What to ask a prime before accepting controlled information

Ask for context before an attachment

An invitation to join a team can arrive with a request to review a technical package immediately. Before anyone forwards it into a bid mailbox, ask the prime to describe the package without sending the controlled content. You need enough context to determine who should receive it and where the review belongs. An enthusiastic business-development response should not become the default data-handling decision.

Start with purpose: what question does the prime need your team to answer, and what information is necessary to answer it? Sometimes an initial capability or pricing discussion can use an approved summary. That possibility should be agreed with the information owner; the supplier should not independently strip markings, invent a public version, or assume an abbreviated drawing is unrestricted.

Identify the authority for handling

CUI is a defined information category grounded in law, regulation, or governmentwide policy, not a synonym for every confidential business document. Ask who is responsible for the package's designation, markings, and handling instructions. The definitions in 32 CFR 2002.4 provide context, while the contract and authoritative information owner resolve the specific exchange.

Record the information category or description, the relevant work package, the source of instructions, and the person authorized to answer questions. If a file is unmarked but appears to contain information subject to controls, do not treat the absence of a label as automatic permission. Conversely, an unexplained label should prompt clarification rather than an improvised classification decision. Keep the question and answer attached to the transfer record.

Confirm people and destinations

Agree on named recipients, their organizational roles, and the approved receiving environment. Ask whether the prime expects browser viewing, download, printing, analysis, modification, or return of a deliverable. These activities create different copies and workflows. A portal invitation is incomplete if nobody has considered local downloads, meeting recordings, collaboration features, or the tools used to create the response.

Have the security owner review the complete path with the delivery owner. They should identify the receiving account, device, storage location, permitted collaborators, and return route. Confirm whether a lower-tier supplier or external service will touch the information. Do not substitute a product label for this review: a secure-looking application does not establish that the organization's intended use meets its applicable obligations.

Use a short pre-transfer conversation

A focused conversation is easier to complete than a broad questionnaire sent to an inbox nobody owns. Share the questions in advance and ask the prime to bring the people who can answer them. Record unanswered items as dependencies and agree who will resolve them before the relevant transfer.

• What are we authorized to do with the package, and which deliverable will we create?
• Who can access it, and may any part be shared with another teammate?
• What receiving system, transfer channel, and retention instructions apply?
• Who handles an incorrect recipient, unexpected attachment, or uncertainty about markings?
• What contractual or assessment condition must be satisfied before access is granted?

A hypothetical estimating request

Imagine an electronics supplier is asked for a budget estimate. The prime offers a technical package through a shared link, but the estimator has only approved arrangements for public product information. The supplier asks whether an authorized high-level specification can support the initial estimate and whether detailed engineering review will be a separate step. The prime's information owner must decide what can be released for that purpose.

If the controlled package remains necessary, the team resolves the receiving environment and applicable requirements first. The supplier records the limitation on its initial estimate so the number is not mistaken for a commitment based on complete technical knowledge. This keeps the commercial decision connected to the information actually available without suggesting that schedule pressure overrides handling conditions.

Make the answer reusable

Create a brief transfer agreement or approved instruction record for the work package. Include its revision, owner, destination, recipient group, and escalation route. Link it from the project kickoff notes and purchasing file. Revisit it when the work or participants change. A useful result is that a new team member can determine the correct next action without reopening a sensitive attachment or guessing which mailbox the prime meant.