CUI Process Workflow

The process for handing CUI in a grant or contract can be complicated.  We've created a process to make it as simple as possible for NMSU so you can ensure you're protecting CUI as needed.  Hopefully, this process flow will make it clear what your next steps should be as you consider the role CUI will play in your grant or contract.
CUI Flow at NMSU
  1. Grant or Contract Process Start
  2. DFARS 7012 or 7021 Clause?
    1. If the grant or contract has either of these clauses, then you may be getting CUI as part of the project.  If not, then you can stop here as you should not be receiving CUI.
  3. If the answer is yes, you have a CMMC requirement on the grant or contract.  You'll need to contact RAS (Research Administration Services) at 575-646-1590 or ras@nmsu.edu to begin the process.
  4. Receiving CUI?
    1. Even if the grant has a clause, it does not necessarily mean you'll be receiving CUI.  If you're not or if you're not sure, you can skip to the end.
  5. Work with NMSU CPM and PSL
    1. Once you've determined that your project will be receiving CUI, you'll need to work with the NMSU CPM and the Physical Science Laboratory to determine requirements for the handling of CUI in your specific case.  This step is handled in more detail in the next section.

 

Continued CUI Flow at NMSU
  1. Work with NMSU CPM and PSL
    1. The NMSU CPM and PSL have the knowledge, facilities, and infrastructure to properly house, track, and process CUI for your project.  Grant and contract CUI at NMSU may only be housed in PSL's CMMC Level 2 network.
  2. Brief PI on CMMC requirements
    1. The PSL team will brief the project PI and other high-level project members on CMMC requirements and how CUI must be stored, tracked, transported, processed, and disposed of during the project.
  3. PI and Team Receive and Sign Binder
    1. The CPM will provide a document binder (the CUI Handling Binder) to the PI and the rest of the team that must be read and signed.  It goes over the requirements for CMMC and how to protect CUI within the PSL CMMC Level 2 network.  
  4. Storing or Processing CUI?
    1. A determination will be made if the CUI as part of the project will only be stored (read-only) or will be stored and processed (read and write).  There are some extra considerations if the CUI will be processed rather than read.
  5. Determine Processing Needs and Local / Cloud Solutions
    1. If the CUI needs to be processed, PSL will work with the PI and project team to determine the best solution to allow processing to take place within the PSL CMMC Level 2 network.  This could be a physical processing server located in a secure data center within PSL or a cloud-based virtual machine located in PSL's Azure Government Cloud Tenant. 
  6. Receive, Catalog, and Track CUI
    1. The CPM will work with the grant or contract entity to receive the CUI and place it in an appropriate digital container available to the team.  The CUI will be tracked in PSL's systems and audited regularly to ensure compliance. 
  7. Do Work
    1. Once secured and tracked, work with the CUI can begin.  If processing is required, it can now be done with the assurance that the data is protected. 

At the conclusion of the project, teams should work with the PSL CPM to finalize the data and determine the disposition of the CUI.  If CUI needs to be transported outside of the PSL CMMC Level 2 network, then the appropriate forms and procedures will need to be followed.  Likewise, if the CUI needs to be disposed of, then the appropriate procedures should be followed in that case as well.