Controlled Unclassified Information (CUI)

CUI Overview

The Controlled Unclassified Information (CUI) program at Department of Commerce (DOC) focuses on managing, sharing, and safeguarding CUI, which is crucial for keeping sensitive data safe and protecting our nation's security. This involves following strict government rules and standards set by E.O 13556 and 32 CFR Part 2002. The program is the result of a unified effort between Executive Branch agencies to standardize the protections and practices of sensitive information.

CUI History

The CUI program originated from recommendations from the National Commission on Terrorist Attacks Upon the United States following the 9/11 attacks, which emphasized the need for the horizontal sharing of intelligence information, transcending individual agencies.

E.O 13556 established the CUI program in 2010, designating the National Archives and Records Administration (NARA) as the Executive Agent (EA). Collaborative efforts between the EA and executive branch agencies led to the development and implementation of regulations, with ongoing refinement through iterative processes. After rounds of interagency and public comments, the final rule (32 CFR Part 2002) was published in 2016. The CUI Program undergoes annual review and adapts as needed during phased implementation, transitioning from development to maintenance and oversight.

CUI Marking

The CUI Program requires information designated as CUI to carry the appropriate markings, which convey sensitivity, handling, and safeguarding requirements. The standard CUI marking is the acronym CUI. Information systems processing, storing, or transmitting CUI must meet the security and privacy protections at the moderate confidentiality baseline as defined in NIST Special Publication 800-53. Marking requirements apply to all sensitive information, including newly created information determined to be CUI. This marking replaces legacy markings such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU), and Law Enforcement Sensitive (LES). For more details on the CUI marking requirements, please refer to the Department of Commerce's CUI policy.

CUI Controls

CUI continues to encourage information sharing through executive branch agencies; however, there are controls in place to ensure that this information is shared with the appropriate audience, as outlined in the Department of Commerce's guidelines on document controls. CUI requires a lawful government purpose, not just a need to know. Any dissemination of CUI should be associated with an activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes as within the scope of its legal authorities or the legal authorities of non-executive branch entities (such as state and local law enforcement). Once CUI has served its purpose, it is encouraged to decontrol CUI that no longer requires safeguarding or dissemination controls, unless doing so conflicts with the governing law, regulation, or Government-wide policy.

More Information

For further exploration and in-depth learning about CUI, we recommend visiting the NARA website. NARA serves as the central hub for information regarding CUI policies, guidelines, and regulations. Their website offers valuable resources, including official documents, training materials, and frequently asked questions, providing a comprehensive understanding of CUI and its implications. By leveraging the wealth of information available on NARA's website, users can delve deeper into specific aspects of CUI, stay updated on the latest developments, and access additional educational materials. The following resources are provided by NARA:

Breadcrumb

Was this page helpful?