Controlled Unclassified Information (CUI) Policy

Approval #

The CUI Senior Agency Official approves this policy under 32 CFR 2002.8(c). The Chief Information Security Officer (CISO) concurs on its security requirements. The Information Security Oversight Office (ISOO) reviews and approves it before it takes effect.

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.

Mandate. Executive Order 13556 set up one program for unclassified information that a law, regulation, or government-wide policy requires agencies to protect or to share only in limited ways. That information is Controlled Unclassified Information (CUI). 32 CFR Part 2002 sets the rules of the program. The CUI Registry lists the categories, the markings, and the limited dissemination controls. The Information Security Oversight Office (ISOO) of the National Archives and Records Administration (NARA) runs the program for the government as the CUI Executive Agent.

ISOO issues notices that bind agency actions. ISOO Notice 2026-07 lists the elements every agency CUI program must have. ISOO Notice 2026-08 sets the rules for waivers. ISOO Notice 2026-01 sets the rules for CUI in the systems its title names. Under Executive Order 14434, this policy calls them Super Intelligence (SI) systems. Earlier CUI Notices that remain in effect add guidance on agreements, marking, training, and destruction.

Under 32 CFR 2002.8(c), the CUI Senior Agency Official (CUI SAO) directs and oversees the Organization’s CUI program. The CUI SAO owns and signs this policy, and ISOO reviews and approves it. The Chief Information Security Officer (CISO) concurs on its security requirements. Five procedures give the steps, and Related Documents lists them. The CUI Program Manager signs the procedures.

1. Policy Statement #

The Organization protects CUI at all times, in a way that keeps the risk of unauthorized disclosure low and still lets authorized holders get the information on time (EO 13556; 32 CFR 2002.14(a)(1)). It uses only the categories, markings, and controls in the CUI Registry. It shares CUI whenever sharing furthers a lawful government purpose and no law forbids it. It does not use CUI markings to hide wrongdoing or to avoid embarrassment. The CUI SAO directs the program, and the CUI Program Manager runs it day to day.

2. Scope #

This policy applies to:

• Every employee, detailee, intern, and contractor of the Organization who has access to CUI. In this policy, each of them is an authorized holder.
• CUI the Organization designates and CUI it receives from other agencies or from outside entities, in any form.
• Every information system that processes, stores, or transmits CUI, including systems a contractor or cloud service provider operates for the Organization.
• Every agreement under which the Organization shares CUI with an entity outside the executive branch.

This policy does not cover classified national security information. It does not bind an entity outside the Organization unless a CUI authority in the CUI Registry makes it apply (32 CFR 2002.22(a)). An agreement may also bind such an entity (32 CFR 2002.1(f)).

3. Requirements #

3.1 Running the program #

1. The Agency Head must designate a CUI SAO in writing, at the Senior Executive Service level or equivalent (32 CFR 2002.8(b)(2), (c)(1); ISOO Notice 2026-07).
2. The CUI SAO must designate a CUI Program Manager in writing, with direct access to the CUI SAO and the authority and resources to run the program (32 CFR 2002.8(c)(3); ISOO Notice 2026-07). The CUI Program Manager represents the Organization to ISOO on day-to-day program matters.
3. The CUI SAO must send ISOO the change form whenever either official changes (CUI Memo 2018-10-16).
4. The CUI SAO approves this policy. Where the Organization’s directives call for it, the Agency Head also approves it (32 CFR 2002.8(b)(3)). ISOO, as the CUI Executive Agent, reviews and approves agency CUI policies (32 CFR 2002.4(b); 32 CFR 2002.8(a)(4)). The CUI SAO sends this policy and each major revision to ISOO before it takes effect.
5. The CUI SAO must approve any CUI policy an office or component of the Organization issues (ISOO Notice 2026-07).
6. The CUI Program Manager must publish this policy and its procedures to all personnel (ISOO Notice 2026-07).
7. The CUI SAO must set up processes for decontrol requests, challenges, misuse reports, and questions about unmarked CUI (32 CFR 2002.8(c)(9), (12)–(14)).
8. The CUI SAO must send ISOO an annual report on program status, challenges, misuse, metrics, and waivers (32 CFR 2002.8(c)(10); ISOO Notice 2026-07). The CUI SAO must also send any update ISOO asks for (32 CFR 2002.8(c)(6)).
9. The CUI SAO must send ISOO any law, regulation, or government-wide policy that calls for CUI controls but is missing from the CUI Registry (32 CFR 2002.8(c)(7); CUI Notice 2018-06). Authorized holders must follow that law’s own marking, safeguarding, and sharing rules. Once the letter is sent, they may protect the information as CUI Basic (CUI Notice 2018-06).
10. The CUI SAO oversees the CUI the Organization gives to contractors and other private sector entities under agreements (CUI Notice 2019-04).

3.2 Designating CUI #

1. Personnel may designate information as CUI only under a category or subcategory the CUI Registry lists (32 CFR 2002.12).
2. Personnel must not mark information as CUI to conceal illegality, negligence, ineptitude, or other embarrassing facts, or for any purpose other than the authority behind the category (32 CFR 2002.20(a)(6)).
3. Personnel must not use legacy markings such as “For Official Use Only” or “Sensitive But Unclassified.” A legacy marking left on information is void (32 CFR 2002.20(a)(2)).
4. Authorized holders must handle information that qualifies as CUI as CUI, even when it carries no marking (32 CFR 2002.20(a)(7)).
5. Personnel may use supplemental markings such as “Draft” or “Pre-decisional” only as the Agency Head authorizes, and only to show that a document is not final (32 CFR 2002.20(l)). The CUI Program Manager publishes the rules for their use.

3.3 Marking CUI #

1. Authorized holders must mark CUI the same way in every format, including documents, email, electronic files, and metadata (ISOO Notice 2026-07). They follow 32 CFR 2002.20 and the CUI Marking Handbook.
2. The Organization uses the acronym “CUI” as the control marking. The regulation lets an agency choose it (32 CFR 2002.20(b)(1)).
3. The banner must include every CUI Specified category marking that applies, and any limited dissemination control marking (32 CFR 2002.20(b)(2)–(3)).
4. Each document must show that the Organization designated the CUI, on the first page or cover (32 CFR 2002.20(d)).
5. The designator must give a decontrol date or event with all CUI (ISOO Notice 2026-07; 32 CFR 2002.20(e)).
6. Designators are encouraged to portion mark. A designator who portion marks must mark both the CUI portions and the uncontrolled portions (32 CFR 2002.20(f)).
7. Where marking each item is not practical, authorized holders must use another method that makes the CUI status readily apparent, such as a system banner or a sign (32 CFR 2002.20(a)(8)). The CUI Program Manager approves each such method.
8. Authorized holders must mark unmarked CUI before they share it with anyone (32 CFR 2002.20(a)(5)). They must mark CUI under a marking waiver before it leaves the Organization (32 CFR 2002.38(d)(4)).
9. Information Owners must review documents created before November 14, 2016. They must re-mark those that hold CUI, or use an alternate marking method (32 CFR 2002.36(a)).
10. Authorized holders who reuse legacy CUI must re-mark it as CUI, even under a legacy marking waiver (32 CFR 2002.38(b)(2)).
11. Authorized holders must mark CUI in a classified document under 32 CFR 2002.20(g) and CUI Notice 2018-05.
12. Where the Organization uses cover sheets and media labels, authorized holders must use the Standard Form (SF) 901 cover sheet and the SF 902 and SF 903 labels (32 CFR 2002.32; CUI Notice 2019-01).

3.4 Protecting CUI #

1. Authorized holders must keep CUI in controlled environments that stop unauthorized people from seeing, hearing, or getting it (32 CFR 2002.14(c)).
2. Outside a controlled environment, authorized holders must keep CUI under their direct control or behind at least one physical barrier (32 CFR 2002.14(c)(3)).
3. System Owners must categorize every federal information system that holds CUI Basic at no less than the moderate confidentiality impact level (32 CFR 2002.14(g); FIPS 199). They must apply the Federal Information Processing Standards (FIPS) 200 and National Institute of Standards and Technology (NIST) SP 800-53 controls for that level, with any risk-based tailoring (32 CFR 2002.14(g)).
4. System Owners must protect CUI at rest and in transit with physical, technical, and handling safeguards (ISOO Notice 2026-07). The Organization uses cryptography validated under FIPS 140-3 to do so.
5. Authorized holders must protect CUI Specified as its own law or regulation requires (32 CFR 2002.14(b)(2)).
6. Authorized holders may copy, scan, or print CUI for a lawful government purpose. System Owners must use equipment that keeps no data, or sanitize it (32 CFR 2002.14(e)).
7. Authorized holders must address a package that holds CUI to a named recipient, with no CUI marking on the outside (32 CFR 2002.20(i)).

3.5 CUI and Super Intelligence (SI) systems #

1. Personnel must not enter CUI into an SI system that is internet-enabled, connected to infrastructure outside the Organization’s control, or not authorized to protect CUI (ISOO Notice 2026-01).
2. ISOO advises that the Chief Information Officer (CIO), the CISO, the CUI Program Manager, and information technology staff assess a system’s capabilities, limits, and risks before CUI goes into it (ISOO Notice 2026-01). The Organization requires that assessment before it allows CUI in any SI system.
3. An SI system that holds CUI must have an authorization to operate at no less than the moderate confidentiality impact level (32 CFR 2002.14(g)). The Super Intelligence (SI) Governance and Acquisition Policy governs every other use of SI.

3.6 Sharing CUI #

1. Authorized holders should share CUI when sharing furthers a lawful government purpose and follows the authority for the category. A limited dissemination control or a law may forbid it (32 CFR 2002.16(a)(1)).
2. Only the designating agency may apply a limited dissemination control, and only a control listed in the CUI Registry (32 CFR 2002.16(b)(4); CUI Notice 2018-07). The CUI SAO decides which roles may apply each control.
3. Before CUI goes to an entity outside the executive branch, the authorized holder must reasonably expect each recipient to be authorized and to know how to handle it (32 CFR 2002.16(a)(4)).
4. Whenever feasible, the Organization should put an agreement in place before sharing CUI outside the executive branch (32 CFR 2002.16(a)(5)(i)). The agreement must include the provisions in 32 CFR 2002.16(a)(6). CUI Notice 2018-01 recommends further terms.
5. For each contract that requires access to CUI, the Contracting Officer must give the prime contractor guidance on the twelve topics ISOO Notice 2026-07 lists. The CUI Safeguarding and Dissemination Procedure lists them.
6. Contracts must use National Institute of Standards and Technology (NIST) SP 800-171 for contractor systems that hold CUI Basic and are not federal information systems (32 CFR 2002.14(h)(2)). Only a CUI authority, or an agreement that protects CUI Basic above moderate confidentiality, may set other requirements (32 CFR 2002.14(h)(2)). The Organization requires NIST SP 800-171 Rev. 3.
7. The Organization assesses only the contractor systems and components that handle CUI, with the NIST SP 800-171A procedures. It describes the scope and methods to the contractor before the assessment (CUI Notice 2020-04). It names NIST SP 800-172 Rev. 3 only for CUI in a critical program or a High Value Asset.
8. Agreements must not add CUI handling requirements beyond those the program allows (32 CFR 2002.22(b)).
9. Sharing CUI with Congress, a court, the Government Accountability Office, or a requester under the Freedom of Information Act (FOIA) or the Privacy Act needs no written agreement (32 CFR 2002.16(a)(7)).

3.7 Decontrolling and destroying CUI #

1. The Organization should decontrol CUI it designated as soon as practicable once the CUI no longer needs protection (32 CFR 2002.18(a)). The CUI SAO must keep procedures for timely decontrol (ISOO Notice 2026-07).
2. Authorized holders may treat CUI as decontrolled once its decontrol date or event arrives, with no further review (32 CFR 2002.20(e)(2)). CUI is also decontrolled when its authority no longer requires control, or when the Organization releases it to the public (32 CFR 2002.18(b), (i)). Any other decontrol needs a decision by an official the CUI SAO names, as 32 CFR 2002.18(d) allows.
3. Decontrol does not authorize public release. Public release follows the Organization’s release rules (32 CFR 2002.18(e), (g)).
4. Personnel must not decontrol CUI to hide an unauthorized disclosure. An unauthorized disclosure does not decontrol CUI (32 CFR 2002.18(j)–(k)).
5. Information released in response to a FOIA request is, as a general matter, decontrolled (CUI Joint Memo 2018-11-19). To keep protecting it, the CUI Program Manager must first consult the Office of the General Counsel (OGC).
6. Authorized holders may destroy CUI only when the Organization no longer needs it and a NARA-approved records schedule allows it (32 CFR 2002.14(f)(1)).
7. Destruction must make CUI unreadable, indecipherable, and irrecoverable. Authorized holders must use NIST SP 800-88 or a method approved for classified information, unless the CUI’s own authority sets a method (32 CFR 2002.14(f)(2)). The Organization applies NIST SP 800-88 Rev. 2.
8. Authorized holders must destroy paper CUI with a cross-cut shredder that makes particles of 1 mm by 5 mm or smaller, or a disintegrator with a 3/32 inch screen. A multi-step process is allowed once the Organization verifies it (CUI Notice 2019-03).
9. The Agency Records Officer must dispose of CUI records under approved records schedules and NARA accessioning guidance (ISOO Notice 2026-07).

3.8 Training #

1. Everyone who handles CUI must complete CUI training when they first begin working for the Organization, and at least once every two years after that (32 CFR 2002.30(c)). The Organization also requires the training before anyone gets access to CUI.
2. The training must cover designating CUI, the categories in use, the CUI Registry, markings, and the rules for safeguarding, sharing, and decontrolling (32 CFR 2002.30(b)). CUI Notice 2018-02 recommends the content.
3. The CUI Program Manager must track completion of the training for everyone who handles CUI (ISOO Notice 2026-07).

3.9 Challenges, misuse, and incidents #

1. An authorized holder who believes in good faith that information is designated as CUI wrongly, or who receives unmarked CUI, should tell the CUI Program Manager (32 CFR 2002.50(a)).
2. A person who brings a challenge may stay anonymous and must not face retribution for it (32 CFR 2002.50(c)(5)).
3. The CUI Program Manager must tell all authorized holders of a challenge decision, inside and outside the Organization (ISOO Notice 2026-07).
4. The CUI SAO sets the process and criteria for reporting and looking into misuse of CUI (32 CFR 2002.54(a)). Under that process, personnel report any suspected misuse to the CUI Program Manager.
5. Personnel must report a suspected unauthorized disclosure of CUI as an incident, under the Incident Response Policy.
6. The Organization may take administrative action against personnel who misuse CUI, as the Agency Head’s authority allows (32 CFR 2002.56(a)). Sanctions that a CUI authority sets apply as written (32 CFR 2002.56(b)).

3.10 Waivers and self-inspection #

1. The CUI SAO may waive marking requirements for CUI while it stays within the Organization (32 CFR 2002.38(a)–(b)). In exigent circumstances, the Agency Head or the CUI SAO may waive other requirements (32 CFR 2002.38(c)).
2. An exigent circumstances waiver is only for extremely rare cases. It must be necessary to prevent harm to the Organization or its personnel, or to keep information flowing in an emergency (ISOO Notice 2026-08). A burdensome requirement is not enough.
3. Each waiver must describe the alternate protections. It must end without delay when the reason for it ends (32 CFR 2002.38(d)), or when a review finds it inconsistent with 32 CFR 2002.38 (ISOO Notice 2026-08).
4. The CUI SAO must send each waiver to ISOO within 30 days after the circumstances that call for it arise. When ISOO finds a waiver out of compliance, the CUI SAO has 60 days to amend, revise, or rescind it (ISOO Notice 2026-08).
5. The CUI SAO must keep a record of each waiver, tell authorized recipients and the public about it, and include it in the annual report (32 CFR 2002.38(e)).
6. The CUI SAO must run a self-inspection of the CUI program at least once a year and record the results (32 CFR 2002.24; ISOO Notice 2026-07).

3.11 CUI and disclosure laws #

1. Marking information as CUI does not decide whether a law requires or permits its release. FOIA and Privacy Act decisions rest on the content and on those laws (32 CFR 2002.44; 32 CFR 2002.46).
2. This policy does not limit any whistleblower protection provided by law (32 CFR 2002.44(c)).
3. The Senior Agency Official for Privacy (SAOP) advises the CUI SAO on which privacy information the CUI Registry requires the Organization to mark.

4. Roles and Responsibilities #

5. How the CUI SAO Measures the Program #

Each quarter, the CUI Program Manager reports these measures to the CUI SAO:

• The share of personnel with access to CUI whose CUI training is current.
• Open challenges, misuse reports, and decontrol requests, with their age.
• CUI incidents reported, and the time each took to report.
• Open waivers, their end dates, and the dates ISOO received them.
• Contracts and agreements that share CUI without the required terms or guidance (the target is zero).
• Self-inspection findings that remain open.

6. Where This Policy Meets 32 CFR Part 2002 and the ISOO Notices #

7. Related Documents #

8. References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• CUI Joint Memo 2018-11-19: Decontrolling CUI in response to a FOIA request: Decontrolling CUI in response to a FOIA request, November 19, 2018.
• CUI Marking Handbook, May 24, 2019.
• CUI Memo 2018-10-16: CUI Senior Agency Official/Program Manager Change Form: CUI Senior Agency Official/Program Manager Change Form, October 16, 2018.
• CUI Notice 2018-01: Guidance for Drafting Agreements with Non-Executive Branch Entities involving CUI, January 24, 2018.
• CUI Notice 2018-02: Recommendations for CUI Basic Training, January 24, 2018.
• CUI Notice 2018-05: Implementation Guidance when CUI is commingled with CNSI, October 24, 2018.
• CUI Notice 2018-06: Establishing, Eliminating or Modifying Categories of CUI, November 16, 2018.
• CUI Notice 2018-07: CUI Limited Dissemination Controls, November 16, 2018.
• CUI Notice 2019-01: CUI Coversheet and Media Labels, February 22, 2019.
• CUI Notice 2019-03: Destroying CUI in Paper Form, July 15, 2019.
• CUI Notice 2019-04: Oversight of the Controlled Unclassified Information (CUI) Program within Private Sector Entities, September 6, 2019.
• CUI Notice 2020-04: Assessing Security Requirements for CUI in Non-Federal Information Systems, June 16, 2020.
• CUI Registry.
• Executive Order 13556: Controlled Unclassified Information, November 4, 2010.
• FIPS 140-3: Cryptographic Module Security Requirements, March 22, 2019.
• FIPS 199: Standards for Security Categorization, February 2004.
• ISOO Notice 2026-01: Responsible Use of Classified National Security Information and Controlled Unclassified Information with AI tools, March 30, 2026.
• ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
• ISOO Notice 2026-08: Controlled Unclassified Information (CUI) Program Revised Requirements for Waivers, September 2, 2026.
• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.
• NIST SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems, May 14, 2024.
• NIST SP 800-171A Rev. 3: Assessing Security Requirements for Controlled Unclassified Information.
• NIST SP 800-172 Rev. 3: Enhanced Security Requirements for Protecting Controlled Unclassified Information, May 13, 2026.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.