CONTROLLED UNCLASSIFIED INFORMATION
Requirements for non-federal organisations that handle US Controlled Unclassified Information.
01
Non-federal organisations that store, process or transmit US Controlled Unclassified Information, usually under a US Department of Defense contract clause (DFARS 252.204-7012) or a prime contractor's flow-down. UK defence and aerospace suppliers in a US prime's chain meet it that way. Revision 2 has 110 requirements in 14 families; Revision 3 (May 2024) has 97 requirements in 17 families; the contract clause sets which revision applies.
02
A requirement-by-requirement gap assessment against the revision the contract names, a System Security Plan and Plan of Action and Milestones in the form the prime expects, and the self-assessment score the contract asks for, with the evidence held in the same system as ISO 27001 and Cyber Essentials.
03
The supplier self-assesses and the prime or the contracting officer accepts it. Where CMMC applies, see CMMC.
04
Many of the controls overlap; the gap assessment shows which ISO 27001 evidence already answers each requirement.
05
Scoped on the diagnostic. Any third-party fee is paid direct.
Scoped on the diagnosticBring the contract, questionnaire or buyer request. The diagnostic establishes the scope and the evidence route.
We use cookies and similar technologies to measure how this site is used, to see which organisations visit and to measure our advertising. Until you choose, Google tags run in a consent-limited mode that sets no cookies. If you accept, we load Google Analytics 4 and Google Ads with cookies, PostHog, Plausible, Microsoft Clarity, which records session replays, and Apollo. Read our Cookies policy.