The text of the CUI Waivers and Self-Inspection Procedure
Approval #
The Controlled Unclassified Information (CUI) Program Manager approves this document for the CUI Senior Agency Official. The Chief Information Security Officer (CISO) concurs on its security content.
| Role | Name | Signature |
|---|---|---|
| CUI Program Manager | ||
| Chief Information Security Officer (CISO), concurring |
Revision History #
| Date | Version | Description | Reviewer |
|---|---|---|---|
| 2026-10-31 | 1.0 | Initial issuance | [Reviewer name] |
Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.
Mandate. The CUI Program Manager issues this procedure for the CUI Senior Agency Official (CUI SAO), to carry out the Controlled Unclassified Information (CUI) Policy (POL-CUI-001). It follows 32 CFR 2002.24 and 2002.38, Information Security Oversight Office (ISOO) Notices 2026-07 and 2026-08, and CUI Memo 2018-10-16. The CUI Program Manager runs this procedure, and the Chief Information Security Officer (CISO) concurs on its security steps.
1. Purpose and Scope #
Use this procedure to ask for, decide, record, and end waivers of CUI requirements, and to run the yearly self-inspection and report to ISOO. It covers every part of the CUI program.
2. Roles #
The roles are defined in the CUI Policy. In the step tables below, each step names the person who acts. The CUI Program Manager coordinates the steps and keeps their records. A step with no citation is the Organization’s own practice.
3. Tools and Systems of Record #
| Tool or system | Use in this procedure | Records it holds |
|---|---|---|
| The document management system | Storing CUI documents in folders limited to authorized holders, and publishing CUI guidance | Documents, access lists, guidance |
| The ticketing system | Questions, requests, challenges, and reports sent to the CUI Program Manager | Request and case records |
| The governance, risk, and compliance (GRC) system | System categorization, System Security and Privacy Plans (SSPPs), and plans of action and milestones (POA&M) | Authorization records |
| The learning management system (LMS) | CUI training and its completion records | Training records |
4. Ask for and Decide a Waiver #
ISOO Notice 2026-08 allows three types of waiver: a limited marking waiver, a legacy material marking waiver, and an exigent circumstances waiver. Marking waivers apply only while the CUI stays within the Organization.
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| Information Owner | 1. Ask for a waiver on the CUI Waiver Memorandum Template (TMPL-CUI-002). Give the type, the CUI it covers, the reason, the alternate protections, and the planned end date. | The ticketing system | Waiver request | PM-09 |
| CUI Program Manager | 2. Check the request against 32 CFR 2002.38 and ISOO Notice 2026-08. Ask the CISO about any effect on system safeguards. | The ticketing system | Review record | PM-09 |
| CUI SAO | 3. Approve or deny a marking waiver (32 CFR 2002.38(a)–(b)). | The ticketing system | Signed decision | PM-09 |
| Agency Head or CUI SAO | 4. Approve an exigent circumstances waiver only in extremely rare cases, when it is necessary to prevent harm or to keep information flowing in an emergency (32 CFR 2002.38(c); ISOO Notice 2026-08). | The ticketing system | Signed decision | PM-09 |
| CUI SAO | 5. Record the waiver, and send it to ISOO within 30 days after the circumstances arise (ISOO Notice 2026-08). | The document management system | Waiver register and transmittal | PM-09 |
| CUI SAO | 6. Tell authorized recipients and the public about the waiver (32 CFR 2002.38(e)(3)). | The document management system | Notice | PM-09 |
| Authorized holder | 7. Mark CUI under a marking waiver before it leaves the Organization. Under an exigent waiver, tell outside recipients the CUI status (32 CFR 2002.38(c)(2), (d)(4)). | The document management system | Marked document or notice | MP-03 |
| CUI SAO | 8. If ISOO finds a waiver out of compliance, amend, revise, or rescind it within 60 days (ISOO Notice 2026-08). | The ticketing system | Revised waiver | PM-09 |
| CUI SAO | 9. End the waiver without delay when its reason ends, or when a review finds it inconsistent with 32 CFR 2002.38. Put the requirements back in force (32 CFR 2002.38(d)(5); ISOO Notice 2026-08). | The ticketing system | End record | PM-09 |
Evidence: each waiver with its request, decision, transmittal to ISOO, notices, and end record.
5. Run the Yearly Self-Inspection #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| CUI Program Manager | 1. Plan the self-inspection: the offices, systems, and agreements to sample, and the methods to use (32 CFR 2002.24(b)(2)). | The document management system | Inspection plan | CA-02 |
| CUI Program Manager | 2. Check a sample of marked documents, folder access, sanitization records, agreements, contract guidance, training records, and open cases. | The document management system | Worksheets | CA-02 |
| Information System Security Officers (ISSOs) | 3. Check that each system holding CUI is categorized at moderate or higher and that its SSPP lists the CUI. | The GRC system | System results | CA-02 |
| CUI Program Manager | 4. Record each finding in the format ISOO prescribes, or in the Organization’s format when ISOO sets none (32 CFR 2002.24(b)(3)). | The document management system | Findings | CA-02 |
| Finding owner | 5. Fix each finding by its due date. Track system findings as POA&M items (32 CFR 2002.24(b)(5)). | The GRC system | POA&M items | CA-05 |
| CUI Program Manager | 6. Update the policy, procedures, and training with lessons learned (32 CFR 2002.24(b)(4)). | The document management system | Change record | PM-14 |
| CUI SAO | 7. Approve the self-inspection report with its analysis and conclusions (32 CFR 2002.24(b)(6)). | The document management system | Signed report | CA-02 |
Evidence: the inspection plan, worksheets, findings, POA&M items, and the signed report.
6. Report to ISOO #
| Actor | Action | Tool | Evidence | Controls |
|---|---|---|---|---|
| CUI Program Manager | 1. Prepare the annual CUI report on program status, challenges, misuse, and metrics, in the form ISOO asks for (ISOO Notice 2026-07). | The document management system | Draft report | PM-09 |
| CUI Program Manager | 2. Describe each current waiver and each waiver issued in the past year, with its reason and its alternate protections (32 CFR 2002.38(e)(2); ISOO Notice 2026-08). | The document management system | Waiver section | PM-09 |
| CUI SAO | 3. Approve and send the report to ISOO by its due date (32 CFR 2002.8(c)(10)). | The document management system | Sent report | PM-09 |
| CUI SAO | 4. Send ISOO the change form whenever the CUI SAO or the CUI Program Manager changes (CUI Memo 2018-10-16). | The document management system | Change form | PM-02 |
Evidence: the sent reports and change forms.
7. Recurring Schedule #
| Activity | When | Owner |
|---|---|---|
| Run the self-inspection | Every year | CUI Program Manager |
| Send the annual CUI report | Every year, by ISOO’s due date | CUI SAO |
| Send each new waiver to ISOO | Within 30 days after the circumstances arise | CUI SAO |
| Review open waivers | Every quarter | CUI Program Manager |
| Report program measures | Every quarter | CUI Program Manager |
| Send the change form | Whenever the CUI SAO or CUI Program Manager changes | CUI SAO |
8. Records #
The CUI Program Manager keeps the waiver register, the self-inspection reports, and the reports to ISOO in the document management system. Each record is kept under the records schedule that applies to it.
9. Related Documents #
10. References #
These are the sources this document cites, with a link to each official text.
- 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
- CUI Memo 2018-10-16: CUI Senior Agency Official/Program Manager Change Form: CUI Senior Agency Official/Program Manager Change Form, October 16, 2018.
- ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
- ISOO Notice 2026-08: Controlled Unclassified Information (CUI) Program Revised Requirements for Waivers, September 2, 2026.