Abstract
On March 17, 2025, EDUCAUSE, COGR, the American Council on Education (ACE), the Association of American Universities (AAU), and the Association of Public and Land-grant Universities (APLU) submitted comments in response to proposed regulations for incorporating controlled unclassified information (CUI) marking, handling, and security requirements into federal contracting rules and processes. Major concerns identified included:
- Changes to standard definitions that might expose fundamental research to unnecessary and counterproductive cybersecurity requirements,
- Mandates that shift the burden of responsibility for identifying and managing unmarked or mismarked CUI from federal agencies to contractors,
- An eight-hour deadline for contractors to report unmarked/mismarked CUI or CUI incidents to federal contract officers, and
- CUI training provisions that would likely extend training requirements well beyond project staff regardless of whether the general staff involved actually accessed or used CUI.