1. Identifying, Categorizing, & Tagging Controlled Unclassified Information (CUI) in Office 365
James Jones
11/20/19

2. Disclaimer
The opinions discussed in today’s presentation are those of the individual and do not represent the firms/companies/entities that they may be affiliated with.

3. Lead Sales Engineer/Federal Solutions Engineer
Meet Our Presenter
James Jones
Lead Sales Engineer/Federal Solutions Engineer
Active Navigation

4. Agenda What is CUI and why protect it?
Existing Agency Policy and Procedure
Law, Regulations, and Government-side policies (LRGWP)
An Information Security Reform
Features
Need a new picture

5. What is Controlled Unclassified Information? (CUI)
n. / information that needs protecting
as specified in the CUI Registry
The CUI Registry provides information on the specific categories of information that the Executive branch protects. The CUI registry can be found at

6. CUI Includes, But is Not Limited to:
Privacy (including health)
Financial
Tax
Intelligence
Law Enforcement
Privilege
Unclassified Nuclear
Capital Infrastructure
Export Control
Procurement & Acquisition

7. Why Protect CUI?
The loss or improper safeguarding of CUI could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.
Degradation in mission capability;
Damage to organizational assets;
Financial loss; or
Harm to individuals

8. LRGWP
Laws, Regulations, & Government-wide policies (LRGWP) identified what to protect, but failed to say how
Agencies took steps to define protection through the issuance of policy and procedure
Lack of oversight over sensitive information programs

9. Implementation Implementation has begun
Program officials, resources, policy, training, systems, contracts, oversight
CUI practices and Legacy practices will exist at the same time

10. Controlled Environments
Reception Area used to control access to workspace
Any area or space an authorized holder deems to have adequate physical or procedural control (e.g., barriers & managed access controls) for protecting CUI from unauthorized access or disclosure

11. Assessing Physical Environments
Going beyond gates, guns, and guards: Internal security
Who works in the space?
Who has access to the space during and after business hours?
Do individual workspaces (cubes & offices) have adequate safeguards to prevent access (locking cabinets, drawers, or overhead bins)?
Suitable for sensitive discussions?

12. CUI Basic and CUI Specified
Laws, Regulations, or Government-wide policies require specific protections. For example:
Unique markings
Enhanced physical safeguards
Limits on who can access the information
Laws, Regulations, or Government-wide policies DO NOT require specific protections.
CUI Specific
(requires unique markings)
CUI Basic

13. Problems CUI Addresses
The program address:
Uniform retention schedules, dissemination controls, and document transfer rules
Outside contractors holding sensitive information
Impediments to authorized information sharing

14. CUIB™: The Controlled Unclassified Information Button
Simplify information sharing
Discover Personally Identifiable Information (PII)
Identify and categorize CUI data
Automatically tag data

15. CUIB™ Demo
Need new picture

16. Lead Sales Engineer/Federal Solutions Engineer
Thank You
Need new picture
James Jones
Lead Sales Engineer/Federal Solutions Engineer