CUI Waiver Memorandum Template

Approval #

The Controlled Unclassified Information (CUI) Senior Agency Official approves this template and signs each waiver made from it under 32 CFR 2002.38. The Chief Information Security Officer (CISO) concurs on its alternate protections.

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy, and after a change to 32 CFR Part 2002 or the CUI Registry.

Mandate. Under 32 CFR 2002.8(c)(15) and 2002.38, the CUI Senior Agency Official (CUI SAO) may waive CUI marking requirements, and the Agency Head or the CUI SAO may waive other requirements in exigent circumstances. Information Security Oversight Office (ISOO) Notice 2026-08 allows three types of waiver: a limited marking waiver, a legacy material marking waiver, and an exigent circumstances waiver. For every waiver, the CUI SAO must document the alternate protections, keep a record, and tell authorized recipients and the public. The CUI SAO must also send the waiver to ISOO within 30 days and end it when its reason ends. The CUI SAO issues this template, and the CUI Program Manager keeps it, for the Controlled Unclassified Information (CUI) Policy (POL-CUI-001) and the CUI Waivers and Self-Inspection Procedure (PROC-CUI-005). The Chief Information Security Officer (CISO) concurs on its security content.

1. How to Use This Template #

1. The Information Owner fills in one memorandum for each waiver. Each waiver meets the rules for one of the three types (ISOO Notice 2026-08). When the Organization grants related waivers at the same time, such as a limited marking waiver and a legacy material marking waiver, one memorandum may grant both. Give each waiver its own number, and repeat sections 2 to 8 of the memorandum (Waiver Type through Duration and End) for each one.
2. In Waiver Type, the Information Owner checks one type and keeps only that type’s sample language in Reason and Alternate Protections. The samples are starting points. Replace them with the facts of the case.
3. The Information Owner writes the memorandum so it holds no CUI. The Organization tells the public about each waiver and sends a copy to ISOO (32 CFR 2002.38(e)(3); ISOO Notice 2026-08). Describe the CUI by category, location, and amount, not by its contents. If the case needs CUI, such as details of a system weakness, put it in a separate attachment marked as CUI.
4. The CUI Program Manager checks the draft against 32 CFR 2002.38 and ISOO Notice 2026-08, and asks the CISO about any effect on system safeguards.
5. The CUI SAO signs a marking waiver. The Agency Head or the CUI SAO signs an exigent circumstances waiver (32 CFR 2002.38(c)).
6. The CUI SAO sends the signed memorandum to ISOO within 30 days after the circumstances arise, using the Transmittal to ISOO below (ISOO Notice 2026-08).
7. The CUI Program Manager records the waiver in the waiver register and adds it to the next annual CUI report (32 CFR 2002.38(e)).

Each signed memorandum is a dated record, so its file name names the waiver type and ends with the signing date. One example is “Agency_Org_CUI-SAO_Artifact_MP-03_CUI-Limited-Marking-Waiver-Memo_20261022.”

2. Choosing the Waiver Type #

A requirement that is merely burdensome does not justify an exigent circumstances waiver (ISOO Notice 2026-08). A marking waiver never travels with CUI that leaves the Organization (32 CFR 2002.38(d)(3)).

---

Memorandum #

From: [CUI Senior Agency Official, or Agency Head for an exigent circumstances waiver] To: [Information Owner and office that hold the CUI] Copy: CUI Program Manager; Chief Information Security Officer (CISO) Subject: Waiver of CUI requirements: [short name of the CUI or the situation] Waiver number: [number from the waiver register]

1. Purpose #

This memorandum grants a waiver of CUI requirements under 32 CFR 2002.38 and ISOO Notice 2026-08. It names the CUI the waiver covers, the reason for it, the protections that replace the waived requirements, and when it ends.

2. Waiver Type #

3. Requirements Waived #

[List each requirement waived, for example the banner marking under 32 CFR 2002.20(b), portion marking, or re-marking under 32 CFR 2002.36]. All other CUI requirements stay in force.

4. CUI Covered #

5. Reason #

[State why meeting the requirement is excessively burdensome, or what the emergency is. Keep the sample for the type checked and replace its bracketed parts.]

Sample: limited marking waiver. The [system name] holds about [number] records that contain [CUI category]. Users see the records in screens and reports that the system builds on demand. Marking each record or each screen would require changes to the system that cost [estimate] and would take [time]. Every user is an authorized holder with a lawful government purpose, and the records do not leave the system except through controlled exports.

Sample: legacy material marking waiver. The [office] holds about [number] documents created before November 14, 2016, many marked “For Official Use Only” or “Sensitive But Unclassified.” The documents are kept in [repository or storage] and are seldom used. Reviewing and re-marking each one would take about [staff hours]. The Organization will re-mark any document it reuses (32 CFR 2002.38(b)(2)).

Sample: exigent circumstances waiver. On [date], [the event, such as a natural disaster, a fire that destroyed a facility, a major system outage, or a national emergency] prevented the Organization from [the requirement that cannot be met]. The Organization must [keep operating or share information with named partners] to prevent harm to the Organization or its personnel, or to keep information flowing in the emergency (ISOO Notice 2026-08).

6. Alternate Protections #

The Organization protects the CUI covered by this waiver as follows (32 CFR 2002.38(d)(1)–(2)):

[List the protections. Keep the samples that apply to the type checked and add any others.]

Samples for a limited marking waiver:

• The system shows a banner at sign-in that tells users it holds CUI, and every user signs an access agreement that says so (32 CFR 2002.20(a)(8)).
• Access is limited to named roles, and the system logs access to the CUI.
• Every report or export the system produces carries the CUI banner marking before it leaves the system.
• The system holds an authorization to operate at no less than the moderate confidentiality impact level (32 CFR 2002.14(g)).

Samples for a legacy material marking waiver:

• A sign on the storage area or a notice on the repository tells users that it holds CUI (32 CFR 2002.20(a)(8)).
• Access to the repository is limited to the office that owns it.
• Anyone who reuses a document removes the legacy marking and marks the new document as CUI (32 CFR 2002.38(b)(2)).
• Documents leave the Organization only after they are re-marked (32 CFR 2002.38(d)(4)).

Samples for an exigent circumstances waiver:

• Authorized holders tell each outside recipient, in writing or aloud, that the information is CUI and what its category is (32 CFR 2002.38(c)(2)).
• Sharing is limited to the partners named in this memorandum, for the purpose stated.
• Authorized holders keep CUI under direct control or behind a physical barrier wherever they work (32 CFR 2002.14(c)(3)).
• The CUI Program Manager keeps a list of what was shared, with whom, and when, so the CUI can be marked once the emergency ends.

7. Limits #

1. A marking waiver applies only while the Organization holds the CUI. Authorized holders mark the CUI before it leaves the Organization (32 CFR 2002.38(d)(3)–(4)).
2. Under an exigent circumstances waiver, authorized holders tell outside recipients the CUI status of what they receive (32 CFR 2002.38(c)(2)).
3. The waiver does not change any requirement that a law, regulation, or government-wide policy sets for CUI Specified (32 CFR 2002.38(c)(1)).

8. Duration and End #

The CUI SAO ends the waiver without delay when its reason ends, or when a review finds it inconsistent with 32 CFR 2002.38, and puts the requirements back in force (32 CFR 2002.38(d)(5); ISOO Notice 2026-08). If ISOO finds the waiver out of compliance, the CUI SAO amends, revises, or rescinds it within 60 days (ISOO Notice 2026-08).

9. Notice and Reporting #

1. The CUI Program Manager tells authorized recipients and the public about this waiver, by [method, such as a notice on the Organization’s public CUI page] (32 CFR 2002.38(e)(3)).
2. The CUI SAO sends this memorandum to ISOO within 30 days after the circumstances arise (ISOO Notice 2026-08).
3. The CUI Program Manager records the waiver in the waiver register and describes it in the annual CUI report, with its reason and its alternate protections (32 CFR 2002.38(e)(1)–(2)).

10. Approval #

---

Transmittal to ISOO #

To: Information Security Oversight Office (ISOO), cui@nara.gov From: CUI Senior Agency Official Subject: [Organization]: CUI waiver [waiver number]

Under ISOO Notice 2026-08, [Organization] sends the attached waiver of CUI requirements for ISOO’s review. The waiver is a [type], effective [date], with a planned end date of [date]. The circumstances that called for it arose on [date]. The memorandum states the CUI covered, the reason, and the alternate protections. Please send questions to the CUI Program Manager at [contact].

Related Documents #

References #

These are the sources this document cites, with a link to each official text.

• 32 CFR Part 2002: Controlled Unclassified Information, September 14, 2016.
• CUI Registry.
• ISOO Notice 2026-08: Controlled Unclassified Information (CUI) Program Revised Requirements for Waivers, September 2, 2026.