DOD, agencies raise concerns over tailored controls in proposed NIST CUI publication update

The program office behind the Pentagon’s cyber certification program and civilian agencies are identifying issues over the use of “organization-defined parameters” in the latest draft update to NIST Special Publication 800-171, a foundational document on the handling of controlled unclassified information.

“The use of ODPs while providing flexibility for Federal organizations that choose to establish non-standard formulations for use in their specific contracts ultimately renders the 171r3 neither a standard nor scalable. Scalability is crucial to implementation of these requirements...