CUI Handling Notice

1. Regulatory Authority

The Controlled Unclassified Information (CUI) Program was established by Executive Order 13556, signed November 4, 2010, to standardize the way the Executive branch handles unclassified information that requires safeguarding or dissemination controls. The implementing regulations are codified at 32 C.F.R. Part 2002.

2. CUI Categories

Documents within our repository may contain information designated under the following CUI categories:

• CUI//SP-EXPT: Export-controlled technical data
• CUI//SP-INFRA: Critical infrastructure information
• CUI//SP-TECH: Sensitive technical specifications
• CUI//SP-PRVCY: Privacy-protected information

3. Recipient Eligibility

Access to CUI is limited to individuals who:

• Have a lawful government purpose for accessing the information
• Have been properly vetted through our intake process
• Represent entities registered with SAM.gov with valid UEI identifiers
• Have acknowledged and agreed to comply with CUI handling requirements
• Operate from approved network environments meeting federal security standards

4. Handling Requirements

Recipients of CUI must:

• Store CUI on authorized information systems only
• Transmit CUI only through encrypted, approved channels
• Limit access to individuals with lawful government purpose
• Mark reproductions with appropriate CUI designations
• Report suspected unauthorized disclosures immediately
• Destroy CUI in accordance with approved destruction methods

5. Dissemination Controls

CUI obtained from our repository may not be further disseminated without prior written authorization from Strategic Supply Resilience LLC. Unauthorized disclosure may result in civil penalties, termination of access privileges, and referral to appropriate federal authorities.

6. Security Compliance

Our information systems and handling procedures are designed to meet the security requirements specified in NIST Special Publication 800-171 for protecting CUI in nonfederal systems and organizations. Regular assessments are conducted to verify compliance with these standards.

7. Incident Reporting

Any suspected or confirmed unauthorized access, disclosure, modification, or destruction of CUI must be reported immediately through our Vetted Intake Portal with "CUI INCIDENT" noted in your communication. Incident reports are processed within 24 hours.