PM-17 Protecting Controlled Unclassified Information on External Systems
a. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
b. Review and update the policy and procedures pm-17_prm_1.
| Parameter ID | Definition |
|---|---|
| pm-17_prm_1 | organization-defined frequency |
| pm-17_odp.01 | frequency |
| pm-17_odp.02 | frequency |
Baselines
- L
- M
- H
- P
Guidance
Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) and, specifically for systems external to the federal organization, [32 CFR 2002.14h](https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/xml/CFR-2017-title32-vol6-part2002.xml) . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes.
References 4
- 32 CFR 2002 Code of Federal Regulations, Title 32, *Controlled Unclassified Information* (32 C.F.R. 2002).
- SP 800-171 Ross RS, Pillitteri VY, Dempsey KL, Riddle M, Guissanie G (2020) Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-171, Rev. 2.
- SP 800-172 Ross RS, Pillitteri VY, Graubart RD, Guissanie G, Wagner R, Bodeau D (2020) Enhanced Security Requirements for Protecting Controlled Unclassified Information: A Supplement to NIST Special Publication 800-171 (Final Public Draft). (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-172.
- NARA CUI National Archives and Records Administration, Controlled Unclassified Information (CUI) Registry.
Related controls 2
- CA-06 Authorization L M H P
- PM-10 Authorization Process L M H P