{
 "slug": "cross-boundary-cui-access",
 "topic_id": "TOPIC-200",
 "cluster": "Defense Industrial Base, CUI & Export-Control Identity",
 "tier": "Tier A",
 "title": "Who touched the CUI? Access evidence across prime and subcontractor boundaries",
 "summary": "Safeguarding requirements flow down through multiple supplier tiers by contract clause, with compliance evidenced by supplier attestation rather than observation. Nobody can name the humans who opened the file.",
 "lede": "A prime shares controlled technical data with a subcontractor, who shares it with theirs, who shares it with a design house overseas. Each tier attests to safeguarding. An incident investigation starts by sending emails.",
 "date": "2025-01-26",
 "category": "Compliance",
 "author_id": "tobias-lindqvist-rao",
 "tags": [
  "CUI",
  "controlled unclassified information",
  "flow down",
  "supply chain security",
  "DFARS",
  "NIST 800-171"
 ],
 "image_title": "Cross Boundary CUI Access",
 "schema": "Article",
 "key_takeaways": [
  "Flow-down is contractual. Each organisation's access controls are internal and produce internal logs, so assurance decays with supply chain depth.",
  "A simple decay model makes the problem legible to leadership in a way that another questionnaire does not.",
  "Cross-boundary access receipts give the prime and the government individual attribution without requiring systems integration."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The decay model"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "Requirements flow down; evidence does not flow back",
   "caption": "Each tier attests. Nobody observes.",
   "nodes": [
    {
     "label": "Government contract",
     "note": "safeguarding clause"
    },
    {
     "label": "Prime flows down",
     "note": "contract clause"
    },
    {
     "label": "Sub flows down again",
     "note": "clause, tier 2, tier 3"
    },
    {
     "label": "Compliance evidenced by attestation",
     "note": "not observation",
     "bad": true
    },
    {
     "label": "Who touched the CUI?",
     "note": "unanswerable",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Assume each tier in a supply chain provides some probability that its safeguarding controls are actually operating as attested — call it <code>p</code>. Assurance at depth <code>n</code> is roughly <code>pⁿ</code>."
  },
  {
   "type": "p",
   "html": "Even at a generous <code>p</code> of 0.9, four tiers down gives 0.66. At 0.8 it is 0.41. And the prime's visibility, which relies on audits it performs only at tier one, does not decay gracefully — it stops at tier one entirely."
  },
  {
   "type": "table",
   "caption": "Illustrative. The point is the shape, not the specific values.",
   "head": [
    "Depth",
    "Assurance at p=0.9",
    "Prime's direct visibility"
   ],
   "rows": [
    [
     "Tier 1",
     "0.90",
     "Audits, questionnaires, site visits"
    ],
    [
     "Tier 2",
     "0.81",
     "Contractual flow-down only"
    ],
    [
     "Tier 3",
     "0.73",
     "None"
    ],
    [
     "Tier 4",
     "0.66",
     "None, and frequently unaware the tier exists"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The fourth row is the one that produces incidents. Primes routinely discover during an investigation that their data reached an organisation they had never heard of, through a legitimate contractual chain."
  },
  {
   "type": "h2",
   "text": "What the obligations require"
  },
  {
   "type": "p",
   "html": "DFARS safeguarding clauses require contractors to implement NIST SP 800-171 controls on covered contractor information systems, to report cyber incidents, and to flow the requirement down to subcontractors at all tiers where covered defense information is involved."
  },
  {
   "type": "p",
   "html": "The CUI programme rule establishes marking and handling requirements government-wide. NIST SP 800-171 includes access control requirements including limiting system access to authorised users and controlling the flow of CUI."
  },
  {
   "type": "p",
   "html": "All of that is well specified. None of it produces an artefact that crosses an organisational boundary."
  },
  {
   "type": "h2",
   "text": "The question that cannot be answered"
  },
  {
   "type": "p",
   "html": "After an incident, the prime asks: which individuals accessed our technical data package?"
  },
  {
   "type": "p",
   "html": "Tier one can answer for itself, from its own logs, in its own format, with its own retention policy. Tier two can answer if it retained logs and if its subcontract obliges it to produce them. Tier three is a request routed through two intermediaries, and the answer arrives weeks later if at all."
  },
  {
   "type": "h2",
   "text": "The Cross-Boundary Access Receipt"
  },
  {
   "type": "p",
   "html": "Each access to a shared CUI artefact produces a receipt naming the individual, the artefact and the authorising delegation."
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"cui_access\",\n  \"artifact\": \"[identifier, hash]\",\n  \"marking\": \"[CUI category, limited dissemination controls]\",\n  \"accessor\": \"[individual credential assertion]\",\n  \"organisation\": \"[entity, CAGE]\",\n  \"under_delegation\": \"[reference to the prime's grant]\",\n  \"at\": \"[timestamp]\"\n}"
  },
  {
   "type": "p",
   "html": "Verification requires only the published keys. The prime can verify a tier-three access without an account on the tier-three system, and the government can verify both without an account anywhere."
  },
  {
   "type": "h2",
   "text": "The commercial objection, and the answer"
  },
  {
   "type": "p",
   "html": "Suppliers will not object technically. They will object to producing externally verifiable records of their internal activity, on the grounds that it creates exposure their competitors do not have."
  },
  {
   "type": "p",
   "html": "Three responses that have traction:"
  },
  {
   "type": "ul",
   "items": [
    "It bounds their exposure as much as the prime's. A supplier able to demonstrate that none of its people accessed a compromised artefact is in a far better position than one relying on an assertion.",
    "It replaces questionnaires. A supplier that produces access receipts can reasonably ask for relief from the annual attestation cycle.",
    "It becomes a differentiator once one supplier in a niche offers it, which is how this propagates."
   ]
  },
  {
   "type": "h2",
   "text": "Scoping to what matters"
  },
  {
   "type": "p",
   "html": "Not every CUI artefact warrants this. Scope to the technical data packages whose compromise would be programme-significant — typically a small number of drawings, models and specifications per programme."
  },
  {
   "type": "p",
   "html": "Instrumenting those is a tractable project. Instrumenting everything marked CUI is not, and attempting it is how these programmes fail."
  },
  {
   "type": "h2",
   "text": "What a prime can actually ask for"
  },
  {
   "type": "table",
   "caption": "Evidence options across a boundary",
   "head": [
    "Option",
    "Practicality"
   ],
   "rows": [
    [
     "Direct log access",
     "Rarely granted, and contains other customers' data"
    ],
    [
     "Periodic assessment",
     "Expensive, point-in-time, and not per-access"
    ],
    [
     "Attestation",
     "What happens today; a statement, not a record"
    ],
    [
     "<strong style=\"font-weight:600\">Per-access receipts</strong>",
     "<strong style=\"font-weight:600\">Verifiable by the prime without the sub's systems</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The clause makes it the sub's problem.”</strong> Contractually, partly. Operationally the prime is still the party asked who accessed the data, and ‘our subcontractor attested’ is a weak answer to a government customer."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Subs will not instrument for us.”</strong> Some will not. The ones handling the most sensitive data usually will, if the ask is bounded to a defined access class rather than general logging."
  }
 ],
 "faq": [
  {
   "q": "Does DFARS require individual attribution across tiers?",
   "a": "It requires flow-down of safeguarding requirements and incident reporting. Cross-boundary individual attribution is not prescribed, which is the gap described here."
  },
  {
   "q": "Do suppliers need to integrate with our systems?",
   "a": "No. Verification uses published keys and requires no account on anyone's system, which is what makes this deployable across a deep supplier base."
  },
  {
   "q": "What about foreign suppliers?",
   "a": "The same mechanism applies, and export control considerations apply independently — see the deemed export analysis for that dimension."
  },
  {
   "q": "How do we get tier three to participate?",
   "a": "Through tier one's subcontract terms. The prime cannot contract with tier three directly, which is why the flow-down language has to carry the requirement."
  },
  {
   "q": "Why can't the prime just get the logs?",
   "a": "They contain other customers' data, reveal architecture, and extraction is unfunded work. The refusal is usually reasonable."
  },
  {
   "q": "What is the cheapest thing to negotiate?",
   "a": "A correlation identifier that round-trips into the subcontractor's records, which makes later reconciliation possible at all."
  },
  {
   "q": "Why does verification without contact matter?",
   "a": "Because evidence that requires the subcontractor's cooperation stops being available when the relationship does."
  }
 ],
 "sources": [
  {
   "t": "CMMC program — DoD CIO",
   "u": "https://dodcio.defense.gov/CMMC/"
  },
  {
   "t": "NIST SP 800-171 Rev. 3 — Protecting CUI",
   "u": "https://csrc.nist.gov/pubs/sp/800/171/r3/final"
  },
  {
   "t": "2 CFR Part 200 — Uniform Administrative Requirements for Federal Awards",
   "u": "https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200"
  },
  {
   "t": "CISA — known exploited vulnerabilities and incident reporting",
   "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  {
   "t": "32 CFR Part 117 — National Industrial Security Program Operating Manual",
   "u": "https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-D/part-117"
  }
 ],
 "related": [
  {
   "slug": "affirmation-evidence-standard",
   "title": "CMMC Phase II is suspended",
   "category": "Compliance"
  },
  {
   "slug": "deemed-export-authorization-chain",
   "title": "Deemed export",
   "category": "Compliance"
  },
  {
   "slug": "interim-supplier-assurance",
   "title": "Buying identity assurance when CMMC is paused",
   "category": "Compliance"
  },
  {
   "slug": "escort-handover-receipt",
   "title": "Visitor escort assignment and insider threat",
   "category": "Compliance"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Cross%20Boundary%20CUI%20Access/1500_900/blog.jpg",
 "wordcount": 862,
 "url": "/blog/cross-boundary-cui-access.html",
 "reading_time": "4 min read",
 "seo_title": "CUI access evidence across contractor boundaries",
 "meta_description": "Safeguarding requirements flow down by contract clause, evidenced by supplier attestation rather than observation. Nobody sees the access.",
 "hub": {
  "slug": "topics/dib-identity",
  "title": "Defense industrial base identity"
 },
 "answer": "Almost never. Safeguarding requirements flow down through supplier tiers by contract clause, and compliance is evidenced by supplier attestation rather than observation. The prime holds a signed statement that controls exist, and no record of who accessed what.",
 "answer_q": "Can a prime contractor see who touched CUI at a subcontractor?",
 "glossary": [
  {
   "term": "CUI",
   "def": "Controlled Unclassified Information: information requiring safeguarding under government-wide policy, with requirements flowed down by contract."
  },
  {
   "term": "Flow-down",
   "def": "The contractual mechanism passing obligations to lower supplier tiers."
  },
  {
   "term": "Attestation-based compliance",
   "def": "Evidence consisting of a supplier's statement that controls exist, as distinct from observation that they operated."
  }
 ],
 "checklist": {
  "title": "Negotiating cross-boundary evidence",
  "id": "negotiate",
  "desc": "Four asks, in order of acceptability.",
  "steps": [
   {
    "name": "A correlation identifier that round-trips.",
    "text": "Cheapest, and it makes any later reconciliation possible."
   },
   {
    "name": "Receipts for a defined access class.",
    "text": "Not general logging — a bounded set the sub can scope."
   },
   {
    "name": "Retention matching your contract period.",
    "text": "In the contract, not in a policy."
   },
   {
    "name": "Verification without contacting the sub.",
    "text": "So evidence survives the relationship ending."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising individual to the exact access or release being authorised, and produces a receipt a prime, a government customer or an investigator can verify without access to the contractor's systems.",
  "href": "../docs.html",
  "label": "See access receipts"
 }
}