CUI transfer

nounverified·updated Aug 30, 2026

GlossaryL1 — what DictionaryL2 — how used ThesaurusL3 — relations Universaleverything

This is a compositional phrase, not a term of art with a field-specific meaning distinct from its parts. In the CUI regulatory framework — governed by Executive Order 13556, 32 CFR Part 2002, and implemented through NIST SP 800-171 and CMMC — "disseminating" CUI is defined as when authorized holders transmit, transfer, or provide access to CUI to other authorized holders through any means; "transfer" is one item in that list, not a separately defined concept. The CUI program addresses transferring records — for example, requiring authorized holders to decontrol CUI when possible when transferring records to NARA, and to indicate continued control on the appropriate transfer forms when the CUI requires ongoing control. The phrase "CUI transfer" in the sentence you quoted ("transfers between organizations based on data structures and content") is simply applying the ordinary meaning of *transfer* to CUI-bearing data flows, using the surrounding context to specify the scope.

Framework senses

2 senses across 2 frameworks

NIST SP 800-171r31 senseview framework →

§1 · attested_usage_reviewer_confirmed: No definition is given in NIST SP 800-171r3. The term is attested in use at 2 citations in that document; a definition is pending curation.
Increment 2: attested in 800-171r3 without a glossary definition.

Legacy lexicon import1 senseview framework →

§1 · web_lookup_draft: This is a compositional phrase, not a term of art with a field-specific meaning distinct from its parts. In the CUI regulatory framework — governed by Executive Order 13556, 32 CFR Part 2002, and implemented through NIST SP 800-171 and CMMC — "disseminating" CUI is defined as when authorized holders transmit, transfer, or provide access to CUI to other authorized holders through any means; "transfer" is one item in that list, not a separately defined concept. The CUI program addresses transferring records — for example, requiring authorized holders to decontrol CUI when possible when transferring records to NARA, and to indicate continued control on the appropriate transfer forms when the CUI requires ongoing control. The phrase "CUI transfer" in the sentence you quoted ("transfers between organizations based on data structures and content") is simply applying the ordinary meaning of *transfer* to CUI-bearing data flows, using the surrounding context to specify the scope.
DR-088 backfill from the noun definition column