01.02 Responsible Organization

Phase 1 - A suggested method would be to include in your policy, a statement that would clearly define the "Responsible Organization" as [Name of Organization/Department] and explicitly state their accountability for protecting Controlled Unclassified Information (CUI). We should outline their responsibilities, including establishing and maintaining the organization's CUI protection program, ensuring compliance with NIST 800-171 Revision 3, and overseeing the implementation of required security controls. Furthermore, the policy should identify the key personnel within the Responsible Organization, such as the CUI Program Manager and other relevant roles, along with their specific duties related to CUI protection. Finally, it should detail how communication and reporting regarding CUI incidents and compliance status will be handled within the organization and with external entities as required.

There is a table in the above example that should be created for our use.