Frequently Asked Questions

Cybersecurity

What is cybersecurity?

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes

What is the purpose of cybersecurity?

Under federal, state, regulatory, and contractual requirements, Michigan Tech is responsible for developing and implementing a comprehensive information security program.

Controlled Unclassified Information (CUI)

What is CUI?

CUI is information held by or generated by the Federal Government that, while not classified, requires safeguarding and dissemination controls.

Who is responsible for determing CUI on my project and/or proposal?

The federal sponsor is responsible for determining whether an award will involve CUI and for ensuring that potential performers have the necessary safeguarding measures in place before CUI artifacts are shared or generated.

What is the U.S. Government’s interest in identifying and protecting CUI?

It is critical to protect sensitive government information, some of which has national security or U.S. trade implications, to reduce the risks of unauthorized release or misuse. Application of and compliance with the information security controls helps protect this information against threats to cybersecurity, data breaches, or other unauthorized disclosures.

Do I have to enforce CUI controls on contracts that have been signed previously?

The controls for CUI are only implemented when we have accepted a contractual obligation to implement specified NIST SP 800-171 controls. Federal agencies may issue contract amendments that would require CUI controls at any time after a contract has been accepted. Consequently, information security controls may change during a project's lifecycle, but these new terms would only be effective from the date we contractually accept them.

What are the potential consequences of non-compliance with CUI requirements?

Failure to comply may result in contract challenges to, or loss of, the award and may result in future ineligibility to be awarded government contracts.

Failure to accurately report the status of compliance could result in charges of fraud and criminal penalties for the individual researcher. In addition, the university could also experience adverse reputational, legal, or financial consequences.