The text of the CUI Safeguarding and Dissemination Procedure
Approval #
The Controlled Unclassified Information (CUI) Program Manager approves this document for the CUI Senior Agency Official. The Chief Information Security Officer (CISO) concurs on its security content.
| Role | Name | Signature |
|---|---|---|
| CUI Program Manager | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.
Mandate. The CUI Program Manager issues this procedure for the CUI Senior Agency Official (CUI SAO), to carry out the Controlled Unclassified Information (CUI) Policy (POL-CUI-001). It follows 32 CFR 2002.14 and 2002.16, Information Security Oversight Office (ISOO) Notices 2026-01 and 2026-07, and CUI Notices 2018-01, 2019-04, 2020-03, and 2020-04. It applies Federal Information Processing Standards (FIPS) 199, FIPS 200, FIPS 140-3, National Institute of Standards and Technology (NIST) SP 800-53, and NIST SP 800-171 Rev. 3. The CUI Program Manager runs this procedure, and the Chief Information Security Officer (CISO) concurs on its security steps.
1. Purpose and Scope #
Use this procedure to store, send, copy, and share CUI, and to set up the systems and agreements that hold it. It covers CUI in paper and electronic form, inside and outside the Organization’s facilities.
2. Roles #
The roles are defined in the CUI Policy. In the step tables below, each step names the person who acts. The CUI Program Manager coordinates the steps and keeps their records. A step with no citation is the Organization’s own practice.
3. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The document management system | Storing CUI documents in folders limited to authorized holders, and publishing CUI guidance | Documents, access lists, guidance |
| The ticketing system | Questions, requests, challenges, and reports sent to the CUI Program Manager | Request and case records |
| The governance, risk, and compliance (GRC) system | System categorization, System Security and Privacy Plans (SSPPs), and plans of action and milestones (POA&M) | Authorization records |
| The learning management system (LMS) | CUI training and its completion records | Training records |
| The key management service | Encrypting CUI sent outside the Organization’s systems | Encryption settings |
4. Store and Work with CUI #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Authorized holder | 1. Keep CUI only in folders or systems the Organization approved for CUI, with access limited to people who need it (32 CFR 2002.14(c)(1)). | The document management system | Folder access list | AC-03, MP-04 |
| Authorized holder | 2. Work with CUI where people without access cannot see the screen or overhear the talk (32 CFR 2002.14(c)(2)). | The LMS | Training record | PE-05 |
| Authorized holder | 3. Outside the office, keep CUI with you or behind at least one physical barrier, such as a locked bag or room (32 CFR 2002.14(c)(3)). | The LMS | Training record | MP-04 |
| Authorized holder | 4. Lock the screen when leaving the device, and lock paper CUI away before leaving the office. | The LMS | Training record | AC-11, MP-04 |
| Authorized holder | 5. Copy, scan, or print CUI only on Organization equipment that does not keep the data or that is sanitized (32 CFR 2002.14(e)). | The ticketing system | Device record | MP-06 |
| Authorized holder | 6. Do not enter CUI into an SI tool unless the Organization authorized that tool for CUI (ISOO Notice 2026-01). | The LMS | Training record | AC-20, SA-09 |
Evidence: the folder access lists, the device records, and the training records.
5. Set Up a System That Holds CUI #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| System Owner | 1. Record in the security categorization that the system holds CUI, and set confidentiality at moderate or higher (32 CFR 2002.14(g); FIPS 199). | The GRC system | Categorization record | RA-02 |
| System Owner | 2. Apply the moderate baseline controls, with any risk-based tailoring, and list the CUI categories the system holds in the SSPP (FIPS 200; NIST SP 800-53). | The GRC system | SSPP | PL-02 |
| System Owner | 3. Protect CUI at rest and in transit (ISOO Notice 2026-07). Use cryptography validated under FIPS 140-3. | The key management service | Encryption settings | SC-08, SC-28 |
| System Owner | 4. For CUI Specified, add any safeguard its authority requires (32 CFR 2002.14(b)(2)). | The GRC system | SSPP | PL-02 |
| Information System Security Officer (ISSO) | 5. Confirm that a contractor or cloud system run for the Organization meets the same requirements as an Organization system (32 CFR 2002.14(h)(1)). | The GRC system | Authorization record | CA-06, SA-09 |
| CUI Program Manager | 6. For an SI system, join the Chief Information Officer (CIO) and the CISO in assessing its capabilities, limits, and risks before any CUI goes into it (ISOO Notice 2026-01). | The GRC system | Assessment record | RA-03 |
| Authorizing Official | 7. Authorize the system only when the CUI safeguards are in place or tracked as POA&M items. | The GRC system | Authorization decision | CA-06 |
Evidence: the categorization, the SSPP, the encryption settings, any SI assessment, and the authorization decision.
6. Send CUI #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Authorized holder | 1. Confirm that each recipient has a lawful government purpose to receive the CUI, and that no limited dissemination control forbids it (32 CFR 2002.16(a)(1), (c)(1)). | The document management system | Recipient list | AC-21 |
| Authorized holder | 2. Send CUI only through systems that meet the moderate confidentiality level (32 CFR 2002.16(c)(2)). Encrypt any email that holds CUI and leaves the Organization’s systems. | The key management service | Sent message | SC-08 |
| Authorized holder | 3. Share files by link from an approved folder, with access limited to the named recipients. | The document management system | Sharing record | AC-03 |
| Authorized holder | 4. Mail paper CUI in an opaque envelope addressed to a named person, with no CUI marking on the outside. Use tracking where available (32 CFR 2002.14(d); 32 CFR 2002.20(i)). | The ticketing system | Tracking number | MP-05 |
| Authorized holder | 5. Do not discuss CUI on a phone or video call where people without access can hear. | The LMS | Training record | PE-05 |
Evidence: the recipient lists, sharing records, and tracking numbers.
7. Share CUI Outside the Executive Branch #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Program Office | 1. Ask the Contracting Officer or the Office of the General Counsel (OGC) for an agreement before sharing CUI with a contractor, grantee, state, tribe, or other outside entity (32 CFR 2002.16(a)(5)). | The ticketing system | Request | SA-04 |
| Contracting Officer (CO) | 2. Put in the agreement that the entity must handle CUI under 32 CFR Part 2002 and the CUI Registry, that misuse carries penalties, and that the entity must report non-compliance (32 CFR 2002.16(a)(6)). | The document management system | Signed agreement | SA-04 |
| Contracting Officer (CO) | 3. Add the terms CUI Notice 2018-01 recommends, such as the CUI categories involved, where the work happens, and the systems the entity will use. | The document management system | Signed agreement | SA-04 |
| Contracting Officer (CO) | 4. For each contract that requires access to CUI, give the prime contractor guidance on the twelve topics listed below (ISOO Notice 2026-07). | The document management system | Guidance in the contract file | SA-04 |
| Contracting Officer (CO) | 5. For a contractor system that is not a federal system, require NIST SP 800-171 (32 CFR 2002.14(h)(2)). Name Rev. 3. Use other terms only where a CUI authority sets them or the agreement protects CUI above moderate. | The document management system | Contract clause | SA-04, SR-03 |
| Contracting Officer’s Representative (COR) | 6. Before assessing, describe the scope and methods to the contractor. Assess only the parts that handle CUI, with the NIST SP 800-171A procedures (CUI Notice 2020-04). | The GRC system | Assessment record | CA-02, SA-09 |
| Contracting Officer’s Representative (COR) | 7. Confirm the agreement adds no CUI handling rules beyond the program’s rules (32 CFR 2002.22(b)). | The document management system | Review record | SA-04 |
| Program Office | 8. Where a nondisclosure agreement is needed, start from the ISOO template (CUI Notice 2020-03). | The document management system | Signed nondisclosure agreement | PS-06 |
| Authorized holder | 9. When no agreement is feasible, tell the recipient that the government strongly encourages it to protect the CUI under the program, and to pass those protections on when it shares the CUI (32 CFR 2002.16(a)(5)(ii)). | The document management system | Written notice | AC-21 |
| Authorized holder | 10. For a foreign entity, use CUI markings, not other markings, and follow any agreement in place (32 CFR 2002.16(a)(5)(iii)). | The document management system | Marked document | AC-21 |
The guidance for a prime contractor covers these twelve topics (ISOO Notice 2026-07):
- Which government-furnished information is CUI.
- How the contractor identifies information it develops as CUI.
- How to challenge a CUI designation.
- Training requirements and resources.
- Access requirements.
- Marking requirements.
- Safeguarding requirements.
- Decontrol and disposition requirements.
- Reporting requirements.
- Self-inspection requirements.
- How to report misuse of CUI.
- Penalties for misuse of CUI.
No written agreement is needed to share CUI with Congress, a court, the Government Accountability Office, or a requester under the Freedom of Information Act (FOIA) or the Privacy Act (32 CFR 2002.16(a)(7)). The proposed Federal Acquisition Regulation (FAR) CUI rule (FR Doc. 2026-12559) is not final. Until it is, Contracting Officers use the terms above.
Evidence: the signed agreements, contract guidance and clauses, assessment and review records, nondisclosure agreements, and written notices.
8. Oversee CUI Held by Contractors #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| CUI Program Manager | 1. Keep a list of contracts and agreements that share CUI, with the categories and the systems involved, so the CUI SAO can oversee them. | The GRC system | Contract list | SA-09 |
| Contracting Officer’s Representative (COR) | 2. Check that the contractor meets the CUI terms, and report gaps to the CUI Program Manager. | The GRC system | Check record | SA-09 |
| CUI SAO | 3. Accept another agency’s assessment of the same contractor where an interagency agreement allows it, to avoid duplicate reviews (CUI Notice 2019-04). | The document management system | Interagency agreement | CA-02 |
Evidence: the contract list, the check records, and any interagency agreement.
9. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Review access to CUI folders | Every year | Information Owners |
| Check that systems holding CUI are categorized at moderate or higher | At each authorization and every year | ISSOs |
| Check agreements and contract guidance that share CUI | Every year, in the self-inspection | CUI Program Manager |
| Check contractors that hold CUI | Every year | CORs |
10. Records #
Contracting Officers keep agreements and contract guidance in the contract file. System Owners keep categorizations and SSPPs in the GRC system. Information Owners keep folder access lists in the document management system. Each record is kept under the records schedule that applies to it.
11. Related Documents #
12. References #
These are the sources this document cites, with a link to each official text.
- 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
- CUI Notice 2018-01: Guidance for Drafting Agreements with Non-Executive Branch Entities involving CUI, January 24, 2018.
- CUI Notice 2019-04: Oversight of the Controlled Unclassified Information (CUI) Program within Private Sector Entities, September 6, 2019.
- CUI Notice 2020-03: CUI Non-Disclosure Agreement Template Memo, June 3, 2020.
- CUI Notice 2020-04: Assessing Security Requirements for CUI in Non-Federal Information Systems, June 16, 2020.
- CUI Registry.
- FAR: Revolutionary Federal Acquisition Regulation Overhaul — Parts 1, 2, 4, 33, 39, 40, and 53 (proposed rule), June 23, 2026.
- FIPS 140-3: Cryptographic Module Security Requirements, March 22, 2019.
- FIPS 199: Standards for Security Categorization, February 2004.
- FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
- ISOO Notice 2026-01: Responsible Use of Classified National Security Information and Controlled Unclassified Information with AI tools, March 30, 2026.
- ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
- NIST SP 800-171 Rev. 3: Protecting Controlled Unclassified Information in Nonfederal Systems, May 14, 2024.
- NIST SP 800-171A Rev. 3: Assessing Security Requirements for Controlled Unclassified Information.
- Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.