How the rules stack and when export-controlled technical data becomes Covered Defense Information Defense contractors often treat Controlled Unclassified Information (CUI), DFARS cybersecurity clauses, CMMC, and ITAR as interchangeable labels for “sensitive defense data.” They are not. They answer different questions, they are enforced by different agencies, and they only overlap when a specific legal test is met. CMMC and NIST SP 800-171 ask how information is protected on c
.png){kind=logo}
