Are there federal regulations/requirements that prohibit such commingling of Private systems and CUI(CUI - Controlled Unclassified Information) storage systems? I am looking at CFR-2017 title32, vol6, part2002, and NIST SP 800-53, but I am not seeing anything exactly saying that it's bad to put other software/data on a system storing CUI.

  • You could always ask. nist.gov/about-nist/contact-us – xorist Oct 3 '18 at 17:46
  • This is a law question, not a computer security question. This site is not a substitute for legal counsel. – Don Simon Jan 2 '19 at 19:02
  • @DonSimon - this is a question about the intersection between law and security - an area where both lawyers and security professionals should be able to help out, as xorist did. – AgapwIesu Jan 2 '19 at 20:43

You'll want to look at NIST SP 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). This document details the security controls for CUI information on unclassified systems. There's also a companion document, NIST SP 800-171A for auditing systems hosting CUI.

As far as the law goes (I am not a lawyer, consult your counsel for full legal protection), it may be helpful to know of DFARS 252.204-7012, which deals with contractor responsibilities for systems storing CUI.

To the larger question, I would strongly advise against storing information on systems not solely dedicated to federal work for a number of reasons:

  1. You'd create a single point of failure for multiple systems instead of just one, meaning if you lose the box, you'll need to rebuild all of them at once. On top of that, managing all of the regulations while making sure everything stays up may prove to be a huge struggle.

  2. A threat vector is created if anyone needs access to the box for the private software that's loaded onto it, but does not have the need to know for the other stuff.

  3. In the event that the government seizes the system, you lose whatever you're hosting on the same system along with it. Again, this can cause issues with your SLAs for other projects or result in the loss of unrelated data.

However, barring an issue with DFARS, I don't think there's any legal problems (again, not a lawyer) with having a shared system like this as long as the whole system is DFARS compliant, meaning it meets the requirements of 800-171.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.