Who touched the CUI? Access evidence across prime and subcontractor boundaries
A prime shares controlled technical data with a subcontractor, who shares it with theirs, who shares it with a design house overseas. Each tier attests to safeguarding. An incident investigation starts by sending emails.
Can a prime contractor see who touched CUI at a subcontractor?
Almost never. Safeguarding requirements flow down through supplier tiers by contract clause, and compliance is evidenced by supplier attestation rather than observation. The prime holds a signed statement that controls exist, and no record of who accessed what.
- Flow-down is contractual. Each organisation's access controls are internal and produce internal logs, so assurance decays with supply chain depth.
- A simple decay model makes the problem legible to leadership in a way that another questionnaire does not.
- Cross-boundary access receipts give the prime and the government individual attribution without requiring systems integration.
Part of Defense industrial base identity
The decay model
Assume each tier in a supply chain provides some probability that its safeguarding controls are actually operating as attested — call it p. Assurance at depth n is roughly pⁿ.
Even at a generous p of 0.9, four tiers down gives 0.66. At 0.8 it is 0.41. And the prime's visibility, which relies on audits it performs only at tier one, does not decay gracefully — it stops at tier one entirely.
| Depth | Assurance at p=0.9 | Prime's direct visibility |
|---|---|---|
| Tier 1 | 0.90 | Audits, questionnaires, site visits |
| Tier 2 | 0.81 | Contractual flow-down only |
| Tier 3 | 0.73 | None |
| Tier 4 | 0.66 | None, and frequently unaware the tier exists |
The fourth row is the one that produces incidents. Primes routinely discover during an investigation that their data reached an organisation they had never heard of, through a legitimate contractual chain.
What the obligations require
DFARS safeguarding clauses require contractors to implement NIST SP 800-171 controls on covered contractor information systems, to report cyber incidents, and to flow the requirement down to subcontractors at all tiers where covered defense information is involved.
The CUI programme rule establishes marking and handling requirements government-wide. NIST SP 800-171 includes access control requirements including limiting system access to authorised users and controlling the flow of CUI.
All of that is well specified. None of it produces an artefact that crosses an organisational boundary.
The question that cannot be answered
After an incident, the prime asks: which individuals accessed our technical data package?
Tier one can answer for itself, from its own logs, in its own format, with its own retention policy. Tier two can answer if it retained logs and if its subcontract obliges it to produce them. Tier three is a request routed through two intermediaries, and the answer arrives weeks later if at all.
The Cross-Boundary Access Receipt
Each access to a shared CUI artefact produces a receipt naming the individual, the artefact and the authorising delegation.
{
"type": "manav-stmt/1",
"action": "cui_access",
"artifact": "[identifier, hash]",
"marking": "[CUI category, limited dissemination controls]",
"accessor": "[individual credential assertion]",
"organisation": "[entity, CAGE]",
"under_delegation": "[reference to the prime's grant]",
"at": "[timestamp]"
}Verification requires only the published keys. The prime can verify a tier-three access without an account on the tier-three system, and the government can verify both without an account anywhere.
The commercial objection, and the answer
Suppliers will not object technically. They will object to producing externally verifiable records of their internal activity, on the grounds that it creates exposure their competitors do not have.
Three responses that have traction:
- It bounds their exposure as much as the prime's. A supplier able to demonstrate that none of its people accessed a compromised artefact is in a far better position than one relying on an assertion.
- It replaces questionnaires. A supplier that produces access receipts can reasonably ask for relief from the annual attestation cycle.
- It becomes a differentiator once one supplier in a niche offers it, which is how this propagates.
Scoping to what matters
Not every CUI artefact warrants this. Scope to the technical data packages whose compromise would be programme-significant — typically a small number of drawings, models and specifications per programme.
Instrumenting those is a tractable project. Instrumenting everything marked CUI is not, and attempting it is how these programmes fail.
What a prime can actually ask for
| Option | Practicality |
|---|---|
| Direct log access | Rarely granted, and contains other customers' data |
| Periodic assessment | Expensive, point-in-time, and not per-access |
| Attestation | What happens today; a statement, not a record |
| Per-access receipts | Verifiable by the prime without the sub's systems |
Objections and honest limits
“The clause makes it the sub's problem.” Contractually, partly. Operationally the prime is still the party asked who accessed the data, and ‘our subcontractor attested’ is a weak answer to a government customer.
“Subs will not instrument for us.” Some will not. The ones handling the most sensitive data usually will, if the ask is bounded to a defined access class rather than general logging.
Negotiating cross-boundary evidence
- A correlation identifier that round-trips. Cheapest, and it makes any later reconciliation possible.
- Receipts for a defined access class. Not general logging — a bounded set the sub can scope.
- Retention matching your contract period. In the contract, not in a policy.
- Verification without contacting the sub. So evidence survives the relationship ending.
Terms used here
- CUI
- Controlled Unclassified Information: information requiring safeguarding under government-wide policy, with requirements flowed down by contract.
- Flow-down
- The contractual mechanism passing obligations to lower supplier tiers.
- Attestation-based compliance
- Evidence consisting of a supplier's statement that controls exist, as distinct from observation that they operated.
Frequently asked questions
Does DFARS require individual attribution across tiers? It requires flow-down of safeguarding requirements and incident reporting. Cross-boundary individual attribution is not prescribed, which is the gap described here.
Do suppliers need to integrate with our systems? No. Verification uses published keys and requires no account on anyone's system, which is what makes this deployable across a deep supplier base.
What about foreign suppliers? The same mechanism applies, and export control considerations apply independently — see the deemed export analysis for that dimension.
How do we get tier three to participate? Through tier one's subcontract terms. The prime cannot contract with tier three directly, which is why the flow-down language has to carry the requirement.
Why can't the prime just get the logs? They contain other customers' data, reveal architecture, and extraction is unfunded work. The refusal is usually reasonable.
What is the cheapest thing to negotiate? A correlation identifier that round-trips into the subcontractor's records, which makes later reconciliation possible at all.
Why does verification without contact matter? Because evidence that requires the subcontractor's cooperation stops being available when the relationship does.
Where this fits in Manav
Manav binds the authorising individual to the exact access or release being authorised, and produces a receipt a prime, a government customer or an investigator can verify without access to the contractor's systems.