WEBVTT
00:00:00.000 --> 00:00:01.760
Welcome to NISPOM Central.
00:00:01.840 --> 00:00:08.000
This is our podcast at our YouTube channel and of course information from here also goes on our newsletters.
00:00:08.240 --> 00:00:11.839
Well today I want to talk to you about CMMC.
00:00:12.480 --> 00:00:13.439
No, not really.
00:00:13.599 --> 00:00:14.880
I'm tired of reading about it.
00:00:14.960 --> 00:00:18.480
What I want to talk to you about is protecting CUI.
00:00:18.960 --> 00:00:22.160
Protecting CUI is a security manager's job.
00:00:22.320 --> 00:00:23.600
I want to emphasize that.
00:00:23.760 --> 00:00:31.440
It's the security manager's job, however, it requires input from the program managers and their personnel.
00:00:31.600 --> 00:00:46.880
For example, if somebody is developing a weapon system for a government customer, it is up to that, those employees in your organizations who are working on that system to identify, mark, and protect that CUI.
00:00:48.159 --> 00:00:52.479
It is not the cybersecurity professionals or the IT professionals.
00:00:53.679 --> 00:01:01.600
If we are relying totally on CMMC to protect our sensitive information, we're losing the battle.
00:01:01.920 --> 00:01:02.399
Why?
00:01:02.560 --> 00:01:11.840
It's just like starting a bank and putting money into the bank without accounting for how much money it is, or items in the bank without accounting for what the value is.
00:01:12.000 --> 00:01:16.000
We just put it in the bank, let it sit there, and hopefully everybody treats it right.
00:01:16.159 --> 00:01:20.640
But once it starts producing interest or growing in value, nobody's tracking it.
00:01:20.799 --> 00:01:26.079
Nobody's tracked what was put into the bank and nobody tracks the value afterwards.
00:01:26.239 --> 00:01:33.359
Whatever is derived off those original products that we put into that bank account or that bank vault is not being tracked.
00:01:33.599 --> 00:01:35.599
Who wants to go to a bank like that?
00:01:35.760 --> 00:01:44.719
Well, that's what I think we do when we relegate the protection of sensitive information to a cyber construct.
00:01:44.959 --> 00:01:46.719
Not that there's anything wrong with it.
00:01:46.879 --> 00:01:49.359
I think we do need a good cyber construct.
00:01:49.519 --> 00:02:04.719
I think we do need good banks, but we need people inside the organizations who can account for, document, mark, and derive products so that we can track how we are using that in our workflow.
00:02:04.959 --> 00:02:06.480
This is not being done.
00:02:06.719 --> 00:02:18.639
When it's relegated to cyber and IT professionals, they're going to do great at doing their job, but I've seen people step back from their responsibilities on identifying and protecting sensitive information.
00:02:19.039 --> 00:02:30.400
The issue is a lack of consistency in identifying and marking that sensitive information and working on it in that workflow that the organization is executing on.
00:03:19.280 --> 00:03:24.560
If it's in hard copy, soft copy, if it's a big thing, we've got to protect it.
00:03:24.960 --> 00:03:38.960
Whether the prime contractor or the subcontractors, wherever you are in that tier, whether government, prime, or sub, protection should be consistent all along that supply chain.
00:03:39.520 --> 00:03:47.199
Now, this I say again is a job for security professionals, but I believe we've relegated that job to those IT people.
00:03:47.520 --> 00:03:48.159
Why?
00:03:48.560 --> 00:03:50.560
I I've got a few ideas.
00:03:50.719 --> 00:04:04.800
One is in social media and online forums, the entire time that we talk about CUI is from the point of view of cybersecurity or IT or this CMMC construct that we're working with.
00:04:05.039 --> 00:04:08.479
I've got some things to say about CMMC, but I'll do that at another time.
00:04:08.560 --> 00:04:09.919
So I hope you'll come back.
00:04:10.080 --> 00:04:19.439
Again, this is a job for security professionals working in coordination with people, program managers, their employees, engineers, etc.
00:04:19.680 --> 00:04:21.600
Whoever's working on a contract.
00:04:21.839 --> 00:04:32.800
Again, if you're commercial, whatever your business is working on, you need to, the people who are working in the business need to understand what they're doing and how they're working on it.
00:04:33.199 --> 00:04:49.680
While it is important to understand how to build networks and store sensitive information, it may require additional efforts and analysis and training and documentation that is required to do this job.
00:04:49.920 --> 00:04:56.000
FSOs and security managers, risk managers, program managers understand how to do this.
00:04:56.160 --> 00:05:07.040
While cybersecurity professionals and CMMC professionals may understand the NIST, they may not understand the intimate details of performing on contract and what that looks like.
00:05:10.639 --> 00:05:15.519
I think we have relegated our responsibilities, and there's many ways I can prove it right now.
00:05:15.680 --> 00:05:24.879
One is when you read the NIST palm and it says DCSA will not be reviewing CUI unless it's a contract requirement.
00:05:25.120 --> 00:05:28.399
Many people had said, okay, CUI is out of my scope.
00:05:28.560 --> 00:05:32.560
But I'm going to tell you, it's going to come back to you, FSOs and security managers.
00:05:32.720 --> 00:05:38.560
We need to bring CUI into our scope and help our program managers with protecting it.
00:05:39.279 --> 00:05:43.199
CUI protection is required in CMMC and NIST.
00:05:43.519 --> 00:05:45.920
We hear that all the time in our social media posts.
00:05:46.160 --> 00:05:50.319
Security community is not proactive in protecting this CUI.
00:05:50.480 --> 00:05:53.199
We talk about it, but in terms of CMMC.
00:05:53.360 --> 00:05:57.040
And when I mean protecting CUI, I'm going to harp on this all the time.
00:05:57.279 --> 00:06:03.360
What is our organization doing with the CUI that is put under our control?
00:06:04.959 --> 00:06:08.240
A lot of people don't even recognize they're receiving CUI.
00:06:08.879 --> 00:06:16.959
CUI discussions occur in CMMC communities, and when many FSOs discuss it, it's from a CMMC point of view.
00:06:17.120 --> 00:06:27.040
We're trying to figure out how to work within CMMC instead of trying to figure out what exactly the CUI is and how we're using it within our organization.
00:06:27.759 --> 00:06:35.920
And you know, if you just follow all the social media and CUI discussions, there are very few that are led from this point of view.
00:06:36.000 --> 00:06:39.519
They're mostly led from a cyber protection point of view.
00:06:39.839 --> 00:06:46.639
I get what I'm saying is broad generalizations, but again, my observations are what is prevalent out there.
00:06:46.800 --> 00:06:52.879
It may be different in your organization, and if so, if you're doing what I'm saying or recommending, I applaud what you're doing.
00:06:52.959 --> 00:06:55.519
But this is kind of a wake-up call for our community.
00:06:55.680 --> 00:07:01.040
While CMMC is important, it may go away, requirements may change.
00:07:01.199 --> 00:07:03.519
I don't know what's going to look like a year from now.
00:07:03.759 --> 00:07:09.120
But realize that any type of technical solution is not the solution.
00:07:09.360 --> 00:07:16.560
We've got to still go in and do our part to identify how we're using it and if we're marking it and how we're protecting it.
00:07:16.800 --> 00:07:19.920
This is not specifically an IT or cyber job.
00:07:20.079 --> 00:07:33.680
They can do it, but I recommend whoever has this responsibility has a job title similar to this job title, which is CI CUI control officer or something like that.
00:07:33.920 --> 00:07:47.600
We have to understand from the top down, from the prime to the sub what the CUI is and how it's presented by our customers and what they expect us to do with it.
00:07:47.680 --> 00:07:52.879
And then what are we doing with that CUI once it's in our possession?
00:07:53.839 --> 00:07:59.279
The application here is that a government contracting activity identifies a CUI.
00:07:59.600 --> 00:08:01.920
You're not going to get a CUI marking guide, right?
00:08:02.000 --> 00:08:11.600
You're going to get source documents, you might get an item, you might get an engineering design document or software design document, kickoff slides, whatever.
00:08:11.680 --> 00:08:13.279
But these are going to be marked.
00:08:13.360 --> 00:08:22.480
And if you have these in your possession and you're working on that project, then consider what you are deriving and give it the appropriate markings.
00:08:24.079 --> 00:08:36.320
Facility security officers, program managers should team to review contracts, work performance statements, whatever that is imposed by the customer.
00:08:36.879 --> 00:08:42.639
You might be looking at the 254, but if you're on unclassified contracts, you won't have a 254.
00:08:42.879 --> 00:08:51.840
And again, your customer may not give you a guide, but they may give you guidance, and it's up to you to take that guidance and apply it to your workshop.
00:08:52.159 --> 00:09:06.000
You might be providing a service, you might be working a help desk, you might be working in healthcare, where you are accessing government systems and downloading them onto your corporate computers.
00:09:06.320 --> 00:09:18.159
Realizing that if you take something that is provided by the government and it's marked CUI and you bring it on your organization's computers, you must protect it as CUI.
00:09:18.240 --> 00:09:26.960
And if you use it in your products for reports or to provide customer service, you must protect that as CUI as well.
00:09:27.279 --> 00:09:36.320
You might consider what you upload to those government websites, those might be CUI as well.
00:09:36.559 --> 00:09:44.159
For example, PII, first of all, identifiable information that you might get from human resources might be PII.
00:09:44.399 --> 00:09:49.440
But if you use it for a government purpose, you might need to consider that CUI.
00:09:49.519 --> 00:09:51.519
It depends on what guidance that you get.
00:09:52.480 --> 00:09:57.840
Now, you also might get some written guidance, some technical guidance.
00:09:57.919 --> 00:10:15.519
You might get slides, presentations, engineering design documents, as I mentioned earlier, drawings, if it's marked, notice what the marking is and use it appropriately for all derived products and bring your teams in together, discuss it, and figure out what it is.
00:10:16.639 --> 00:10:25.759
Analyzing all the requirements and applying it to your workload is one of the least things, but most important things that you can do.
00:10:25.919 --> 00:10:36.320
Sure it'll take a lot of time, but if you continue to rely on technical countermeasures alone, such as what CMMC might bring in, you're going to lose it.
00:10:36.639 --> 00:10:53.919
Just like that bank that takes in all this information that they think is valuable, but don't track interest, don't track who deposited, how much was deposited, well that can walk out of your protected bank at any time without you even noticing it.
00:10:54.159 --> 00:11:04.080
If you're relying on CMMC and you have an enclave, sensitive information can be removed without your knowing it if it's not properly accounted for.
00:11:06.960 --> 00:11:09.360
Alright, one more thing before we go.
00:11:09.679 --> 00:11:17.519
Some FSOs and security managers have asked, what if we're working on something and we don't know whether or not it's CUI?
00:11:17.679 --> 00:11:21.360
Or what if the government gives us something that's not marked CUI?
00:11:21.519 --> 00:11:22.720
Where do we start?
00:11:22.879 --> 00:11:26.399
And I usually respond with, of course you don't know it's C UI.
00:11:26.559 --> 00:11:28.000
You don't work on it every day.
00:11:28.240 --> 00:11:36.720
The best thing to do is go to your program manager that is in your organization or the employees that are working on it and get clarification.
00:11:36.960 --> 00:11:41.519
Chances are they know what is CUI because they're working on it every day.
00:11:41.759 --> 00:11:45.679
They just need help with the accounting and the derivative part.
00:11:46.080 --> 00:11:47.919
Something that you can be control of.
00:11:48.080 --> 00:11:51.519
What do you do when you have CUI and you teach them what to do it?
00:11:51.759 --> 00:12:00.720
But if you want the CUI left and right guidelines or understand better what the CUI is, go to your program managers, your engineers.
00:12:00.879 --> 00:12:01.600
They know.
00:12:02.000 --> 00:12:10.159
If they don't know or if they understand what that guidance is, chances are they're sitting on it and you might have to help them with that part.
00:12:10.399 --> 00:12:17.120
However, if there is a chance that nobody in your organization knows what to do, the next best thing is go up the chain.
00:12:17.279 --> 00:12:22.159
If you're a subcontractor, you need to approach the program managers that are in the primes.
00:12:22.559 --> 00:12:23.600
They will know.
00:12:23.840 --> 00:12:31.039
If they don't know, or if you are the prime, you need to go to the government program office and negotiate that.
00:12:31.200 --> 00:12:35.440
Hey, this is marked as CUI and we don't understand why.
00:12:35.679 --> 00:12:38.480
Or this is not marked, we believe it is CUI.
00:12:38.639 --> 00:12:41.039
What can we do to resolve this problem?
00:12:41.279 --> 00:12:45.279
We're not going to do that internally because it's not available to us.
00:12:45.440 --> 00:12:49.279
We need to go to the source and request that for them.
00:12:49.440 --> 00:13:03.120
There's no way that I, as a compliance officer, an IT manager, or cybersecurity officer, or even an FSO can understand what is CY in my workload unless I'm intimately familiar with it.
00:13:03.360 --> 00:13:06.240
For that, I need to go to the source.
00:13:06.639 --> 00:13:09.039
Hey, if you have any questions, just let me know.
00:13:09.120 --> 00:13:14.559
And thanks for sticking around for this episode of NISPOM Central.
00:13:26.720 --> 00:13:28.639
Or from people within your organization.
00:13:28.879 --> 00:13:32.000
Just for that, I'm putting together a special lesson.
00:13:32.159 --> 00:13:40.240
And this lesson will be featured in my learning management system at called NISPOM Central, and it's on Teachable.
00:13:40.320 --> 00:13:50.799
Now I'll put a link to there in this, but you can also go to NISPOMCentral.com or NISPOM.com to find links to that training.
00:00:00.000 --> 00:00:01.760
Welcome to NISPOM Central.
00:00:01.840 --> 00:00:08.000
This is our podcast at our YouTube channel and of course information from here also goes on our newsletters.
00:00:08.240 --> 00:00:11.839
Well today I want to talk to you about CMMC.
00:00:12.480 --> 00:00:13.439
No, not really.
00:00:13.599 --> 00:00:14.880
I'm tired of reading about it.
00:00:14.960 --> 00:00:18.480
What I want to talk to you about is protecting CUI.
00:00:18.960 --> 00:00:22.160
Protecting CUI is a security manager's job.
00:00:22.320 --> 00:00:23.600
I want to emphasize that.
00:00:23.760 --> 00:00:31.440
It's the security manager's job, however, it requires input from the program managers and their personnel.
00:00:31.600 --> 00:00:46.880
For example, if somebody is developing a weapon system for a government customer, it is up to that, those employees in your organizations who are working on that system to identify, mark, and protect that CUI.
00:00:48.159 --> 00:00:52.479
It is not the cybersecurity professionals or the IT professionals.
00:00:53.679 --> 00:01:01.600
If we are relying totally on CMMC to protect our sensitive information, we're losing the battle.
00:01:01.920 --> 00:01:02.399
Why?
00:01:02.560 --> 00:01:11.840
It's just like starting a bank and putting money into the bank without accounting for how much money it is, or items in the bank without accounting for what the value is.
00:01:12.000 --> 00:01:16.000
We just put it in the bank, let it sit there, and hopefully everybody treats it right.
00:01:16.159 --> 00:01:20.640
But once it starts producing interest or growing in value, nobody's tracking it.
00:01:20.799 --> 00:01:26.079
Nobody's tracked what was put into the bank and nobody tracks the value afterwards.
00:01:26.239 --> 00:01:33.359
Whatever is derived off those original products that we put into that bank account or that bank vault is not being tracked.
00:01:33.599 --> 00:01:35.599
Who wants to go to a bank like that?
00:01:35.760 --> 00:01:44.719
Well, that's what I think we do when we relegate the protection of sensitive information to a cyber construct.
00:01:44.959 --> 00:01:46.719
Not that there's anything wrong with it.
00:01:46.879 --> 00:01:49.359
I think we do need a good cyber construct.
00:01:49.519 --> 00:02:04.719
I think we do need good banks, but we need people inside the organizations who can account for, document, mark, and derive products so that we can track how we are using that in our workflow.
00:02:04.959 --> 00:02:06.480
This is not being done.
00:02:06.719 --> 00:02:18.639
When it's relegated to cyber and IT professionals, they're going to do great at doing their job, but I've seen people step back from their responsibilities on identifying and protecting sensitive information.
00:02:19.039 --> 00:02:30.400
The issue is a lack of consistency in identifying and marking that sensitive information and working on it in that workflow that the organization is executing on.
00:03:19.280 --> 00:03:24.560
If it's in hard copy, soft copy, if it's a big thing, we've got to protect it.
00:03:24.960 --> 00:03:38.960
Whether the prime contractor or the subcontractors, wherever you are in that tier, whether government, prime, or sub, protection should be consistent all along that supply chain.
00:03:39.520 --> 00:03:47.199
Now, this I say again is a job for security professionals, but I believe we've relegated that job to those IT people.
00:03:47.520 --> 00:03:48.159
Why?
00:03:48.560 --> 00:03:50.560
I I've got a few ideas.
00:03:50.719 --> 00:04:04.800
One is in social media and online forums, the entire time that we talk about CUI is from the point of view of cybersecurity or IT or this CMMC construct that we're working with.
00:04:05.039 --> 00:04:08.479
I've got some things to say about CMMC, but I'll do that at another time.
00:04:08.560 --> 00:04:09.919
So I hope you'll come back.
00:04:10.080 --> 00:04:19.439
Again, this is a job for security professionals working in coordination with people, program managers, their employees, engineers, etc.
00:04:19.680 --> 00:04:21.600
Whoever's working on a contract.
00:04:21.839 --> 00:04:32.800
Again, if you're commercial, whatever your business is working on, you need to, the people who are working in the business need to understand what they're doing and how they're working on it.
00:04:33.199 --> 00:04:49.680
While it is important to understand how to build networks and store sensitive information, it may require additional efforts and analysis and training and documentation that is required to do this job.
00:04:49.920 --> 00:04:56.000
FSOs and security managers, risk managers, program managers understand how to do this.
00:04:56.160 --> 00:05:07.040
While cybersecurity professionals and CMMC professionals may understand the NIST, they may not understand the intimate details of performing on contract and what that looks like.
00:05:10.639 --> 00:05:15.519
I think we have relegated our responsibilities, and there's many ways I can prove it right now.
00:05:15.680 --> 00:05:24.879
One is when you read the NIST palm and it says DCSA will not be reviewing CUI unless it's a contract requirement.
00:05:25.120 --> 00:05:28.399
Many people had said, okay, CUI is out of my scope.
00:05:28.560 --> 00:05:32.560
But I'm going to tell you, it's going to come back to you, FSOs and security managers.
00:05:32.720 --> 00:05:38.560
We need to bring CUI into our scope and help our program managers with protecting it.
00:05:39.279 --> 00:05:43.199
CUI protection is required in CMMC and NIST.
00:05:43.519 --> 00:05:45.920
We hear that all the time in our social media posts.
00:05:46.160 --> 00:05:50.319
Security community is not proactive in protecting this CUI.
00:05:50.480 --> 00:05:53.199
We talk about it, but in terms of CMMC.
00:05:53.360 --> 00:05:57.040
And when I mean protecting CUI, I'm going to harp on this all the time.
00:05:57.279 --> 00:06:03.360
What is our organization doing with the CUI that is put under our control?
00:06:04.959 --> 00:06:08.240
A lot of people don't even recognize they're receiving CUI.
00:06:08.879 --> 00:06:16.959
CUI discussions occur in CMMC communities, and when many FSOs discuss it, it's from a CMMC point of view.
00:06:17.120 --> 00:06:27.040
We're trying to figure out how to work within CMMC instead of trying to figure out what exactly the CUI is and how we're using it within our organization.
00:06:27.759 --> 00:06:35.920
And you know, if you just follow all the social media and CUI discussions, there are very few that are led from this point of view.
00:06:36.000 --> 00:06:39.519
They're mostly led from a cyber protection point of view.
00:06:39.839 --> 00:06:46.639
I get what I'm saying is broad generalizations, but again, my observations are what is prevalent out there.
00:06:46.800 --> 00:06:52.879
It may be different in your organization, and if so, if you're doing what I'm saying or recommending, I applaud what you're doing.
00:06:52.959 --> 00:06:55.519
But this is kind of a wake-up call for our community.
00:06:55.680 --> 00:07:01.040
While CMMC is important, it may go away, requirements may change.
00:07:01.199 --> 00:07:03.519
I don't know what's going to look like a year from now.
00:07:03.759 --> 00:07:09.120
But realize that any type of technical solution is not the solution.
00:07:09.360 --> 00:07:16.560
We've got to still go in and do our part to identify how we're using it and if we're marking it and how we're protecting it.
00:07:16.800 --> 00:07:19.920
This is not specifically an IT or cyber job.
00:07:20.079 --> 00:07:33.680
They can do it, but I recommend whoever has this responsibility has a job title similar to this job title, which is CI CUI control officer or something like that.
00:07:33.920 --> 00:07:47.600
We have to understand from the top down, from the prime to the sub what the CUI is and how it's presented by our customers and what they expect us to do with it.
00:07:47.680 --> 00:07:52.879
And then what are we doing with that CUI once it's in our possession?
00:07:53.839 --> 00:07:59.279
The application here is that a government contracting activity identifies a CUI.
00:07:59.600 --> 00:08:01.920
You're not going to get a CUI marking guide, right?
00:08:02.000 --> 00:08:11.600
You're going to get source documents, you might get an item, you might get an engineering design document or software design document, kickoff slides, whatever.
00:08:11.680 --> 00:08:13.279
But these are going to be marked.
00:08:13.360 --> 00:08:22.480
And if you have these in your possession and you're working on that project, then consider what you are deriving and give it the appropriate markings.
00:08:24.079 --> 00:08:36.320
Facility security officers, program managers should team to review contracts, work performance statements, whatever that is imposed by the customer.
00:08:36.879 --> 00:08:42.639
You might be looking at the 254, but if you're on unclassified contracts, you won't have a 254.
00:08:42.879 --> 00:08:51.840
And again, your customer may not give you a guide, but they may give you guidance, and it's up to you to take that guidance and apply it to your workshop.
00:08:52.159 --> 00:09:06.000
You might be providing a service, you might be working a help desk, you might be working in healthcare, where you are accessing government systems and downloading them onto your corporate computers.
00:09:06.320 --> 00:09:18.159
Realizing that if you take something that is provided by the government and it's marked CUI and you bring it on your organization's computers, you must protect it as CUI.
00:09:18.240 --> 00:09:26.960
And if you use it in your products for reports or to provide customer service, you must protect that as CUI as well.
00:09:27.279 --> 00:09:36.320
You might consider what you upload to those government websites, those might be CUI as well.
00:09:36.559 --> 00:09:44.159
For example, PII, first of all, identifiable information that you might get from human resources might be PII.
00:09:44.399 --> 00:09:49.440
But if you use it for a government purpose, you might need to consider that CUI.
00:09:49.519 --> 00:09:51.519
It depends on what guidance that you get.
00:09:52.480 --> 00:09:57.840
Now, you also might get some written guidance, some technical guidance.
00:09:57.919 --> 00:10:15.519
You might get slides, presentations, engineering design documents, as I mentioned earlier, drawings, if it's marked, notice what the marking is and use it appropriately for all derived products and bring your teams in together, discuss it, and figure out what it is.
00:10:16.639 --> 00:10:25.759
Analyzing all the requirements and applying it to your workload is one of the least things, but most important things that you can do.
00:10:25.919 --> 00:10:36.320
Sure it'll take a lot of time, but if you continue to rely on technical countermeasures alone, such as what CMMC might bring in, you're going to lose it.
00:10:36.639 --> 00:10:53.919
Just like that bank that takes in all this information that they think is valuable, but don't track interest, don't track who deposited, how much was deposited, well that can walk out of your protected bank at any time without you even noticing it.
00:10:54.159 --> 00:11:04.080
If you're relying on CMMC and you have an enclave, sensitive information can be removed without your knowing it if it's not properly accounted for.
00:11:06.960 --> 00:11:09.360
Alright, one more thing before we go.
00:11:09.679 --> 00:11:17.519
Some FSOs and security managers have asked, what if we're working on something and we don't know whether or not it's CUI?
00:11:17.679 --> 00:11:21.360
Or what if the government gives us something that's not marked CUI?
00:11:21.519 --> 00:11:22.720
Where do we start?
00:11:22.879 --> 00:11:26.399
And I usually respond with, of course you don't know it's C UI.
00:11:26.559 --> 00:11:28.000
You don't work on it every day.
00:11:28.240 --> 00:11:36.720
The best thing to do is go to your program manager that is in your organization or the employees that are working on it and get clarification.
00:11:36.960 --> 00:11:41.519
Chances are they know what is CUI because they're working on it every day.
00:11:41.759 --> 00:11:45.679
They just need help with the accounting and the derivative part.
00:11:46.080 --> 00:11:47.919
Something that you can be control of.
00:11:48.080 --> 00:11:51.519
What do you do when you have CUI and you teach them what to do it?
00:11:51.759 --> 00:12:00.720
But if you want the CUI left and right guidelines or understand better what the CUI is, go to your program managers, your engineers.
00:12:00.879 --> 00:12:01.600
They know.
00:12:02.000 --> 00:12:10.159
If they don't know or if they understand what that guidance is, chances are they're sitting on it and you might have to help them with that part.
00:12:10.399 --> 00:12:17.120
However, if there is a chance that nobody in your organization knows what to do, the next best thing is go up the chain.
00:12:17.279 --> 00:12:22.159
If you're a subcontractor, you need to approach the program managers that are in the primes.
00:12:22.559 --> 00:12:23.600
They will know.
00:12:23.840 --> 00:12:31.039
If they don't know, or if you are the prime, you need to go to the government program office and negotiate that.
00:12:31.200 --> 00:12:35.440
Hey, this is marked as CUI and we don't understand why.
00:12:35.679 --> 00:12:38.480
Or this is not marked, we believe it is CUI.
00:12:38.639 --> 00:12:41.039
What can we do to resolve this problem?
00:12:41.279 --> 00:12:45.279
We're not going to do that internally because it's not available to us.
00:12:45.440 --> 00:12:49.279
We need to go to the source and request that for them.
00:12:49.440 --> 00:13:03.120
There's no way that I, as a compliance officer, an IT manager, or cybersecurity officer, or even an FSO can understand what is CY in my workload unless I'm intimately familiar with it.
00:13:03.360 --> 00:13:06.240
For that, I need to go to the source.
00:13:06.639 --> 00:13:09.039
Hey, if you have any questions, just let me know.
00:13:09.120 --> 00:13:14.559
And thanks for sticking around for this episode of NISPOM Central.
00:13:26.720 --> 00:13:28.639
Or from people within your organization.
00:13:28.879 --> 00:13:32.000
Just for that, I'm putting together a special lesson.
00:13:32.159 --> 00:13:40.240
And this lesson will be featured in my learning management system at called NISPOM Central, and it's on Teachable.
00:13:40.320 --> 00:13:50.799
Now I'll put a link to there in this, but you can also go to NISPOMCentral.com or NISPOM.com to find links to that training.
