CUiGuide.com
Sign in

Answers people search for

What to do. What to show. The template.

CUI is Controlled Unclassified Information. CMMC Level 2 assesses NIST SP 800-171 Revision 2 through the 320 objectives in NIST SP 800-171A. These answers are the work. The workbench holds the template.

Questions

What is CUI?

CUI is Controlled Unclassified Information. It is unclassified federal information that still requires safeguarding under 32 CFR Part 2002 and the NARA CUI Registry.

Do this. Name the CUI category the contract actually calls, the system that stores it, and the person who owns that system.

There's a template for that.

What is CMMC Level 2?

CMMC Level 2 is the Department of Defense program that assesses a contractor against NIST SP 800-171 Revision 2. The assessable unit is the objective in NIST SP 800-171A: 320 objectives across 110 requirements. One open objective fails the requirement.

Do this. Stop scoring at the control name. Open the objective. 3.1.1[a] is not 3.1.1.

There's a template for that.

What do I need to do first?

Start with what you have. Upload existing policies, diagrams, exports, or notes—a little or a lot. If there is nothing to upload yet, describe the boundary and where CUI enters, rests, and exits. Descriptions establish the starting point; they are not evidence.

Produce. A component list, three hops, and any available documents. CUiGuide will show what is still needed. Identity, MFA, and logging cannot be left blank.

There's a template for that.

What evidence do I produce for an objective?

The mechanism and the record. A policy that only names access control is mention-only. It does not close the objective.

Example. For authorized users: the roster, the owner, and one add ticket and one remove ticket from the last 90 days.

There's a template for that.

What does the config look like between government cloud and commercial?

Commercial Microsoft 365 is not the CUI boundary. GCC High is a US Government tenant. Labels that say CUI are required, guest sharing is restricted, and admin accounts are separate.

Tap to look closer
Commercial tenant versus GCC High. The commercial tenant is not where CUI rests.
Produce. Tenant name, label policy export, conditional access policy, and the line that says what Microsoft runs and what you still show.

There's a template for that.

What does a CUI dataflow look like?

Ordered hops. Each hop is enters, processed, stored, or exits, tied to a component and a transport. Do not draw a hop you cannot name.

Tap to look closer
A flow a lead can accept. Missing admin VDI stays unresolved. It is not invented onto the diagram.

There's a template for that.

What does a printer VLAN look like?

CUI printers do not sit on guest Wi-Fi. Corporate devices reach a print server. The printer VLAN accepts badge release. Guest has no route there.

Tap to look closer
VLAN 10 to 20 to 30. VLAN 99 does not route to the printers.
Produce. The VLAN map, the deny rule, the printer inventory, and one badge-release log.

There's a template for that.

How do I draw Wi-Fi campus boundaries?

Corporate SSID can reach CUI. Guest SSID is internet only. Plant or OT wireless is outside the boundary, or Specialized with a written reason.

Tap to look closer
Two SSIDs minimum. Guest does not reach file shares or CUI printers.

There's a template for that.

Show me an SSP control implementation statement.

Name the system, the mechanism, the owner, and the file. The statement stays proposed until the lead approves it.

Tap to look closer
3.5.3, written as this environment, not as a control definition.

There's a template for that.

What am I getting with this tool?

A firm workbench and a client workbench. The client sees one project. You get the objective worklist, the blocking list, a draft SPRS, and a mock result: ready for self-assessment, or not. CUiGuide does not certify and does not post to SPRS.

The export header says it. Worklist for readiness. Not a certificate. Not an SPRS posting.

There's a template for that.

How do I know a module is FIPS-validated, and what evidence do I need?

Look the module up on the NIST CMVP validated-module list. The brochure is not the certificate. Record the certificate number, the module name, and the version, and show that version is what is installed.

Tap to look closer
Four artifacts. Encryption that is missing cannot use the FIPS scheduling exception.
The rule. 3.13.11 may be scheduled only when encryption is already in use and only FIPS validation is missing. That exception is in 32 CFR 170.21.

There's a template for that.

Which requirements cannot go on a POA&M?

A POA&M cannot hold a requirement worth more than one point, except the FIPS case above. These six never go on a POA&M: 3.1.20 external connections, 3.1.22 public information, 3.12.4 system security plan, 3.10.3 escort visitors, 3.10.4 physical access logs, and 3.10.5 manage physical access.

Do this. Fix those before you talk about a conditional score. Conditional Level 2 still needs at least 88.

There's a template for that.

What does a draft SPRS score mean?

The DoD assessment methodology starts at 110 and deducts the published weight, 1, 3, or 5, for each unmet requirement. One open objective fails the requirement. A score in CUiGuide is a draft from coverage. It is not an SPRS submission.

Produce. The draft number, the distance to 88, and the blocking requirement ids. Quote it only after the lead confirms it.

There's a template for that.

What is shared responsibility in GCC High?

Microsoft runs the cloud service. You still show who is authorized, how MFA is enforced, and where CUI is labeled. A vendor claim does not mark an objective met.

Produce. Provider, the part you still must show, and the evidence still missing.

There's a template for that.

What MFA evidence closes 3.5.3?

The conditional access policy export, plus one admin sign-in and one user sign-in that show MFA. A sentence that says MFA is enabled does not close it.

Produce. Policy export and two log lines, tied to 3.5.3[a] and 3.5.3[b].

There's a template for that.

See the templates in the workbench.

Answers for readiness, not a certificate.

Request a demo