An organization protects Controlled Unclassified Information (CUI) through implementing NIST SP 800-171 and NIST SP 800-171A.
This is defined by both the Defense Federal Acquisition Regulation Supplement (DFARS) and US National Archives (NARA).
