CUI Handling Standard Operating Procedure

This CUI Handling Standard Operating Procedure (SOP) establishes mandatory controls for identifying, marking, storing, transmitting, and destroying Controlled Unclassified Information (CUI) at Aegis Defense Systems. It applies to all employees, contractors, and systems that process CUI in support of Department of Defense contracts. CUI must never be stored on personal devices or non-approved cloud services.

Our CUI handling procedure requires: (1) classify and mark materials with CUI banners and portion marks before storage or sharing; (2) store only in approved encrypted repositories (Aegis Knowledge Vault or authorized GRC systems); (3) transmit only via encrypted channels with need-to-know recipients; (4) log access events for audit; (5) destroy CUI using NIST 800-88 media sanitization methods when retention expires. Printing CUI requires a logged print release and secure disposal of hard copies within 24 hours.

All CUI documents must display a banner marking of CONTROLLED // CUI on the first page and page headers. Emails containing CUI must include CUI in the subject line and use organizational encryption. Unmarked materials discovered with CUI characteristics must be quarantined and reported to the ISSO within one business day.