PM-17 Protecting Controlled Unclassified Information on External Systems

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: CA-6, PM-10

Control statement

• a. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
• b. Review and update the policy and procedures [Assignment: organization-defined frequency].

NIST discussion

Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in 32 CFR 2002 and, specifically for systems external to the federal organization, 32 CFR 2002.14h . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-17

Determine if:

• PM-17a.
  • PM-17a.[01] policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
  • PM-17a.[02] procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
• PM-17b.
  • PM-17b.[01] policy is reviewed and updated [Assignment: organization-defined frequency];
  • PM-17b.[02] procedures are reviewed and updated [Assignment: organization-defined frequency]

Examine: Controlled unclassified information policy; controlled unclassified information procedures; other relevant documents or records..

Interview: Organizational personnel with controlled unclassified information responsibilities; organizational personnel with information security responsibilities..

Policy statement

• The Chief Information Security Officer shall establish policy and procedures to ensure that requirements for protecting controlled unclassified information processed, stored or transmitted on external systems are implemented in accordance with applicable laws, regulations, policies and standards. (PM-17a)
• The Chief Information Security Officer shall review and update that policy Fill in: the frequency at which to review and update the policy Typical: annually. (PM-17b)
• The Chief Information Security Officer shall review and update those procedures Fill in: the frequency at which to review and update the procedures Typical: annually. (PM-17b)

Federal systems

Under 32 CFR 2002.14(h)(2), agencies must use NIST SP 800-171 when establishing security requirements to protect CUI’s confidentiality on non-federal information systems. 32 CFR 2002.2 still incorporates the June 2015 edition of SP 800-171 by reference, while NIST’s current revision is SP 800-171 Rev. 3 (May 2024), so each agreement should name the revision it requires. As of October 2026.

• Each agreement that shares CUI with a non-federal organization shall require the recipient to protect it as 32 CFR 2002.14(h) requires, and shall name the revision of NIST SP 800-171 that applies. (PM-17a)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-17 is about controlled unclassified information (CUI) that leaves your own systems. You set policy and procedures so that the protection requirements for CUI processed, stored or transmitted on external systems are carried out as laws, regulations and standards require (a). You review and update both at a set frequency (b). PM-17 is in the SP 800-53B Privacy baseline.

NIST’s PM-17 discussion says the National Archives and Records Administration (NARA) defines CUI and its safeguarding and dissemination requirements in 32 CFR part 2002. Section 2002.14(h) covers systems outside the federal organization. The discussion adds that the policy sets the conditions of use, carried out through organizational procedures “including via its contracting processes”. In practice, the contract or agreement is where the requirement reaches the external system.

PM-17 applies only where the organization shares CUI with external systems or holds CUI under a contract or agreement. The Program Management policy says so. If it does not apply, record that decision and its reason in the program plan.

Common implementations. The Program Management policy gives PM-17 to the Chief Information Security Officer. A typical CUI policy and procedure set covers:

• How CUI is identified and marked before it is shared, using the categories in NARA’s CUI Registry
• Which external systems receive CUI, recorded in the system inventory or a list of external services (SA-9)
• The protection requirements written into each contract and agreement, usually SP 800-171 Rev. 3 for non-federal systems
• How the organization checks that recipients meet those requirements, such as attestations, assessments or the external service review
• How recipients report mishandling of CUI, and who receives the report

For a system-to-system exchange, put the CUI terms in section 4 of the information exchange agreement (CA-3). For a vendor, put them in the contract through the acquisition security requirements (SA-4). The related controls on the page, CA-6 and PM-10, tie the policy to authorization decisions.

Organization-defined parameters. From templates/policy/pm/. Typical values, which your organization may set differently:

Parameter	Typical value
Policy review and update frequency (b)	Annually
Procedure review and update frequency (b)	Annually

Evidence assessors ask for.

• The CUI policy and procedures, approved and dated (a)
• The list of external systems and organizations that receive CUI
• A sample of contracts and agreements that carry the CUI protection requirements
• Records of how recipients’ compliance was checked
• Records of the last review and update of the policy and of the procedures (b)

Inheritance. PM-17 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system that sends CUI to an external system applies the policy through its own agreements and interconnections.

Common findings.

• No list of where CUI goes, so nobody can say which external systems hold it.
• Contracts that mention CUI but name no protection requirement.
• Agreements signed with no check that the recipient meets them.
• A policy written for internal systems only, silent on external ones.
• No decision recorded where the organization says PM-17 does not apply.

Enhancements. PM-17 has no enhancements.

Federal systems (as of October 2026). 32 CFR 2002.14(h)(2) says “Agencies must use NIST SP 800-171 when establishing security requirements to protect CUI’s confidentiality on non-Federal information systems.” Exceptions are a CUI Registry authority that prescribes other safeguards, or an agreement that requires more than moderate confidentiality. A system a contractor operates on an agency’s behalf is a federal information system under § 2002.14(h)(1), and is protected as the agency’s own. 32 CFR 2002.2 still incorporates the June 2015 edition of SP 800-171 by reference; NIST’s current revision is Rev. 3 (May 2024). Name the revision each agreement requires.

Under 32 CFR 2002.16(a)(5) and (6), agencies should enter into agreements with non-executive branch entities they share CUI with, whenever feasible. Each agreement must require handling under Executive Order 13556, part 2002 and the CUI Registry. It must state that misuse is subject to penalties, and require the recipient to report non-compliance to the disseminating agency. OMB Circular A-130, Appendix I, section 3.e, says agencies “shall protect Controlled Unclassified Information (CUI)”.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy