Electric sector group seeks clarity on DOD definition of CUI amid CMMC rulemaking process

By Sara Friedman  / November 5, 2024

The Edison Electric Institute is asking the Defense Department to scope what is considered controlled unclassified information in the context of the Cybersecurity Maturity Model Certification program, building on comments submitted in February to reflect the current situation with the acquisition-focused proposed rule.

EEI’s Oct. 15 filing focuses on “how the CMMC as structured under the Proposed Rule would view CUI, and, more specifically, the numerous individual CUI designations.” It says, “Accordingly, we seek clarifications to the Proposed Rule, as we did with the CMMC Policy Proposal, so that DOD does not misapply CUI designations under the CMMC in a manner that makes the program impermissibly broad.”

The Pentagon published a proposed rule on Aug. 15 to amend the Defense Federal Acquisition Regulation Supplement to make changes for CMMC 2.0. DOD announced a CMMC revamp in November 2021 following an internal review of the program.

A second rulemaking to establish the CMMC program in Title 32 of the Code of Federal Regulations was released on Oct. 15.

Stakeholders only had a few days to read the final programmatic rule between when it was posted for public inspection in the Federal Register and the Oct. 15 deadline to submit final comments on the DFARS proposed rule. The CMMC program final rule was published in the Federal Register on Oct. 15.

EEI’s comments on the 32 CFR proposed rule “noted that DOD guidance on CUI in utility privatization contracts issued pursuant to current safeguarding requirements at DFARS 252.204-7012 incorrectly applied CUI designations intended only for the government, including General Critical Infrastructure Information, Critical Electric/Energy Information, and Protected Critical Infrastructure Information, to information created by electric companies,” the trade association says in its latest filing.

EEI includes a chart which they argue shows that “CUI designations listed in DOD’s utility privatization contracts CUI guidance do not, in practice, apply to electric utility data used in the performance of DOD contracts.”

The filing says, “We are concerned that a similar lack of clarity in the CMMC DFARS Proposal could cause CUI designations to be further misinterpreted, leading contract officers to inappropriately apply the CMMC to EEI members. As such, the revisions requested herein seek to clarify the CMMC DFARS Proposal so that CUI is correctly identified.”

“Our members understand that they provide vital services to DOD as well as the nation as a whole and appreciate the responsibilities that come with that role. They consistently meet -- and often surpass -- cybersecurity requirements across their operations,” the filing says.

EEI adds, “They do not seek to be exempt from protecting information designated as CUI. We simply ask that the CMMC Program be crafted such that CUI is applied in accordance with laws, regulations and government policies that underly CUI designation.”

EEI argues that “CUI is not a single, uniform category.” It says, “Rather, it encompasses a broad range of designations derived from various laws, regulations, and Governmentwide policies, each with distinct scopes and objectives.”

First, EEI says it is crucial to “assess” whether a specific CUI designation that subject to CMMC was “meant to apply to contractor-held information.”

The National Archives and Records Administration’s CUI definition used in the proposed rule “does not explicitly contemplate whether a non-agency entity, such as a contractor, must control information in the same manner as the government,” the filing says.

“Such consideration of specific contractor safeguarding duties must be implicitly read into NARA’s ‘CUI’ definition to reconcile it with the CUI designations it aims to define. The absence of its specific mention could lead users of the NARA ‘CUI’ definition -- and by extension, the Proposed Rule -- to misclassify contractor information as CUI, even if it does not meet the actual criteria for such designation,” the filing says.

EEI proposes clarifying the “implicit scope of NARA’s ‘CUI’ definition to better align it with underlying CUI designations.” The filing says, “This clarification will mitigate the risk of contract officers misreading the definition to apply the CMMC to information that does not, in fact, qualify as CUI. Doing so would require only slight modifications to the Proposed Rule’s ‘CUI’ definition.”

“Specifically, DOD should explicitly state that a law, regulation, or Governmentwide policy must authorize the government to direct nongovernment entities to safeguard information for it to be considered CUI under the CMMC Proposal. This change would ensure that contractors are subject to CUI controls only when explicitly mandated by the relevant policies, rather than when the safeguarding responsibility lies solely with the government,” the filing says.

EEI also urges DOD to “be mindful not to unintentionally disincentivize the use of CUI designations for private-public information sharing or otherwise encroach upon the jurisdiction of federal and state agencies who have historically regulated electric utility operations.”

The trade association says electric companies are “constantly creating and processing sensitive information that aligns with multiple CUI designations, including Critical Energy Infrastructure Information, Protected Critical Infrastructure Information, and most ubiquitously, General Critical Infrastructure Information. Nevertheless, as detailed herein and in our CMMC Policy Proposal Comments, electric companies do not create CUI as part of the various services they provide to DOD.”

“Sensitive electric utility information instead often becomes CUI when submitted to the federal government. In this way, electric companies have a unique relationship with CUI, inverse to that of many other DOD contractors. Rather than receive sensitive information that the government expects a contractor to safeguard as CUI, electric companies far more often provide sensitive information that they expect the government to safeguard as CUI,” the filing says.

Alignment

DOD addresses alignment between the two CMMC rulemakings, explaining how some of the comments on the 32 CFR proposed rule were not addressed in program final rule because they applied to the acquisition rulemaking.

“The policies underlying CMMC 2.0 are inseparable from the contract clauses enforcing it. Regardless of the administrative complexity for DOD, the public would have been better served by a joint rulemaking combining the CMMC Policy Proposal and CMMC DFARS Proposal,” the filing says.

The filing says, “Continuing to bifurcate CMMC comment consideration exacerbates these challenges, undermining the public’s opportunity to ‘meaningfully inform DOD’s ultimate policy on the CMMC.’”

EEI adds, “We again encourage DOD to reflect upon all stakeholder concerns in whatever rulemaking ultimately implements CMMC 2.0, whether they are in comments submitted in response to the CMMC Policy Proposal or the CMMC DFARS Proposal.”