Controlled Unclassified Information (CUI) Handling

Marking

• All received CUI materials are marked at the top and bottom of each page with the CUI banner and (where present) the source category, dissemination controls, and limited-dissemination control markings.
• Email containing CUI uses an explicit CUI banner in the subject line and body.
• CUI materials we generate inherit the source markings; mixed-content materials use the highest-marking-applies rule.

Storage and transmission

• CUI is stored on systems that meet NIST SP 800-171 r3 controls; access requires named user, MFA, and need-to-know.
• Transmission uses FIPS-validated cryptography (TLS 1.2+ with FIPS modules; AES-256 at rest).
• Cloud services hosting CUI are FedRAMP Moderate (or equivalent) authorized.
• Physical media containing CUI travel in tamper-evident packaging with chain of custody.

Decontrol and destruction

CUI is decontrolled only by the originating agency or under conditions specified in 32 CFR § 2002.18. Destruction follows NIST SP 800-88 r1 sanitization methods, with certificates retained for the period required by the contract.

Personnel training

Personnel with access to CUI complete annual CUI training covering the CUI Registry, marking, handling, and incident reporting. New hires complete initial training before access is granted.

Incident handling

Suspected CUI compromise is reported within 72 hours of discovery to the contracting officer (DFARS 252.204-7012) and to security@partsperk.com for internal triage and customer notification coordination.