**This report was updated on March 11, 2024. See the revision memo click here.
This special report provides insight into the common cybersecurity weaknesses identified in DoD Office of Inspector General audit reports and through our support to the Defense Criminal Investigative Service and the Department of Justice on Civil Cyber-Fraud Initiative investigations related to DoD contractor compliance with Federal cybersecurity requirements for protecting controlled unclassified information. CUI is not classified information but is information created or possessed by the Government that requires safeguarding or dissemination controls according to applicable laws, regulations, and Government-wide policies as defined in Executive Order 13526, “Classified National Security Information,” December 29, 2009.