Data Handling and AI Ground Rules (Read First)

💡 Key concepts

• CUI (Controlled Unclassified Information): Government-created or government-owned information that needs safeguarding or dissemination controls under law, regulation, or policy. Program cost data, contract details, schedules, and technical data are often CUI. Your agency's CUI policy is the authority. The National Archives CUI Registry is the government-wide reference.
• Other sensitive categories: PII, contractor proprietary data, source selection information, export-controlled technical data (ITAR/EAR), pre-decisional budget information, and classified information (never on unclassified systems at all).
• Public vs. approved tools: Consumer chatbots can retain, log, or train on what you enter. Only tools your organization has authorized for a given data type are acceptable for that data.
• Schema, not data: Describe column names and types, and use made-up sample rows. Even program names and code names can be sensitive, so sanitize them as well.
• Aggregation risk: Several individually harmless details can become sensitive when combined.

🛠 Hands-on exercise

Take this (fictional) request and rewrite it so it is safe to send to a public AI tool:

"Here's my IRONWOOD EVM export for contract XX0001-24-C-0107 with Fabrikam. CPI is 0.87. Write me a DAX measure for EAC."

Rewritten version: "I have a table EVM with columns PeriodEnd (date), BCWP, ACWP, BAC (currency, current-period values except BAC). Write a DAX measure for cumulative CPI and an independent EAC = BAC / CPI. Handle divide-by-zero."

📦 Mini-project

Write your personal "AI Use Card": a pocket checklist of 5–7 rules, based on your organization's actual policy. Find out who your CUI program manager or AI governance contact is.