How MSPs Can Identify Clients Handling DoD Controlled Unclassified Information
Summary
The guide advises MSPs to review public contract records and company indicators, then ask about DFARS clauses, DoD-marked technical data, and PIEE access to identify clients with potential CUI compliance needs.
Key points
- Search USASpending[.]gov contract records for a client’s awards; direct awards can indicate defense-industry activity, though subcontract awards are not included.
- Check company websites for indicators such as ITAR registration, AS9100 certification, Nadcap accreditation, government contract vehicles, or defense-sector work.
- Ask whether contracts include FAR or DFARS clauses and whether the client receives DoD technical data with distribution statements.
- Ask whether the client has a PIEE account and has submitted a NIST 800-171 self-assessment through SPRS.
- Documents with DoD distribution statements are not necessarily CUI; verify whether they relate to a contract containing DFARS clauses.
- The article says Huntress supports 51 of the 110 controls required for CMMC Level 2 and promotes its compliance services.
Article Details
- Topic
- Guidance for MSPs and MSSPs on identifying clients in the Defense Industrial Base that handle Controlled Unclassified Information (CUI), to assess their DFARS and CMMC compliance needs.