Controlled technical information (CTI), explained

Controlled technical information (CTI) is technical information with military or space application that is subject to controls on its access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. That definition is in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, in its MAY 2024 text. The clause adds that CTI would meet the criteria, if disseminated, for distribution statements B through F under Department of Defense (DoD) Instruction 5230.24. Information that is lawfully publicly available without restrictions is not CTI. Two consequences follow: CTI is a category of Controlled Unclassified Information (CUI), and CTI held for a DoD contract on a contractor's system falls under the clause's safeguarding and reporting rules.

What counts as technical information

The clause defines technical information as technical data or computer software, as DFARS 252.227-7013 defines those terms, whether or not that clause is in the contract. The examples it lists are concrete:

• Research and engineering data
• Engineering drawings, associated lists, specifications, standards, and process sheets
• Manuals, technical reports, and technical orders
• Catalog-item identifications, data sets, and studies and analyses
• Computer software executable code and source code

DoD Instruction (DoDI) 5230.24, effective January 10, 2023, draws the outer edge. The instruction's CTI category excludes general scientific, mathematics, or engineering principles commonly taught in schools, colleges, and universities, and information in the public domain. The authorized markings are Distribution Statements B, C, D, E, or F, or REL TO.

DoDI 5200.48, the DoD CUI instruction effective March 6, 2020, draws its line at basic research. Scientific, technical, and engineering information beyond basic research, with military or space application and subject to controls, is treated as CUI. The instruction warns that such information can become classified by compilation or aggregation.

How CTI sits inside CUI

The National Archives and Records Administration (NARA) CUI Registry entry for CTI lists the category marking CTI, the type Specified, and the banner marking CUI//SP-CTI. The authority cited is 48 CFR 252.204-7012, the Code of Federal Regulations (CFR) citation for the clause.

DoDI 5230.24 ties the two marking systems together in paragraph 3.4. All unclassified CTI must be marked as CUI under DoDI 5200.48. CTI originated by or under the control of DoD also carries a distribution statement. Legacy material need not be remarked while it stays under DoD control, but new derivative information that qualifies must be marked.

The first page or cover carries a CUI designation indicator with five lines:

1. Controlled By: the DoD Component
2. Controlled By: the DoD office
3. CUI Category: CTI
4. Distribution Statement: the letter B, C, D, E, or F
5. Point of Contact: the controlling office's telephone number or mailbox

The instruction's own example lists a second category beside CTI, Proprietary Business Information, with Distribution Statement E.

What the clause asks of a contractor

The clause defines covered defense information as unclassified CTI, or other CUI Registry information, that falls in one of two groups. The first is information marked or identified in the contract and provided by or for DoD. The second is information collected, developed, received, transmitted, used, or stored by or for the contractor in support of the contract. The second group can include drawings and code the contractor develops for the contract.

A covered contractor information system is any unclassified system owned or operated by or for the contractor that processes, stores, or transmits that information. Paragraph (b) requires adequate security on it. For a contractor's own system, paragraph (b)(2) sets the minimum as the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 requirements in effect when the solicitation is issued, unless the contracting officer authorizes otherwise.

DoDI 5200.48 sets duties on the DoD side too. DoD must identify CUI in the contracting vehicle when it provides information to contractors. Contracts must require contractors to watch for aggregation that could produce classified information and to report it to a DoD representative. CTI that does become classified falls under the National Industrial Security Program, which has different requirements than the clause.

Paragraph (m) requires flowdown to subcontractors whose work involves covered defense information. The prime contractor decides whether the information keeps that identity, consulting the contracting officer if needed.

When a cyber incident touches CTI

The clause defines compromise broadly. The definition includes the copying of information to unauthorized media. When a contractor discovers a cyber incident affecting covered defense information, paragraphs (c) through (g) apply:

• Review. Look for compromised computers, servers, data, and user accounts, including other systems that may have been accessed.
• Report. Report to DoD at dibnet.dod.mil within 72 hours of discovery, using a DoD-approved medium assurance certificate.
• Malicious software. Submit isolated malicious software to the DoD Cyber Crime Center (DC3), not to the contracting officer.
• Preservation. Keep images of affected systems and relevant packet capture data for at least 90 days from the report.
• Access. Give DoD access to information or equipment needed for forensic analysis, and provide the preserved information if DoD runs a damage assessment.

The prescription has moved. Under class deviation 2026-O0025, Revision 3, signed September 3, 2026, contracting officers use a revised DFARS Part 240 in place of the codified text. The revised Part 240 prescribes the clause at 240.370-5(c), dates it JUN 2026, and keeps the CTI definition word for word.

What to check

• Does the contract identify which information is CTI, as DoDI 5200.48 says DoD must?
• Is the information lawfully publicly available without restrictions, which the definition excludes?
• Does the first page carry a designation indicator with CUI Category CTI, a distribution statement letter, and a point of contact?
• Does technical information the contractor creates for the contract count as covered defense information?
• Which text of the clause is in the contract: the codified MAY 2024 version or the JUN 2026 deviation?
• Is there a path to report compiled CTI that may have become classified?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Sources

1. 1252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (MAY 2024) · Acquisition.gov (Defense Federal Acquisition Regulation Supplement)
2. 2Controlled Technical Information (CUI Registry category) · National Archives and Records Administration (last reviewed May 8, 2025)
3. 3DoD Instruction 5230.24, Distribution Statements on DoD Technical Information, January 10, 2023 · Office of the Under Secretary of Defense for Research and Engineering
4. 4DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 · Office of the Under Secretary of Defense for Intelligence and Security
5. 5Class Deviation 2026-O0025, Revision 3, Revolutionary FAR Overhaul Part 40, DFARS Part 240 · Defense Pricing, Contracting, and Acquisition Policy (signed September 3, 2026)
6. 6Attachment 1, Class Deviation 2026-O0025, Revision 3: DFARS Part 240 · Defense Pricing, Contracting, and Acquisition Policy

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.