NASA CUI readiness: from agreement clause to operating program.

The five readiness steps

• 1. Inventory the instruments. Contracts, grants, cooperative agreements, Space Act agreements, and subcontract flow-downs — each read for the CUI and security terms it actually incorporates. NASA's directive shapes what agreements say; the agreement is what binds you.
• 2. Find the NASA CUI. Technical data, research results, pre-decisional information — identify what you hold that NASA designates as CUI, where it enters your environment, and everywhere it travels. In research settings this is the hardest and most valuable step.
• 3. Draw the smallest defensible boundary. Shared lab infrastructure, collaboration platforms, student and visiting-researcher access — research environments sprawl by default. A deliberate enclave for NASA CUI (see enclave architecture) usually beats bringing the whole institution into scope, on both cost and credibility.
• 4. Implement and document to the incorporated baseline. 800-171 at the revision your agreement incorporates, with an SSP written from the live environment and evidence at the objective level — ready for whatever demonstration the agreement anticipates.
• 5. Operate for agreement churn. NASA work arrives as a stream of agreements with varying terms. A program with a maintained obligations matrix absorbs each new award as a delta review, not a fresh scramble.

The research-institution trap

Universities and research organizations often try to satisfy NASA terms with campus-wide general IT controls. Assessorial reality: a boundary you can't enumerate is a boundary you can't defend. The pattern that works is containment — a defined environment where NASA CUI lives, with the full control set implemented deeply there instead of shallowly everywhere.