The text of the CUI Decontrol and Destruction Procedure
Approval #
The Controlled Unclassified Information (CUI) Program Manager approves this document for the CUI Senior Agency Official. The Chief Information Security Officer (CISO) concurs on its security content.
| Role | Name | Signature |
|---|---|---|
| CUI Program Manager | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.
Mandate. The CUI Program Manager issues this procedure for the CUI Senior Agency Official (CUI SAO), to carry out the Controlled Unclassified Information (CUI) Policy (POL-CUI-001). It follows 32 CFR 2002.14(f), 2002.18, and 2002.34, Information Security Oversight Office (ISOO) Notice 2026-07, CUI Notice 2019-03, CUI Joint Memo 2018-11-19, and National Institute of Standards and Technology (NIST) SP 800-88 Rev. 2. The CUI Program Manager runs this procedure, and the Chief Information Security Officer (CISO) concurs on its security steps.
1. Purpose and Scope #
Use this procedure to decontrol CUI, to release formerly controlled information, to destroy CUI, and to transfer CUI records to the National Archives and Records Administration (NARA). It covers CUI the Organization designated and CUI it holds from others.
2. Roles #
The roles are defined in the CUI Policy. In the step tables below, each step names the person who acts. The CUI Program Manager coordinates the steps and keeps their records. A step with no citation is the Organization’s own practice.
3. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The document management system | Storing CUI documents in folders limited to authorized holders, and publishing CUI guidance | Documents, access lists, guidance |
| The ticketing system | Questions, requests, challenges, and reports sent to the CUI Program Manager | Request and case records |
| The governance, risk, and compliance (GRC) system | System categorization, System Security and Privacy Plans (SSPPs), and plans of action and milestones (POA&M) | Authorization records |
| The learning management system (LMS) | CUI training and its completion records | Training records |
4. Decontrol CUI #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Authorized holder | 1. Treat CUI as decontrolled once its decontrol date or event has passed. No further review is needed (32 CFR 2002.20(e)(2)). | The document management system | Decontrol indicator | MP-03 |
| Information Owner | 2. Each year, find CUI the Organization designated that no longer needs protection, and send it for decontrol (32 CFR 2002.18(a); ISOO Notice 2026-07). | The document management system | Review list | MP-03 |
| Authorized holder | 3. To ask for decontrol, send a request with the reason to the CUI Program Manager (32 CFR 2002.18(h)). | The ticketing system | Request | MP-03 |
| CUI Program Manager | 4. Send the request to the official the CUI SAO named for that category. Ask the Office of the General Counsel (OGC) when the authority sets its own decontrol rules (32 CFR 2002.18(d), (l)). | The ticketing system | Routing record | MP-03 |
| Named official | 5. Decide within 30 days and record the reason. Refuse a request that would hide an unauthorized disclosure (32 CFR 2002.18(k)). | The ticketing system | Decision | MP-03 |
| Author | 6. When restating, reusing, or releasing decontrolled CUI, show that it is no longer controlled. Remove every CUI marking from a new document that reuses it (32 CFR 2002.18(f)). | The document management system | Updated document | MP-03 |
Decontrol does not authorize public release (32 CFR 2002.18(e)). Evidence: the requests, decisions, and updated documents.
5. Release Formerly Controlled Information #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Information Owner | 1. Before any public release, follow the Organization’s release review, including the OGC and public affairs where they apply (32 CFR 2002.18(g)). | The ticketing system | Release approval | AC-22 |
| Freedom of Information Act (FOIA) Officer | 2. Base each FOIA decision on the content and the FOIA exemptions, not on the CUI marking (32 CFR 2002.44(b); CUI Joint Memo 2018-11-19). | The ticketing system | FOIA case record | AC-22 |
| FOIA Officer | 3. As a general matter, treat information released under FOIA as decontrolled. Tell the CUI Program Manager what was released (CUI Joint Memo 2018-11-19). | The ticketing system | Case record | AC-22 |
| CUI Program Manager | 4. If the Organization needs to keep protecting released information, consult the OGC and, where needed, ISOO and the Department of Justice Office of Information Policy (CUI Joint Memo 2018-11-19). | The ticketing system | Consultation record | AC-22 |
Evidence: release approvals, FOIA case records, and consultation records.
6. Destroy CUI #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Information Owner | 1. Confirm with the Agency Records Officer that a NARA-approved records schedule allows destruction, and that no legal hold applies (32 CFR 2002.14(f)(1)). | The ticketing system | Records Officer approval | MP-06 |
| Authorized holder | 2. Shred paper CUI in a cross-cut shredder that makes particles of 1 mm by 5 mm or smaller, or use a disintegrator with a 3/32 inch screen (CUI Notice 2019-03). | The ticketing system | Shredder model record | MP-06 |
| Facility Manager | 3. Pick shredders from the National Security Agency (NSA) list of evaluated paper shredders, which meet the CUI standard (CUI Notice 2019-03). | The ticketing system | Equipment record | MP-06 |
| Facility Manager | 4. Keep shred bins locked in a controlled environment, and track each bin until its contents are destroyed (CUI Notice 2019-03). | The ticketing system | Bin service record | MP-06 |
| Facility Manager | 5. Use a multi-step process, such as shredding followed by pulping, only after the Organization verifies that it leaves CUI unreadable (CUI Notice 2019-03). | The ticketing system | Verification record | MP-06 |
| Media Custodian | 6. Sanitize or destroy electronic media under NIST SP 800-88, or use a method the CUI’s own authority requires (32 CFR 2002.14(f)(2)). Apply Rev. 2. | The ticketing system | Sanitization record | MP-06 |
| Media Custodian | 7. Record the media, the method, the date, and the person who did it. | The ticketing system | Sanitization record | MP-06 |
| System Owner | 8. Sanitize printers, copiers, and scanners that hold CUI before they are repaired, returned, or disposed of (32 CFR 2002.14(e)(2)). | The ticketing system | Sanitization record | MP-06 |
Evidence: the Records Officer approvals, equipment and verification records, bin service records, and sanitization records.
7. Transfer CUI Records to NARA #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Agency Records Officer | 1. Decontrol records before transfer when feasible (32 CFR 2002.34(a)). | The ticketing system | Decontrol decision | MP-03 |
| Agency Records Officer | 2. When records stay CUI, say so on the transfer request in NARA’s Electronic Records Archives, or on the paper transfer form, Standard Form (SF) 258 (32 CFR 2002.34(b)(1)). | The document management system | Transfer request | MP-05 |
| Agency Records Officer | 3. For paper records, put no CUI marking on the outside of the box (32 CFR 2002.34(b)(2)). | The ticketing system | Shipping record | MP-05 |
Evidence: the transfer requests and shipping records.
8. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Review CUI that no longer needs protection | Every year | Information Owners |
| Check sanitization and shred records | Every year, in the self-inspection | CUI Program Manager |
| Service locked shred bins | On the vendor’s schedule | Facility Manager |
9. Records #
The CUI Program Manager keeps decontrol requests and decisions in the ticketing system. Media Custodians keep sanitization records in the ticketing system. The Agency Records Officer keeps transfer records. Each record is kept under the records schedule that applies to it.
10. Related Documents #
11. References #
These are the sources this document cites, with a link to each official text.
- 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
- CUI Joint Memo 2018-11-19: Decontrolling CUI in response to a FOIA request: Decontrolling CUI in response to a FOIA request, November 19, 2018.
- CUI Notice 2019-03: Destroying CUI in Paper Form, July 15, 2019.
- ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
- NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization, September 2025.