CUI Decontrol and Sanitization: Records Retention for the DIB
CUI status does not change how long you keep records; decontrol and sanitization handle markings and media while contracts and schedules drive retention.
Compliance
CUI Marking Requirements Under 32 CFR Part 2002
32 CFR Part 2002 directs agencies and authorized holders to use CUI Registry markings, apply clear banners with required category and dissemination indicators, and end legacy labels that the rule does not permit.
ITAR Section 120.54 and the Deemed Export Rule for Cloud Environments
ITAR 120.54 permits end-to-end encrypted, unclassified technical data in the cloud when you control keys and avoid proscribed routing, but the deemed export rule keeps identity and access at the center of any Microsoft 365 strategy.
NIST 800-172 Enhanced Security Requirements: Who Actually Needs Them
NIST SP 800-172 Rev. 3 adds threat-focused enhancements on top of NIST SP 800-171, and agencies invoke them for CUI tied to high value assets or critical programs, not for the average DIB contract.
International Traffic in Arms Regulations and U.S.-Person Cloud Operations
ITAR puts identity, location, and key custody at the center of cloud design, which drives U.S.-person operations models, U.S.-based environments, and strict access and encryption patterns across Microsoft 365 and Azure.
SPRS Scoring: Calculating and Improving Your NIST 800-171 Posture
How SPRS scoring works under DFARS 7019/7020. The scoring methodology, common deductions, posting cadence, and what CMMC changes about it.