Modernizing Government IT While Protecting Controlled Unclassified Information

The Challenge: Finding and Managing CUI

Documents may contain information that can become a national threat, yet agencies aren’t always able to spot the risk. “CUI right now is often generated faster than it can be manually labeled,” Fink says.

In many cases, agencies “may not be aware that the documents contain CUI and therefore must be handled in a different manner,” says Steve Thamasett, public sector field CISO for the Google team at CDW Government. But the problem goes even deeper: While Document A and Document B may not contain CUI, merging them may create a CUI risk.

All this becomes especially urgent as agencies modernize. They may be deploying AI agents to drive efficiency, and they need to be certain these agents aren’t pulling information from documents that may contain CUI. But agentic AI can also help to address these challenges.

EXPLORE: AI-enabled platforms are transforming government.

Automation Offers a Way Forward

To identify CUI, agencies need a way to analyze vast data repositories. That can be done manually, but it’s potentially an overwhelming task. Automation is needed here, as AI can categorize documents faster than any human.

“It can scan information and give you some feedback results — a confidence score,” Fink says. That helps bring the CUI to light and can guide the modernization effort, ensuring that processes steer clear of those sensitive documents.

All this helps human operators to know where to put their focus as they look to safeguard CUI. “You can have an agent run through a hundred documents, and maybe it comes back with eight. Now the human only has to evaluate those eight documents,” Thamasett says.

To bring that vision to life, CDW has leveraged powerful toolsets from Google Public Sector. They’ve developed an AI agent that gives agencies ready visibility into their documents as they look to safeguard CUI.

Click the banner below to learn how companies are scaling AI adoption.

A Powerful Partnership for AI and Document Management

The CDW agent can scan and categorize documents and rank them for urgency. What does that look like in practice? In one case, “we had a maintenance ticket, and my first thought was: Maintenance ticket? There’s not going to be CUI in there!” Fink says.

In fact, the AI agent gave it a 60% confidence score. Turns out, that ticket spoke to where and how radiological materials were stored — not something you’d want the bad actors to see. With the AI agent identifying the risk and highlighting the potential adverse effect, “a compliance officer would now know to stamp it with a CUI label,” Fink says.

This approach illustrates the power of combining Google tools with CDW’s deep insights into the needs and workings of federal government.

“The agent was developed by CDW personnel using Gemini Enterprise and Google’s AI Agent Development Kit (ADK),” Thamasett says. “Gemini Enterprise allowed our developers to build something that goes beyond a simple keyword search — looking for buzzwords like ‘nuclear.’ It can find passages in these documents and also relate the context.”

The agent doesn’t make the final determination of whether something is a CUI risk; that’s left to human judgment. “But it can increase efficiency dramatically,” Thamasett says.

This can be a boon to civilian agencies, and Google’s recent announcement that Gemini models are now available for use by the military further expands the potential to accelerate modernization across federal government.

LEARN MORE: How federal agencies can get cloud cost management under control.

Next Steps That Federal Agencies Can Take

Federal agencies can begin now to move toward an AI-informed approach to securing CUI. That starts with elevating risk awareness.

“The first step is getting the stakeholders to the table,” Thamasett says. “That will involve the CISO, general counsel and mission owners, because it’s not just an IT problem. They need to understand the ramifications of CUI potentially being exposed.”

From there, agencies can start to get their data in order and establish rules of the road. CDW can help define that governance before agencies move ahead and can support them through each phase of adoption, from data readiness and policy development to deploying and scaling AI agents in production environments.

Brought to you by: