What Level of System and Network Configuration Is Required for CUI? A Complete Guide

What Level of System and Network Configuration Is Required for CUI? A Complete Guide

If you have hit this question in a training module, the answer you need is moderate confidentiality. That is the correct option, and it is worth knowing it comes from federal regulation rather than from a textbook convention. But moderate confidentiality is a classification, not an instruction, and knowing the label does not tell you what to actually configure. This guide covers both: the answer, and what it requires you to do.

The Direct Answer

Moderate confidentiality.

The regulatory basis is 32 CFR 2002.14, the federal rule governing CUI safeguarding. It states that in accordance with FIPS PUB 199, CUI Basic is categorized at no less than the moderate confidentiality impact level.

That phrasing matters. It is a floor, not a ceiling. Moderate is the minimum, and certain categories or agreements can require more.

So when asked what level of system and network configuration is required for CUI, the answer is moderate confidentiality, and the citation behind it is 32 CFR 2002.14 read alongside FIPS 199.

Why the Other Options Are Wrong

Training questions asking what level of system and network configuration is required for CUI typically offer distractors like basic, enhanced, or advanced confidentiality. Understanding why they are incorrect clarifies the framework.

FIPS 199 defines exactly three impact levels: Low, Moderate, and High. There is no basic, enhanced, or advanced level in that scheme. Those terms are invented distractors, which is why recognizing the actual FIPS 199 structure makes the question straightforward.

• Low is insufficient. CUI requires safeguarding by law, regulation, or government-wide policy, which places it above the low threshold by definition.
• High is not required as a baseline. High confidentiality corresponds to information whose unauthorized disclosure would have severe or catastrophic effect, which is above the standard CUI requirement.
• Moderate is the specified minimum, corresponding to a serious adverse effect from unauthorized disclosure.

Note that FIPS 199 applies impact levels across three objectives: confidentiality, integrity, and availability. The CUI requirement specifically addresses confidentiality, since CUI is fundamentally about controlling disclosure.

What Moderate Confidentiality Actually Means

FIPS 199 defines the moderate impact level as the point where a loss of confidentiality could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

Serious adverse effect is further characterized as significant degradation of mission capability, significant damage to assets, significant financial loss, or significant harm to individuals not involving loss of life or serious life-threatening injuries.

This is the conceptual justification for the requirement. CUI is not classified national security information, but its unauthorized disclosure carries consequences serious enough to warrant more than baseline protection.

The Framework Behind the Answer

Answering what level of system and network configuration is required for CUI properly means understanding which document applies to your situation, because the answer routes differently for federal agencies and for contractors.

For federal agencies, 32 CFR 2002.14 directs application of FIPS 200 and NIST SP 800-53 controls at the moderate baseline, subject to risk-based tailoring.

For contractors and other nonfederal organizations, NIST SP 800-171 is the operative standard. It was written specifically to translate the federal moderate-confidentiality expectation into requirements that a nonfederal system can implement.

This distinction trips people up regularly. A defense contractor asking what level of system and network configuration is required for CUI is answered by moderate confidentiality conceptually, but implemented through NIST SP 800-171 practically.

NIST SP 800-171 in Practice

For nonfederal organizations, this is where the abstract answer becomes an actual configuration checklist.

Revision 2, the version most widely referenced in existing contracts, contains 110 security requirements organized into 14 families:

• Access Control
• Awareness and Training
• Audit and Accountability
• Configuration Management
• Identification and Authentication
• Incident Response
• Maintenance
• Media Protection
• Personnel Security
• Physical Protection
• Risk Assessment
• Security Assessment
• System and Communications Protection
• System and Information Integrity

NIST released Revision 3 in 2024, which restructured the requirement families and changed the requirement count. This matters practically: check which revision your specific contract references, since obligations follow the contract language rather than the newest publication. Organizations frequently find themselves assessed against the version cited in their agreement.

The Configuration Requirements That Follow

Translating the answer to what level of system and network configuration is required for CUI into actual technical implementation produces a recognizable set of controls.

Access control. Limit system access to authorized users, processes, and devices. Apply least privilege so users can reach only what their role requires. Separate duties where practical. Control remote access and limit CUI access to authorized sessions.

Identification and authentication. Uniquely identify every user. Implement multifactor authentication for network access to privileged accounts and for remote access. Enforce password complexity and prohibit reuse.

Encryption. Protect CUI confidentiality both at rest and in transit. Critically, the requirement specifies FIPS-validated cryptography, meaning the cryptographic module must be validated under the FIPS 140 program. Using strong encryption that is not FIPS-validated does not satisfy the requirement, which is a common and expensive misunderstanding.

Boundary protection. Monitor and control communications at external system boundaries and at key internal boundaries. Implement subnetworks for publicly accessible components, separating them from internal networks. Deny network traffic by default and allow by exception.

Audit and accountability. Create and retain audit logs sufficient to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized activity. Ensure actions can be traced to individual users. Protect audit information from unauthorized modification.

Configuration management. Establish and maintain baseline configurations. Enforce security configuration settings. Apply the principle of least functionality by disabling unnecessary programs, ports, protocols, and services. Control and monitor user-installed software.

System and information integrity. Identify, report, and correct flaws in a timely manner. Provide protection from malicious code. Monitor security alerts and advisories and take action.

Media protection. Protect CUI on system media, control access, sanitize or destroy media before disposal or reuse, and mark media containing CUI.

Incident response. Establish an operational incident-handling capability including preparation, detection, analysis, containment, recovery, and user response. Track, document, and report incidents.

Physical protection. Limit physical access to systems and equipment, escort visitors, and maintain physical access logs.

Documentation Requirements

An aspect frequently underestimated: implementing controls is not sufficient on its own. Two documents are effectively mandatory.

The System Security Plan (SSP) describes the system boundary, the operating environment, how each requirement is implemented, and the relationships with other systems. Assessors work from the SSP, and its absence is treated as a significant finding.

The Plan of Action and Milestones (POA&M) documents requirements not yet fully implemented, with specific remediation plans, resources, and target completion dates.

For DoD contractors, self-assessment scores are typically submitted to the Supplier Performance Risk System (SPRS), and an accurate score is a prerequisite for certain contract awards.

DFARS and CMMC

For defense contractors specifically, the contractual mechanism matters as much as the technical standard.

DFARS 252.204-7012 requires contractors handling covered defense information to provide adequate security, implement NIST SP 800-171, and report cyber incidents to the DoD within 72 hours of discovery. That reporting timeline is a hard requirement and organizations should know their procedure before an incident rather than during one.

CMMC adds verification. Rather than relying solely on self-attestation, the program introduces assessment requirements tied to contract eligibility. Handling CUI generally corresponds to CMMC Level 2, which aligns with the NIST SP 800-171 requirements, with assessment rigor varying by contract.

The practical consequence is that self-assessment alone may no longer suffice depending on the contract, and organizations should confirm their specific obligations rather than assuming.

CUI Basic Versus CUI Specified

A nuance worth understanding when considering what level of system and network configuration is required for CUI.

CUI Basic is the subset where the authorizing law, regulation, or government-wide policy does not prescribe specific handling controls. It gets the standard moderate confidentiality treatment.

CUI Specified is the subset where the authorizing authority does prescribe specific controls. Those specific requirements apply in addition to or instead of the baseline.

Both sit within the CUI framework at moderate confidentiality as the floor, but CUI Specified can carry additional obligations layered on top. If you handle CUI Specified categories, the controlling authority’s requirements must be consulted directly.

Importantly, 32 CFR 2002.14 also constrains agencies: they may increase CUI Basic’s confidentiality impact level above moderate only internally or through agreements, and may not otherwise impose higher or different controls on CUI Basic when disseminating it outside the agency. This prevents inconsistent requirements being pushed onto contractors arbitrarily.

Common Mistakes

Several errors recur across organizations implementing CUI protections.

Assuming encryption is enough. Encryption is one requirement among many. Access control, logging, configuration management, and incident response are equally mandatory.

Using non-FIPS-validated cryptography. As noted, strong is not the same as validated. Verify the module’s validation certificate.

Failing to scope the environment. Organizations frequently apply controls across their entire network when a properly scoped enclave holding CUI would be far cheaper and easier to assess. Conversely, scoping too narrowly while CUI leaks into email and personal devices creates real exposure.

Neglecting the SSP and POA&M. Controls without documentation fail assessments regardless of technical implementation quality.

Overlooking cloud service providers. If CUI touches a cloud environment, the provider must meet the relevant requirements, and FedRAMP status becomes a consideration.

Treating it as one-time work. These are ongoing obligations requiring continuous monitoring, patching, log review, and periodic reassessment.

Ignoring the human layer. Awareness and training is an explicit requirement family, and personnel handling CUI need to know marking, handling, and destruction procedures.

A Practical Starting Sequence

For an organization beginning this work:

1. Determine whether you actually handle CUI, and which categories, since obligations differ for CUI Specified.
2. Identify the controlling contract language, including which NIST revision and whether CMMC applies.
3. Map where CUI lives across systems, email, endpoints, backups, and cloud services.
4. Define and document the system boundary, scoping deliberately rather than by default.
5. Conduct a gap assessment against the applicable requirements.
6. Write the SSP describing implementation of each requirement.
7. Build the POA&M for gaps, with dates and owners.
8. Remediate, prioritizing access control, MFA, FIPS-validated encryption, and logging.
9. Submit scores where required, such as to SPRS.
10. Establish continuous monitoring rather than treating compliance as complete.

Getting Advice

A closing caveat worth stating plainly. This is a general explanation of a regulatory framework, not compliance advice for a specific organization.

Requirements depend on your contract language, the CUI categories you handle, your agency relationship, and the revision cited in your agreement. Regulations in this area have also changed meaningfully in recent years, particularly around CMMC.

Organizations with genuine CUI obligations should work from the current authoritative sources, including the NIST publications themselves and the National Archives CUI Registry, and should engage qualified compliance support. Contract obligations carry real legal and financial consequences, and misjudging them is expensive.

The bottom line on what level of system and network configuration is required for CUI is that the answer is moderate confidentiality, established by 32 CFR 2002.14 in accordance with FIPS PUB 199, which categorizes CUI Basic at no less than the moderate confidentiality impact level. In practice that translates to FIPS 200 and NIST SP 800-53 moderate baseline controls for federal systems, and NIST SP 800-171 for nonfederal systems including contractors, implemented through access control, multifactor authentication, FIPS-validated encryption at rest and in transit, boundary protection, audit logging, configuration management, and incident response, and documented through a System Security Plan and POA&M.

Key Takeaways

• The required level is moderate confidentiality, per 32 CFR 2002.14 in accordance with FIPS PUB 199.
• Moderate is a floor rather than a ceiling, since CUI Specified and certain agreements can require more.
• FIPS 199 defines only three impact levels: Low, Moderate, and High, so basic, enhanced, and advanced are distractors.
• Moderate means unauthorized disclosure could be expected to cause a serious adverse effect.
• Federal agencies apply FIPS 200 and NIST SP 800-53 moderate baseline controls with risk-based tailoring.
• Nonfederal organizations and contractors implement NIST SP 800-171, the standard written for that purpose.
• Revision 2 contains 110 requirements across 14 families, while Revision 3 restructured them, so check your contract.
• Encryption must use FIPS-validated cryptographic modules; strong encryption alone does not satisfy the requirement.
• A System Security Plan and a POA&M are effectively mandatory, and their absence is a significant assessment finding.
• DFARS 252.204-7012 requires DoD contractors to report cyber incidents within 72 hours of discovery.
• CMMC adds verification beyond self-attestation, with CUI handling generally corresponding to Level 2.
• Scope the CUI environment deliberately, since over-scoping is costly and under-scoping creates real exposure.