CUI SAO and Program Manager Designation Templates

Approval #

Revision History #

Review cycle: Every year, and whenever a designation changes.

Mandate. Under 32 CFR § 2002.8(b) and (c), the agency head must designate a Senior Agency Official (SAO) for Controlled Unclassified Information (CUI), called the CUI SAO. The CUI SAO must have the authority and resources to oversee and implement the agency’s CUI program, and must designate a CUI Program Manager.

The Information Security Oversight Office (ISOO) issued Notice 2026-07, Executive Agent Guidance for Implementation of the CUI Program, on September 2, 2026. Under it, the agency must make both designations in writing, and the CUI Program Manager must have direct access to the CUI SAO. CUI Memo 2018-10-16 gives the form the agency sends to ISOO at cui@nara.gov whenever either official changes.

ISOO Notice 2026-08, issued the same day, sets the waiver rules under 32 CFR § 2002.38. They include sending each waiver to ISOO within 30 days.

The offices named in each template complete it. The CUI SAO often sits outside the Chief Information Officer (CIO)’s organization, so the templates name roles only. The CISO’s part is coordinating the safeguarding of CUI in information systems, as the CUI SAO’s responsibilities in Template 1 describe.

---

Template 1 — Designation of the CUI Senior Agency Official #

From: Agency Head To: [Title of the official designated] Subject: Designation as Senior Agency Official for Controlled Unclassified Information

1. Purpose #

This memorandum designates the Senior Agency Official for Controlled Unclassified Information (CUI SAO) for the Organization. The Agency Head makes this designation under Executive Order 13556, 32 CFR Part 2002, and ISOO Notice 2026-07.

2. Designation #

Effective [date], the Agency Head designates the [title] as the CUI SAO. This designation replaces any earlier one.

3. Authority and Responsibilities #

Under 32 CFR § 2002.8(b) and (c), the CUI SAO has the authority and resources to oversee and implement the Organization’s CUI program. The CUI SAO must:

1. Establish, approve, and maintain the Organization’s CUI policy and procedures in line with the CUI Registry and the Executive Agent’s requirements. Approve any component CUI policy before anyone uses it.
2. Provide the personnel, training, technology, and budget the program needs. The program covers designation, marking, safeguarding, dissemination, decontrol, disposition, challenges (§ 2002.50), misuse reporting (§ 2002.54), and self-inspection (§ 2002.24).
3. Designate, in writing, a CUI Program Manager with direct access to the CUI SAO (Template 2).
4. Make sure each agreement that shares CUI with a contractor or other non-executive-branch entity meets 32 CFR § 2002.16. That includes the contract terms the Executive Agent requires for identifying, marking, safeguarding, training, access, decontrol, disposition, reporting, self-inspection, and misuse.
5. Use the waiver authorities in 32 CFR § 2002.38 as ISOO Notice 2026-08 directs. Document each waiver’s type, scope, alternate protections, and duration. Send it to ISOO within 30 days of the circumstances that require it, and include every waiver in the annual CUI report.
6. Conduct a CUI program self-inspection at least once a year. Send the annual report and the other required reports to ISOO by their due dates.
7. Coordinate with the CIO and the CISO on safeguarding CUI in information systems, under the Organization’s security program and the Risk Management Framework. Coordinate with the Office of the General Counsel on agreements and disclosure decisions, and with the records officer on disposition under approved schedules.

The CUI SAO may delegate operational tasks to the CUI Program Manager and stays accountable for the program.

4. Contact Information #

5. Transmittal #

The Agency Head’s office sends a copy of this memorandum and the contact information above to ISOO at cui@nara.gov. The office sends ISOO the change form whenever this designation changes (CUI Memo 2018-10-16).

---

Template 2 — Designation of the CUI Program Manager #

From: CUI Senior Agency Official To: [Title of the official designated] Subject: Designation as Controlled Unclassified Information Program Manager

1. Purpose #

This memorandum designates a CUI Program Manager under 32 CFR Part 2002 and ISOO Notice 2026-07. The CUI Program Manager has the authority and resources to manage and implement the Organization’s CUI program for the CUI SAO.

2. Designation #

Effective [date], the CUI SAO designates the [title] as the CUI Program Manager, with direct access to the CUI SAO.

3. Responsibilities #

The CUI Program Manager must:

1. Manage the CUI program day to day: policy upkeep, the designation process, marking guidance, and dissemination controls.
2. Deliver initial and refresher CUI training to everyone who handles CUI (32 CFR § 2002.30), and keep the training records.
3. Run the challenge, misuse, and self-inspection processes, and keep their records.
4. Prepare the annual CUI report to ISOO and the waiver submissions for the CUI SAO to sign.
5. Work with the CISO’s office so that each system holding CUI carries the safeguarding requirements in its System Security and Privacy Plan (SSPP) and contracts.
6. Work with Contracting Officers so that agreements carry the § 2002.16 terms.

4. Contact Information #

---

Template 3 — Transmittal to ISOO #

To: Information Security Oversight Office, cui@nara.gov Subject: [Organization] — CUI Senior Agency Official and Program Manager designations

Under ISOO Notice 2026-07, [organization] submits the designations of its CUI SAO and CUI Program Manager. The signed designation memoranda are attached, with the name, title, and contact information of each official. [Organization] will send ISOO the change form whenever either designation changes (CUI Memo 2018-10-16).

---

Program Elements Checklist (for the CUI SAO’s first review) #

References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• CUI Marking Handbook, May 24, 2019.
• CUI Memo 2018-10-16: CUI Senior Agency Official/Program Manager Change Form: CUI Senior Agency Official/Program Manager Change Form, October 16, 2018.
• CUI Registry.
• Executive Order 13556: Controlled Unclassified Information, November 4, 2010.
• ISOO Notice 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, September 2, 2026.
• ISOO Notice 2026-08: Controlled Unclassified Information (CUI) Program Revised Requirements for Waivers, September 2, 2026.