Universities face NIST SP 800-171 from an unusual starting point. Most of their research is meant to be published, their IT is decentralized by design, their researchers include foreign nationals, and individual principal investigators often buy and run their own lab equipment. A defense-funded project that brings CUI onto campus collides with all of that at once.
The answer at almost every institution that has done this well is the same: establish whether the work is genuinely fundamental research, and where it is not, keep the CUI inside a purpose-built enclave rather than trying to bring the campus network into compliance.
Start with the fundamental research question
National Security Decision Directive 189 defines fundamental research as basic and applied research in science and engineering whose results are ordinarily published and shared broadly within the scientific community. Results of fundamental research are generally not subject to export controls and are not normally designated as CUI.
The exclusion is lost when the sponsor imposes publication restrictions or access controls, or when the project receives controlled information from the sponsor as an input. A contract containing DFARS 252.204-7012, or a clause limiting publication or foreign national participation, is the usual signal. Research offices should review those terms before an award is accepted, because accepting them is what brings the project into scope. The clause-by-clause test applies to universities as much as to companies.
Deemed exports and foreign national researchers
Under the export regulations, releasing controlled technology to a foreign person inside the United States can be treated as an export to that person's country — a deemed export. When CUI is also export-controlled technical data, access control is no longer only a NIST SP 800-171 question: access must be limited to people who are authorized under export rules, and in many ITAR cases that means US persons only.
Access Control requirements 3.1.1 and 3.1.2, and Personnel Security requirement 3.9.1 (screening before access), become the place where export compliance and cybersecurity meet. The aerospace and defense page covers how ITAR and CUI classify the same data differently.
Why the enclave is the only practical boundary
A campus network has thousands of unmanaged devices, departmental servers, shared storage and guest access. Bringing it under NIST SP 800-171 is neither affordable nor compatible with academic freedom. A research enclave — a dedicated, managed environment with its own identity, endpoints, storage and logging — lets a small number of approved researchers work on controlled projects while the rest of campus is out of scope.
The design questions are which instruments must connect to the enclave, how data moves from lab equipment into it, and how PI-owned devices are handled. Lab equipment that cannot be managed is usually isolated and treated as a specialized asset documented in the SSP. See CMMC enclave vs GCC High for the architecture options.
Funding the enclave
The enclave is shared infrastructure, so the funding model matters as much as the design. Institutions that have succeeded usually fund the core build centrally and recover running costs per project through a service rate charged to the award, the same way core research facilities are funded. Researchers then have a clear answer when a sponsor asks how CUI will be protected, and the institution avoids each department buying and securing its own environment.
Governance that fits a university
- A central research security function that reviews award terms for 7012, 7019, 7020 and publication or foreign-national restrictions before acceptance.
- A technology control plan per project naming authorized personnel and permitted systems.
- Onboarding for researchers covering CUI handling and marking — see CUI marking requirements.
- An institutional SSP for the enclave, with project-level addenda.
- One SPRS assessment for the enclave, maintained by central IT rather than individual departments.
Frequently asked questions
Does a DoD grant automatically bring CUI onto campus?
No. Many DoD-funded projects are fundamental research with no CUI. The contract terms decide: look for DFARS 252.204-7012 and restrictions on publication or participation.
Can graduate students work on CUI projects?
Yes, if they are authorized, trained and, where export controls apply, eligible under those rules. Authorization should be recorded in the project's access list.
Who posts the SPRS score for a university?
The institution, for the system that handles the CUI — usually the research enclave. Individual labs should not post separate scores.
Can researchers collaborate with other institutions on a CUI project?
Yes, if each institution protects the CUI it holds and the sharing is authorized. Flow the safeguarding requirements to collaborators through the subaward, as a prime would to a subcontractor.