The text of the CUI Challenges and Misuse Reporting Procedure
Approval #
The Controlled Unclassified Information (CUI) Program Manager approves this document for the CUI Senior Agency Official. The Chief Information Security Officer (CISO) concurs on its security content.
| Role | Name | Signature |
|---|---|---|
| CUI Program Manager | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.
Mandate. The CUI Program Manager issues this procedure for the CUI Senior Agency Official (CUI SAO), to carry out the Controlled Unclassified Information (CUI) Policy (POL-CUI-001). It follows 32 CFR 2002.8(c)(13) and (14), 2002.50, 2002.52, 2002.54, and 2002.56, and Information Security Oversight Office (ISOO) Notice 2026-07. The CUI Program Manager runs this procedure, and the Chief Information Security Officer (CISO) concurs on its security steps.
1. Purpose and Scope #
Use this procedure to bring and answer a challenge to a CUI designation, and to report and look into misuse of CUI. It covers challenges and reports from personnel and from authorized holders outside the Organization.
2. Roles #
The roles are defined in the CUI Policy. In the step tables below, each step names the person who acts. The CUI Program Manager coordinates the steps and keeps their records. A step with no citation is the Organization’s own practice.
3. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The document management system | Storing CUI documents in folders limited to authorized holders, and publishing CUI guidance | Documents, access lists, guidance |
| The ticketing system | Questions, requests, challenges, and reports sent to the CUI Program Manager | Request and case records |
| The governance, risk, and compliance (GRC) system | System categorization, System Security and Privacy Plans (SSPPs), and plans of action and milestones (POA&M) | Authorization records |
| The learning management system (LMS) | CUI training and its completion records | Training records |
| The security information and event management (SIEM) system | Logs that help show who accessed or sent CUI | Log records |
4. Challenge a CUI Designation #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Authorized holder | 1. Send the challenge to the CUI Program Manager, with the reason you believe the designation or marking is wrong. You may send it without your name (32 CFR 2002.50(a), (c)(5)). | The ticketing system | Challenge record | MP-03 |
| Authorized holder | 2. Keep protecting the information at its marked level until the challenge is decided (32 CFR 2002.50(d)). | The LMS | Training record | MP-03 |
| CUI Program Manager | 3. Acknowledge the challenge within 5 business days. Give the expected decision date, a chance to explain the reason, and the deciding official’s contact information (32 CFR 2002.50(c)(1)–(4)). | The ticketing system | Acknowledgment | MP-03 |
| CUI Program Manager | 4. If another agency designated the information, send the challenge to that agency and tell the challenger (32 CFR 2002.50(a)). | The ticketing system | Referral | MP-03 |
| CUI Program Manager | 5. If the information is part of litigation, send the challenge to the Office of the General Counsel (OGC) (32 CFR 2002.50(b)). | The ticketing system | Referral | MP-03 |
| CUI SAO | 6. Decide the challenge within 30 days, record the reason, and tell the challenger. Make sure no one faces retribution (32 CFR 2002.50(c)(5)). | The ticketing system | Decision | MP-03 |
| CUI Program Manager | 7. Tell all authorized holders of the decision, inside and outside the Organization, so they update markings and handling (ISOO Notice 2026-07). | The document management system | Notice to holders | MP-03 |
Evidence: each challenge with its acknowledgment, decision, referral, and notice to holders.
5. Resolve a Dispute #
A challenger who disagrees with the decision may use the dispute steps below (32 CFR 2002.50(e)).
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| CUI Program Manager | 1. Where the CUI’s own law or regulation sets a dispute process, follow that process (32 CFR 2002.52(a)). | The ticketing system | Case record | MP-03 |
| CUI Program Manager | 2. Send a dispute that involves litigation to the OGC (32 CFR 2002.52(a)). | The ticketing system | Referral | MP-03 |
| CUI SAO | 3. Otherwise, try to resolve the dispute with the other party within a reasonable time (32 CFR 2002.52(c)). | The ticketing system | Case record | MP-03 |
| CUI SAO | 4. If the parties cannot agree, either party may refer the dispute to ISOO (32 CFR 2002.52(d)). | The document management system | Referral to ISOO | MP-03 |
Until the dispute is resolved, authorized holders keep protecting the CUI at its marked level (32 CFR 2002.52(f)). Evidence: the case records and any referral.
6. Report Misuse of CUI #
Misuse includes marking information that does not qualify as CUI, failing to protect CUI, and sharing it with people who should not have it. A suspected unauthorized disclosure is also an incident.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Authorized holder | 1. Report suspected misuse to the CUI Program Manager, under the process the CUI SAO set (32 CFR 2002.54(a)). | The ticketing system | Misuse report | IR-06 |
| Authorized holder | 2. If CUI may have reached someone without authorization, report an incident at once, under the Incident Response Policy. | The ticketing system | Incident record | IR-06 |
| Incident Response Team | 3. Handle the incident, and tell the CUI Program Manager. Tell the Senior Agency Official for Privacy (SAOP) when personally identifiable information is involved. | The SIEM system | Incident record | IR-04 |
| CUI Program Manager | 4. Open a misuse case, and tell the designating agency when the CUI came from another agency. | The ticketing system | Case record | IR-06 |
| CUI Program Manager | 5. Find the facts with the supervisor, the Information System Security Officer (ISSO), and the OGC as needed. Recommend corrective action to the CUI SAO. | The ticketing system | Findings | IR-04 |
| CUI SAO | 6. Decide corrective action, such as retraining or re-marking. Refer misconduct for administrative action as the Agency Head’s authority allows (32 CFR 2002.56(a)). | The ticketing system | Decision | PS-08 |
| CUI Program Manager | 7. Act on misuse findings ISOO sends to the Organization, and report the result to the CUI SAO (32 CFR 2002.54(b)). | The ticketing system | Case record | IR-06 |
| CUI Program Manager | 8. Count misuse cases for the annual report to ISOO (ISOO Notice 2026-07). | The document management system | Report figures | IR-06 |
Evidence: the misuse reports, incident records, findings, decisions, and report figures.
7. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Report open challenges and misuse cases | Every quarter | CUI Program Manager |
| Review trends to update training | Every year | CUI Program Manager |
8. Records #
The CUI Program Manager keeps challenges, disputes, and misuse cases in the ticketing system. The Incident Response Team keeps incident records. Each record is kept under the records schedule that applies to it.
9. Related Documents #
10. References #
These are the sources this document cites, with a link to each official text.
- 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
- ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.