DRAFT NIST 800-171 - READ THIS!

[randy <marchany () VT EDU>]

We were just told about a new NIST draft SP 800-171 "Protecting Controlled
Unclassified Information (CUI) in Nonfederal Information Systems and
Organizations".
http://csrc.nist.gov/publications/drafts/800-171/sp800_171_second_draft.pdf

It establishes "infosec" standards and guidelines for protecting CUI. They
apply to the components of nonfederal info systems that process, store or
transmit CUI.

The "problem" is there is a BROAD definition of CUI that can impact how
research institutions will have to deal with data in these categories.

Just wondering if anyone else has looked at this draft and if they're as
concerned about it.

-Randy Marchany
VA Tech IT Security Office and Lab