CMMC and NIST SP 800-171AwarenessFoundation

CUI Handling and Marking

Recognize controlled unclassified information, mark it correctly and handle it safely

Duration: 1.5 hours
Modules: 4
Final exam: 70% to pass
Certificate: No expiry

$59

Lifetime access to the course and your certificate
Verifiable Certificate of Completion. Certificate does not expire.
3 exam attempts
Progress saved to your account on every slide

Buying for a team? Volume pricing from 5 seats

1 to 4 seats	List price
5 to 10 seats	15% off
11 to 20 seats	25% off
21 or more seats	35% off

Seats

$250.75

5 × $50.15 · save $44.25

Each seat is a single-use code. Send one to each learner; they sign in with their own account and earn their own certificate. Track progress on your Team page.

About this course

Controlled unclassified information (CUI) is the technical data, procurement information and export controlled material that flows through every defense supply chain. Drawings, models, process sheets, test reports and the emails that carry them are all covered. Mishandling it breaches your contract, can be an export violation and is the most common root cause behind the incidents DoD receives.

This awareness course teaches the person who actually touches CUI: the buyer, the machinist, the inspector, the document controller, the engineer. You learn to tell federal contract information, CUI and classified information apart, to read and apply the banner line, category markings and designation indicator, and to store, share, carry, print and destroy CUI without losing control of it. The final module covers cyber incidents and spills, the company's 72-hour duty to report to DoD and your duty to report within minutes.

The course is awareness level. It is anchored on 32 CFR Part 2002, the NARA CUI Registry, DoDI 5200.48, DFARS 252.204-7012 and NIST SP 800-171. It does not give legal advice and does not replace your company's procedures; where the two differ, follow your security officer and empowered official.

The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course content and your certificate. The certificate does not expire.

What you will be able to do

Distinguish federal contract information, CUI Basic, CUI Specified and classified information, and name the categories a supplier meets most.
Explain who designates and decontrols CUI and what lawful government purpose and need to know mean for your access.
Read and apply a CUI banner line, category markings, limited dissemination controls and designation indicator, and treat legacy markings such as FOUO correctly.
Mark emails, documents, drawings, models, program files and physical media that contain or derive from CUI.
Store, access, transmit, share, print, carry and destroy CUI in line with 32 CFR Part 2002 and NIST SP 800-171.
Recognize a cyber incident or spill and carry out your reporting and evidence preservation duties under DFARS 252.204-7012.

Course outline

1
What CUI is and is not
Federal contract information, controlled unclassified information and classified information are three different things. Learn the categories a supplier meets most, who designates CUI and what lawful government purpose means.
About 20 minutes, then a module quiz
2
Marking CUI correctly
The banner line, category markings and limited dissemination controls, the designation indicator, portion marking, legacy markings such as FOUO, and how to mark emails, drawings, models, files and physical media.
About 20 minutes, then a module quiz
3
Handling CUI day to day
Storage, need-to-know access, encrypted transmission, sharing with sub-tiers, printing, travel, clean desk, destruction and decontrol: what to do with CUI from the moment it arrives until it leaves.
About 22 minutes, then a module quiz
4
Incidents, spills and reporting
What counts as a cyber incident or a spill, the company's 72-hour duty to report to DoD, your duty to report within minutes, what to preserve and what not to touch.
About 18 minutes, then a module quiz
Final examination and certificate
10 questions drawn from the course bank. Score 70% or higher to receive your Certificate of Completion.

Who it is for

Shop floor, inspection, stockroom and shipping staff who handle government drawings and travelers
Buyers, planners, document controllers and programme administrators on defense contracts
Engineers and programmers who create or export technical data
Managers and security officers who need a short course to assign to every employee in CUI scope

Prerequisites

None.

Questions

Does this course satisfy the CUI training requirement in my contract or in NIST SP 800-171?

It covers the topics most companies include in their CUI awareness training and gives you a record of completion. Whether it satisfies a specific contract depends on what the contract and your security officer require. Many companies use it as the base and add a short briefing on their own procedures and points of contact.

Is this course a substitute for legal or export control advice?

No. It is awareness level training. The authorities on CUI policy are NARA's Information Security Oversight Office and, for defense contracts, the DoD CIO and the Under Secretary of Defense for Intelligence and Security. Export decisions belong to your empowered official under DDTC and BIS rules. Follow your company's procedures where they are more specific than this course.

Does the course cover classified information?

Only enough to explain that classified information is a different regime with its own clearance, facility and training requirements. If you work with classified material, your facility security officer provides that training.

What certificate do I receive?

You receive a PlanetISO Certificate of Completion showing the course title, your name and your exam result. It does not expire. It is evidence of training for your company's training record and for an assessor. It is not an accreditation and does not make you a certified CUI, security or CMMC professional.

How long do I have access?

Lifetime access to the course and your certificate. You can revisit any module and download your certificate at any time, which is useful when your company refreshes training each year.

What happens if I fail the exam?

You have 3 attempts. Each attempt draws a different 10-question set from the bank of 20, and module quizzes can be retaken without limit to prepare.

CMMC and NIST SP 800-171Short course
CMMC Level 2 and NIST SP 800-171 Overview
What a Level 2 assessment expects, how the 110 requirements are organized and how to build a program that passes
Duration
3 hours
Level
Foundation
$99
View course
CMMC and NIST SP 800-171Awareness
Insider Threat Awareness
Recognize and report the indicators that protect your colleagues, your company and controlled information
Duration
1.5 hours
Level
Foundation
$59
View course
CMMC and NIST SP 800-171Awareness
Phishing and Email Security
Spot the message that is trying to trick you, and know exactly what to do next
Duration
1.5 hours
Level
Foundation
$59
View course
CMMC and NIST SP 800-171Awareness
Social Engineering Prevention
Recognize manipulation in person, on the phone and online, and verify before you act
Duration
1.5 hours
Level
Foundation
$59
View course
CMMC and NIST SP 800-171Awareness
CMMC Level 1 Overview
The 15 basic safeguards for federal contract information and how the annual self-assessment works
Duration
1.5 hours
Level
Foundation
$59
View course

About this course

What you will be able to do

Course outline

What CUI is and is not

Marking CUI correctly

Handling CUI day to day

Incidents, spills and reporting

Final examination and certificate

More CMMC and NIST SP 800-171 training

CMMC Level 2 and NIST SP 800-171 Overview

Insider Threat Awareness

Phishing and Email Security

Social Engineering Prevention

CMMC Level 1 Overview