On May 12, EDUCAUSE submitted comments to the National Institute of Standards and Technology (NIST) regarding its final public draft of Special Publication 800-171: Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, which was issued on April 2, 2015. The guidance is intended to provide federal agencies with guidelines for securing unclassified federal information being held in nonfederal information systems. The guidance covers all unclassified information that is being held by non-federal entities and is still subject to government controls for security, technology, or economic reasons.
EDUCAUSE’s comments largely requested clarification of the requirements listed for controlled unclassified information (CUI) as well as the applicability of the guidance in relation to other laws and regulations higher education institutions must follow when processing or storing CUI. EDUCAUSE also pointed the agency to comments [http://www.cogr.edu/viewDoc.cfm?DocID=152115] submitted by the Council on Government Relations and the Association of American Universities, in which they requested NIST emphasize the flexibility colleges and universities have in addressing the identified requirements. (Note that EDUCAUSE submitted comments to the agency on its initial draft of the publication as well; those comments and the initial draft are both available from the EDUCAUSE Library listing for this issue.)
NIST is expected to release the final version of SP 800-171 in June 2015.