PM-17, Protecting Controlled Unclassified Information on External Systems, asks for a policy and procedures that make sure the requirements for protecting controlled unclassified information (CUI) are met when that information is processed, stored or transmitted on systems you do not own. You also review and update the policy on a defined schedule.
NIST 800-53 binds federal systems, and it reaches contractors and partners through contract terms. If you sell to a federal agency or sit in its supply chain, this control may land on you by way of your agreement. If not, treat it as a reference for any sensitive data that leaves your boundary.
What it means in practice
The record points to the National Archives definition of CUI, codified in 32 CFR 2002, and specifically to 32 CFR 2002.14h for systems external to the federal organization. The policy prescribes the specific use and the conditions that apply, in line with organizational procedures, including contracting processes.
In plain terms: know what CUI you hold, know which outside systems touch it, and write down the conditions under which that is allowed. A SaaS tool that receives CUI is an external system. So is a subcontractor laptop or a cloud storage bucket in another account.
The contract is where the real requirement usually lives. Read the clauses in your agreements that mention CUI, because the policy should trace back to them.
Evidence to collect
- The written policy and procedures, with owner and approval date
- An inventory of external systems that process, store or transmit CUI
- Contract clauses and flow down terms that set handling conditions
- Agreements or assessments for each external provider
- Records of the periodic policy review
Common gaps
- No list of which outside services receive CUI
- Policy exists but contracts with providers do not carry the same terms
- Staff paste CUI into unapproved tools because nobody told them not to
- The policy was never reviewed after the last vendor change
How to implement it
- Identify your CUI first. Ask the contracting officer or check your contract documents for what is marked.
- List every external system that touches it and the legal basis for each.
- Write the policy so each allowed use names its conditions.
- Add a check to vendor onboarding that asks whether CUI will be shared.
- Review the policy on the schedule you defined and after material vendor changes.
Quick check
Does PM-17 apply if I never handle federal data?
Not directly. It is a federal control that reaches others by contract. If you hold no CUI, it still works as a reference for sensitive data on outside systems.
Where do the handling requirements come from?
From 32 CFR 2002 and the terms of your contracts. The control asks you to implement them through policy.
