Defensible Score
Paste guard
If the text looks like CUI and the site is risky or simply not allow-listed, the paste waits. Block, allow once, or allow that host for the browser session.
Browser extension · Defensible Score
Stop accidental CUI leaks at the paste step.
Most Controlled Unclassified Information does not walk out the door in a briefcase. It gets pasted into a chatbot, a personal Gmail draft, or the wrong conversation. Defensible CUI Guard watches copy and paste in the browser, matches local CUI-style markings, and asks you to think twice before it lands somewhere risky.
On-device matching. No clipboard uploads in v0.1. Assists people — does not replace enterprise DLP or CMMC practices. Defensible Score is not a C3PAO and does not issue CMMC certifications.
The accident this is built for
Your team handles CUI correctly in the approved system — then someone highlights a paragraph, copies it, and pastes into a chatbot “just to rewrite the email.” That is not a sophisticated adversary. That is a busy Tuesday.
What it does
Copy reminder
A short toast when a marked selection is copied: paste it only into an authorized system.
Allow list
Your company hosts and the government or GRC tools you actually trust. Allow wins over the high-risk list.
High-risk defaults
Consumer AI, personal webmail, social sites, Slack, public pastebins, translators. The list is editable.
Break-glass
Pause the guard for 15 or 60 minutes when you mean to. Tools that cannot be overridden get uninstalled.
What it does not do
- It does not stop screenshots, phone photos, retyped text, or desktop apps outside the browser.
- It is not Microsoft Purview, Netskope, or a full DLP suite.
- It does not make you CMMC Level 2 certified, and it is not a federal endorsement.
- A determined insider can bypass pattern checks. This product reduces accidents.
If you need a full CUI program, that is a conversation with Defensible Score. The extension is the daily seatbelt.
How detection works
Patterns run on your device: CUI banners, CUI// portion markings, FEDCON and NOFORN, legacy FOUO wording, distribution statements, plus optional org-specific rules you add. A bare “CUI” in the middle of a sentence is not enough to fire — the markers are the banners and portion marks, so ordinary prose is left alone.
Version 0.1 does not send clipboard contents to Defensible Score. The warning shows the rule name and the site, not the text you pasted. Optional anonymous counters would require a later privacy update and an explicit switch. They are not in this version.
Who it’s for
- Defense suppliers and contractors who handle CUI
- Teams practicing CMMC habits who want a visible, teachable control in the browser
- Consultants who want a concrete artifact a client can install during an engagement
Questions
Can someone override a block?
Yes. Allow once, allow the host for the session, or pause the guard. Overrides on high-risk sites are counted on the device so coaching still has a number to look at.
Will this flag every paste?
No. It looks for CUI-style markings and your optional rules, then applies the destination policy. Allow-listed hosts pass through.
Chrome and Firefox?
Yes, when the listings are live.
Is this a Defensible Score subscription?
The browser guard is a companion. Deeper CUI and CMMC readiness work is a separate conversation. We prepare teams for assessment paths. We do not certify them.