Get (revised July 21, 2008) 252.204-7000 Disclosure Of Information. As ...

Essentially, CTI is a specific category of CUI (listed on the CUI Registry as part of the Defense organizational index grouping) while CDI is a DoD term that encompasses all categories of CUI plus any other information DoD has not approved for public release.

The DoD requiring activity is responsible for identifying covered defense information (CDI) in ance with DoD procedures for identification and protection of controlled unclassified information found in DoDM 5200.01 Vol 4, DoD Information Security Program: Controlled Unclassified Information (CUI).

The term Covered Defense Information (CDI) will usually only come up in connection with Department of Defense (DoD) research agreements and other DoD contracts. CDI is essentially CUI.

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

252.204-7001 Reserved. 252.204-7002 Payment for Subline Items Not Separately Priced. 252.204-7003 Control of Government Personnel Work Product.

DFARS 7019 is a clause that requires contractors to have a cybersecurity plan in place, while CMMC is a framework that assesses a contractor's cybersecurity practices and assigns a certification level based on their maturity and compliance with cybersecurity requirements.

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Covered Defense Information (CDI): Is a term defined in the DFAR clause 252.204-7012 Safeguarding Covered Defense Information as unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) registry that requires safeguarding or dissemination controls ...