How to Send Email Securely as a Defense Contractor

To send email securely as a defense contractor, the message has to stay inside a system that meets your contract’s safeguarding requirements, reach only recipients authorized to receive it, and carry the correct CUI markings. Encryption is part of that, but a padlock icon in the mail client does not settle the question by itself.

This guide covers the sending decisions made daily when emailing Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) to primes, subs, and government customers. For the controls an assessor reviews on the email system itself, see CMMC Level 2 email controls. For choosing a platform, start with CMMC compliant email for small business.

Under Class Deviation 2026-O0025, Revision 3, the NIST SP 800-171 Rev. 2 baseline under DFARS 252.204-7012 remains in place, so these practices still apply.

What does “secure” mean for CUI email?

Three different protections often get called “encrypted email.” Each covers a different part of the message’s life.

Requirement 3.13.8 calls for cryptographic mechanisms that prevent unauthorized disclosure of CUI during transmission, and 3.13.16 calls for protecting the confidentiality of CUI at rest.

Server-to-server TLS is often opportunistic: RFC 3207 says a publicly referenced mail server must not require TLS to deliver mail locally. MTA-STS (RFC 8461) lets a receiving domain tell senders to refuse delivery without valid TLS. Ask your provider whether outbound mail can fall back to plaintext.

Is the cryptography FIPS-validated?

Requirement 3.13.11 says to employ FIPS-validated cryptography when it protects the confidentiality of CUI. “Validated” means the cryptographic module appears in the NIST Cryptographic Module Validation Program search, not that a vendor uses AES. Our FIPS validated vs compliant guide walks through checking a certificate.

Encryption also does not change what the data is. Encrypted CUI is still CUI, so the systems carrying the ciphertext stay in scope.

Does your email provider need FedRAMP Moderate?

If a cloud provider stores, processes, or transmits covered defense information for you, DFARS 252.204-7012(b)(2)(ii)(D) requires you to “require and ensure” that it meets security requirements equivalent to the FedRAMP Moderate baseline. The provider must also meet the clause’s incident reporting and related paragraphs (c) through (g).

The DoD CIO’s December 21, 2023 memo, “Federal Risk and Authorization Management Program Moderate Equivalency for Cloud Service Provider’s Cloud Service Offerings,” sets out what equivalency means: FedRAMP Moderate authorization, or an assessment by a FedRAMP-recognized third-party assessment organization showing full implementation of the Moderate baseline, with a supporting body of evidence. Read the memo itself before accepting a vendor’s summary of it. Our FedRAMP Moderate vs High comparison and CMMC compliant email providers review cover how specific providers line up.

For a sender, the rule is simple: CUI should leave from an account on a system your organization has confirmed meets the clause.

How do you verify the recipient before you hit send?

Under 32 CFR 2002.16(a)(4), an authorized holder disseminating CUI to a non-executive branch entity must reasonably expect that all intended recipients are authorized to receive it and have a basic understanding of how to handle it. In email, most failures here are mechanical:

• Autocomplete fills in a similar name or an old personal address.
• Lookalike domains change one letter in a prime’s domain.
• Distribution lists hide who is on them.
• Reply-all threads pick up new participants over time.

Suggested steps: keep a list of approved contacts and domains per contract, check every address against it, and confirm any new or changed address through a channel you already trust, such as a phone number from the contract file, not one supplied in the email requesting the change.

How should CUI be marked in an email?

The NARA CUI email marking guidance says a banner marking must appear at the top of the email. “Contains CUI” can also appear in the subject line to alert recipients. When forwarding or replying, carry forward all applicable markings.

Attachments carry their own markings according to the CUI Marking Handbook. When an email serves as a transmittal for attached CUI, 32 CFR 2002.20(j) requires the transmittal to indicate that CUI is attached and to state, as appropriate, how the document should be treated once the enclosure is removed. The handbook illustrates this on page 26.

If your contract or government customer specifies marking instructions, follow those. Ask the contracting officer or the prime when the expected categories or dissemination controls are unclear.

Should you send an attachment or a controlled link?

An attachment is a copy that sits in every recipient’s mailbox and cannot be recalled. A link to compliant file storage keeps the file in one place, where sharing can be limited to named people, access removed, and downloads logged.

Requirement 3.1.3 asks you to control the flow of CUI in accordance with approved authorizations. A controlled link makes that easier to show, because the flow is visible in one audit trail.

Two limits apply. The link should require the recipient to sign in as a named user, not open for anyone holding the URL. And it cannot retrieve a file already downloaded, so agree on how the recipient stores it.

What if the recipient is not on a compliant system?

Sometimes the engineer who needs a drawing uses a consumer mailbox. Sending CUI there moves it outside any boundary you can vouch for, and requirement 3.1.20 asks you to verify and control connections to and use of external systems.

Options to raise with the recipient and, where needed, the prime or contracting officer:

1. Give the recipient access through a named account in your compliant environment, so the CUI never leaves it.
2. Use a transfer method the prime or government customer has designated for the program.
3. Confirm whether the recipient needs the CUI at all, or whether an unmarked summary covers their task.

Record the decision and who approved it. For subcontractors, paragraph (m) of DFARS 252.204-7012 requires the prime to flow the clause down when subcontract performance involves covered defense information, so a sub receiving CUI should already have safeguarding obligations of its own.

What should you never do when emailing CUI?

• Use a personal account. Personal email is an external system outside your control and outside your provider’s FedRAMP Moderate equivalency review.
• Send the password in the same email. Anyone who receives a misdirected message gets both. Use a separate, verified channel, and remember that a password-protected file still leaves your boundary.
• Auto-forward work mail. A rule forwarding to a personal or partner mailbox moves every future CUI message unreviewed. Review mailbox rules and block external auto-forwarding where your system allows it.
• Paste CUI into the body to avoid the attachment. The body is CUI too, and needs the same banner marking.

Use a pre-send checklist

Keep this near anyone who emails program documents.

Where can tooling take some of this off the sender?

Much of the checklist depends on memory. Systems can carry part of it. IRONKEEP MAIL keeps CUI, FCI, and internal handling labels visible in the workflow and applies outbound DLP rules that can block, quarantine, or flag messages by domain, attachment type, keyword, or pattern. IRONKEEP DRIVE supports sharing with named people and logs uploads, downloads, sharing, and access events. Storage, envelope, and client-cache encryption use FIPS 140-3 validated cryptographic modules, and the security overview describes each layer.

IRONKEEP is in private beta and is pursuing FedRAMP authorization but is not currently authorized, so review its fit against your contract’s requirements before introducing CUI. If your team’s gap is CUI going out as unreviewed attachments or to unverified addresses, request a defense pilot around your outbound email workflow. Bring one real sending scenario involving a prime, a sub, or a government customer. The pilot path starts by scoping that one workflow: its users, systems, data flows, and external parties.

Run the checklist on last week’s sent mail

Pick five sent messages from last week that carried program documents. Answer the checklist for each and note every “no” or “not sure.” Those gaps become your first fixes: an approved contact list, a marking template, a forwarding-rule review, or a move to controlled links.

Keep the results with your system security plan notes for the next review.