# Contractors Determine CUI Scope

A DEFCERT presentation by CEO Ryan Bonner explains how defense contractors should determine whether information is Controlled Unclassified Information (CUI): assess applicable laws and regulations, government data rights, and contract requirements rather than relying on broad labels or CUI Registry summaries alone. It distinguishes government information contractors deliver or hold from proprietary information they retain internally, and recommends inventorying information, reviewing deliverables, and limiting CUI exposure across systems and suppliers. The presentation also references DoD marking guidance revised January 10 in the 2023 presentation context.

- Contractors can use these criteria when scoping information-handling obligations for a contract and deciding which information and systems warrant CUI protections.
- Reviewing deliverables and separating government information from internally retained proprietary data can help clarify the scope of contractor information systems.
- The presentation cautions that a system containing even one CUI document may be a covered contractor information system under a DoD contract; procurement and security teams should assess system scope accordingly.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 04, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Archives and Records Administration (NARA)
- National Institute of Standards and Technology (NIST)

### Vendors
- DEFCERT (CUI scoping and determination consultant)

### Key Quotes
> If there's even one CUI document in that system, it's a covered contractor information system if under a DOD contract.
> — Ryan Bonner (DEFCERT CEO)

### Sources
- [I'm keep getting confused about what's CUI or what's not. Can you guys recommend me some resource/YT video which will help me understand the actual definition of it???](https://www.reddit.com/r/CMMC/comments/1xno1tx/im_keep_getting_confused_about_whats_cui_or_whats) - reddit-cmmc