Protect your CUI files.
Keep the proof for CMMC.

A protected file can only be unlocked by someone signed in to CUIVault who has the right key, or who it was shared with through CUIXchange.

CUIVault has three roles: Admin, User and Auditor. Settings, saved keys and the audit log are off-limits to anyone without the right role.

Unlocked files can only be saved to folders you approve, and files can only be shared with people you approve. An administrator also approves each document before it leaves CUIVault.

The Admin, User and Auditor roles keep everyday file work separate from managing settings and reviewing the log.

You still: decide who gets each role, and review the list from time to time.

Admin-only tasks are blocked for everyone else, and every blocked attempt goes into the audit log.

Five wrong codes in a row lock sign-in for 15 minutes. Restarting CUIVault doesn't reset the count.

A CUI handling notice appears every time CUIVault starts, and each person has to accept it to go on.

After 30 minutes without activity, or the limit you set, CUIVault ends the session and covers every screen. Getting back in takes a fresh sign-in.

Files you protect stay encrypted on any laptop, even if it's lost or stolen.

You still: turn on full-disk encryption, such as BitLocker, for everything else on the laptop.

CUIXchange only connects to computers on your office network and refuses anything from the internet. DoD SAFE downloads use a checked, secure connection.

You still: control the rest of your company's connections to outside systems.

Every sign-in, encryption, decryption, share, download and delete goes into the audit log, including attempts that were denied.

You still: decide how long to keep the log, and back it up.

Each record names the person, what they did, to which file, when, and whether it worked.

If the audit log can't be written, CUIVault stops the action and tells you, instead of carrying on without a record.

Review the log on screen, filter it by what happened (succeeded, failed or denied), and export it as a spreadsheet (CSV), as JSON, or in CEF, the format security monitoring tools read.

You still: review the log on a regular schedule and follow up on anything odd.

Every record is time-stamped. CUIVault can check its clock against a time server you choose, and flags any record made while it couldn't confirm the time.

You still: keep your computers' clocks in sync.

Each record is chained to the one before it, so any change or deletion shows up when you press Verify. Checkpoints also go to the Windows Event Log as a second record.

You still: copy the log somewhere your staff can't change it, such as a central log server.

Only people with the Admin or Auditor role can open or export the audit log.

CUIVault's security settings live in a signed file your administrator installs. People can't change it, and CUIVault won't start if someone tampers with it or deletes it.

Everyone has their own sign-in, and CUIVault checks it every time it starts and every time it unlocks.

In CUI mode, people sign in with a smart card and its PIN. Otherwise, they add a 6-digit code from an authenticator app on their phone to their Windows sign-in.

Each phone code works only once, and a smart-card sign-in answers a fresh challenge every time, so a copied code is useless.

Key passwords need at least 14 characters, with upper- and lowercase letters, a number and a symbol. You can make the rules stricter.

A key can't go back to any of its last five passwords.

Mark a password as temporary, and CUIVault makes the person choose a new one the first time they use it.

CUIVault never saves your passwords. Your saved keys are locked with them, and all it keeps is a one-way check value that can't be turned back into the password.

Passwords show as dots on the screen.

Files you protect are encrypted wherever they're saved: your computer, a file server or a USB drive.

You still: lock up paper copies and the drives themselves.

Only someone with the key and its password, or the person it was shared with, can unlock a protected file.

Secure delete overwrites a file three times before deleting it.

You still: wipe or destroy old drives, especially solid-state drives, and take care of backup and cloud copies.

A yellow CUI banner runs across the window, and every file CUIVault unlocks or downloads gets a label file saying it's CUI, where it came from, who unlocked it and when.

You still: make sure the markings inside your documents are right.

Every share, export and DoD SAFE download is recorded: who sent it, to whom, and when. For shared files you can also see when they were accepted and opened.

You still: keep track of USB drives and laptops that leave the office.

Protected files stay encrypted when you copy them to a USB drive or a laptop.

CUIVault won't save unlocked files to USB drives or other removable media.

You still: control USB ports on your computers with Windows settings.

Backups of protected files stay encrypted, so a lost backup drive doesn't expose them.

CUIXchange refuses connections from outside your office network and logs every refused attempt.

You still: run a firewall where your network meets the internet.

Files shared through CUIXchange are encrypted before they leave your computer and travel over an encrypted connection. DoD SAFE downloads use a verified secure connection.

CUIVault makes strong keys, saves them locked with a password, and shows how often each one is used.

You still: back up your saved keys. Without them, the files they protect can't be unlocked.

CUIVault locks files with the FIPS-validated encryption built into Windows. In CUI mode it refuses to lock or unlock files unless Windows is running in FIPS mode.

You still: turn on FIPS mode in Windows on each computer.

Before any file moves, the two computers prove who they are to each other, and you confirm the other person by reading a short code aloud over the phone.

Files are locked with AES-256 encryption and can't be read without the key.

Before CUIVault locks a file or saves a DoD SAFE download, it scans the file with Microsoft Defender or the antivirus you choose. A file that fails the scan is blocked.

You still: run up-to-date antivirus on every computer.

CUIVault warns you when a file has been changed or damaged or the wrong key is used, and records every denied or failed attempt so you can spot trouble.