What is Controlled Unclassified Information (CUI)?

What is CUI? 

• Government created or owned UNCLASSIFIED information that must be safeguarded from unauthorized disclosure.
• An overarching term representing many difference categories, each authorized by one or more law, regulation, or Government-wide policy. 
• Information requiring specific security measures indexed under one system across the Federal Government.

Controlled Unclassified Information is any information that law, regulation, or governmentwide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526,Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended

Executive Order 13556 “Controlled Unclassified Information” (the Order), establishes a program for managing CUI across the Executive branch and designates the National Archives and Records Administration (NARA) as Executive Agent to implement the Order and oversee agency actions to ensure compliance. The Archivist of the United States delegated these responsibilities to the Information Security Oversight Office (ISOO).

32 CFR Part 2002 “Controlled Unclassified Information” was issued by ISOO to establish policy for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI, self-inspection and oversight requirements, and other facets of the Program. The rule affects Federal executive branch agencies that handle CUI and all organizations (sources) that handle, possess, use, share, or receive CUI—or which operate, use, or have access to Federal information and information systems on behalf of an agency.

1. CUI Basic contains the baseline handling and dissemination controls as identified in the Final Rule issued by NARA (the National Archives and Records Administration) on November 14, 2016. The Federal Information Systems Modernization Act (FISMA) requires that CUI Basic be protected at the FISMA Moderate level and can be marked as either CUI or Controlled. 
2. CUI Specified is a subset of CUI where the authorizing law, policy, or regulation puts more restrictive controls on the handling and control of the CUI Specified content. The underlying authority maintains the handling controls on CUI Specified content and ONLY a designating agency may apply the limited dissemination controls to CUI content.  This cannot be done by an agency that was not the original designating authority.  More importantly, agencies cannot increase CUI Basic’s impact level above moderate external to their agency without an agreement with the external agency or contractor organization operating an information system on their behalf. 

Why do I need to protect CUI? 

Who is responsible for identifying CUI?

The National Archives and Records Administration, per 32 CFR Part 2002 “Controlled Unclassified Information” establishes policy for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI, self-inspection and oversight requirements, and other facets of the Program.

Where can I find the CUI Registry?

The CUI Registry includes the CUI Categories, Category Markings, and additional resources.  The CUI Categories are available at: https://www.archives.gov/cui/registry/category-list

Who can I contact with questions about identifying, marking, safeguarding, disseminating, and disposing of CUI? 

The CUI Executive Agent can be reached at Information Security Oversight Office – Controlled Unclassified Information, National Archives and Records Administration700 Pennsylvania Ave, N.W., Room 100Washington, DC 20408-0001

E-mail:  cui@nara.gov

Why is CUI important?

• The establishment of CUI was a watershed moment in the Department’s information security program, formally acknowledging that certain types of UNCLASSIFIED information are extremely sensitive, valuable to the United States, sought after by strategic competitors and adversaries, and often have legal safeguarding requirements.
• Unlike with classified national security information, DoD personnel at all levels of responsibility and across all mission areas receive, handle, create, and disseminate CUI.
• CUI policy provides a uniform marking system across the Federal Government that replaces a variety of agency-specific markings, such as FOUO, LES, SBU, etc.

Source: Controlled Unclassified Information: What is CUI and it’s Origins (summit7.us)

Where did CUI come from?

• Executive Order 13556 established CUI on November 4, 2010.
• Part 2002 of 32 Code of Federal Regulations prescribed Government-wide implementation standards on September 14, 2016.
• DoD Instruction 5200.48, “Controlled Unclassified Information,” established DoD CUI policy on March 6, 2020. 

The Base Requirements

The March 6, 2020 release of DoD Instruction 5200.48 Controlled Unclassified Information (CUI)  includes the following requirements for DoD Contractors in section 5.3.

a. Whenever DoD provides information to contractors, it must identify whether any of the information is CUI via the contracting vehicle, in whole or part, and mark such documents, material, or media in accordance with this issuance.

b. Whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, will be articulated in the contract, grant, or other legal agreement, as appropriate.

c. DoD contracts must require contractors to monitor CUI for aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information. DoD contracts shall require contractors to report the potential classification of aggregated or compiled CUI to a DoD representative.

d. DoD personnel and contractors, pursuant to mandatory DoD contract provisions, will submit unclassified DoD information for review and approval for release in accordance with the standard DoD Component processes and DoDI 5230.09.

e. All CUI records must follow the approved mandatory disposition authorities whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and this issuance.