frames CUI protection almost entirely through CMMC. Training announcements, explainers and blog posts keep pairing "identify and protect CUI" with "understand CMMC requirements," and at least one piece suggests that any contractor holding CUI needs to comply with CMMC. That is the defense picture, and it is incomplete for everyone else.

CMMC is a Department of War program. It applies through Department of War contracts and the clauses in them. A GSA Schedule holder or a small firm supporting a civilian agency is not brought under CMMC just because it handles CUI. There is no civilian equivalent of a CMMC certification, and no third party can certify you as compliant for civilian purposes.

That does not mean civilian contractors have no obligations. The government wide CUI program is set out in 32 CFR Part 2002, managed by the National Archives, and agencies pass CUI safeguarding requirements to contractors through their contract terms. A proposed FAR rule on CUI was published in January 2025 and would create a uniform contract clause across civilian agencies. It is still a proposed rule, not a requirement in force, and its final shape and timing are not settled.

There was also a widely shared post this week about GSA cybersecurity requirements for contractors handling CUI on GSA contracts. GSA does publish IT security procedural guidance on protecting CUI in nonfederal systems. Whether that guidance binds you depends on what your specific contract or task order incorporates, so read your own clauses rather than relying on a social media summary.

Here is what all of that means in practice. Your obligations come from your contract today, and a clear internal procedure is the fastest way to show you take them seriously, whatever the final rule turns out to say.

What should actually go on the page?

Keep it to the decisions an ordinary employee makes. Seven short sections cover almost everything:

What CUI looks like here. Name the contracts or task orders that involve CUI, describe the kinds of documents your staff will see, and tell people to look for the "CUI" banner marking at the top of a page or email. Add one line saying that unmarked information the government tells you is CUI is still CUI.
Where CUI may live. List the specific approved systems by name, such as one file share, one email tenant or one project folder. Then say plainly that CUI does not go anywhere else: not personal email, not personal cloud storage, not a phone's photo roll, not a public AI tool.
Who may see it. CUI is shared with people who need it to do the contract work. Tell staff to confirm need before forwarding, and to check with the named contact before sending CUI to a subcontractor or anyone outside the firm.
How to send it. Use only the approved encrypted method, name it, and keep the CUI marking on anything you forward, print or derive from the original.
How to handle paper and devices. Keep printed CUI out of view when you are away, lock it up at the end of the day, and do not take it home unless your procedure allows it. Removable media gets the same rules as the system it came from.
How to get rid of it. Paper goes in the approved shredder or locked destruction bin. Files and devices are disposed of only through the named person, because federal rules require CUI to be destroyed so it cannot be read or recovered.
What to do if something goes wrong. If CUI is sent to the wrong person, lost, left on an unapproved system or seen by someone who should not see it, stop, do not try to quietly fix it, and tell the named contact right away. Many contracts have short incident reporting windows, so speed matters more than certainty.

Close the page with one name, one phone number and one email address. If people do not know who to ask, they will guess.

How do you write it so people follow it?

Most procedures fail because they read like they were written for an auditor rather than for the person doing the work. A few habits help.

Write in the imperative. "Save CUI only in the Contracts folder" works better than "Personnel are expected to ensure that CUI is retained within authorized repositories."

Use your real system names. Staff do not think in terms of "the authorized information system." They think in terms of the folder they open every morning.

Say what not to do. The most common mistakes are predictable: forwarding to a personal account, pasting into an unapproved tool, printing to a shared printer and walking away. Name them.

Test it on someone new. Hand the draft to a recent hire or a part time staff member and ask them to explain it back. Wherever they hesitate, rewrite.

Review it when something changes. A new contract, a new system or a new subcontractor is a reason to update the page. So is a near miss.

How does a one page procedure connect to NIST SP 800-171 Rev 3?

NIST SP 800-171 Rev 3, finalized in May 2024, is the current version of the standard for protecting CUI in nonfederal systems. It asks organizations to have documented policies and procedures, to train users and to handle media, physical access and incidents in a controlled way. Your one page procedure is not a replacement for that work. It is the part of that work your staff actually touch.

Think of it as a summary layer. Your system security plan and fuller policies describe how you meet each requirement. The one page procedure turns the parts that depend on human behavior into plain instructions. It supports awareness and training, media protection, physical protection and incident response, and it gives you something concrete to point to when a contracting officer or agency asks how your people handle CUI.

One caution: which version of NIST SP 800-171 any given contract or final rule will point to is not something to assume. Check the clause language in your own contracts, and do not describe your firm as "certified" against the standard. On the civilian side, no such certification exists.

What should you leave off the page?

Leave off anything that does not change what a person does. Regulatory citations, control numbers, risk methodology and system architecture belong in your fuller documentation. On the page, they push the useful instructions out of view.

Also leave off promises you cannot keep. If your procedure says every CUI file is encrypted at rest and one system is not, you have created a written gap. Describe what you actually do, then improve it.

Finally, do not pad the page with defense requirements that do not apply to you. If you have no Department of War contracts, CMMC language on your procedure will confuse your staff and may mislead a customer about what you have.

Frequently Asked Questions

Do civilian federal contractors need CMMC certification to handle CUI?

No. CMMC is a Department of War program that applies through Department of War contracts. Civilian contractors handle CUI under the terms of their own contracts and the government wide CUI program in 32 CFR Part 2002. There is no CMMC equivalent certification on the civilian side.

Is the FAR CUI rule in effect?

No. The FAR CUI rule was published as a proposed rule in January 2025 and has not been finalized. Until a final rule is issued, civilian contractors' CUI obligations come from the clauses in their individual contracts. The final rule's content and timing are not settled.

What is a CUI handling procedure?

A CUI handling procedure is a short internal document that tells staff how to recognize, store, share, dispose of and report problems with Controlled Unclassified Information. It turns contract and NIST SP 800-171 obligations into plain instructions. For a small firm, one page is often enough for daily use.

Does a one page procedure satisfy NIST SP 800-171 Rev 3?

Not by itself. NIST SP 800-171 Rev 3 covers many technical and administrative requirements that a single page cannot address. A one page procedure supports the requirements that depend on staff behavior, such as training, media handling and incident reporting, alongside a fuller security plan.

How do I know whether information is CUI?

Start with your contract and any markings the government applies, such as the "CUI" banner at the top of a document. The National Archives maintains a CUI Registry listing the categories of information that qualify. If you are unsure, ask your contracting officer rather than guessing.

What should staff do if CUI is sent to the wrong person?

They should stop, avoid trying to fix it quietly and report it right away to the person named in your procedure. Many contracts set short reporting windows for incidents involving CUI. Fast, honest reporting protects both the information and your firm's standing with the agency.

Sources

Want a second set of eyes on the CUI terms in your GSA Schedule contract or task orders? Talk to the GSA Ready Now team.

Talk to a Compliance Specialist

Write a One Page CUI Handling Procedure Your Civilian Staff Will Actually Follow