{{Short description|US government information category}} [[File:Controlled Unclassified Information Office logo.svg|thumb|250px|The Controlled Unclassified Information (CUI) Office logo.<ref>Use of the CUI logo is controlled by the National Archives's regulations at [http://www.gpo.gov/fdsys/granule/CFR-2012-title36-vol3/CFR-2012-title36-vol3-sec1200-7/content-detail.html 36 C.F.R. 1200.7]</ref>]] '''Controlled Unclassified Information''' ('''CUI''') is a category of [[classified_information_in_the_United_States#Unclassified|unclassified information]] within the U.S. Federal government. The CUI program was created by President Obama’s Executive Order 13556 to create a streamlined method for information sharing and safeguarding. The [[Information Security Oversight Office]] (ISOO) acts as the Executive Agent (EA) of the National Archives and Records Administration (NARA), and is responsible for oversight of the CUI program. The ISOO monitors the implementation of the CUI program by executive branch agencies. CUI will replace agency specific labels such as [[For Official Use Only]] (FOUO), [[Sensitive But Unclassified]] (SBU), and [[Law Enforcement Sensitive]] (LES) on new data and some data with legacy labels will also qualify as Controlled Unclassified Information.<ref>{{Cite news | last = Casteli | first = Elise | title = New policy expected soon for sensitive information | newspaper = Federal Times | date = January 22, 2008 | url = http://www.federaltimes.com/index.php?S=3323622 | archive-url = https://archive.today/20130102142248/http://www.federaltimes.com/index.php?S=3323622 | url-status = dead | archive-date = January 2, 2013 }} </ref><ref>{{cite press release | title = Memorandum For The Heads Of Executive Departments And Agencies - Designation and Sharing of Controlled Unclassified Information (CUI) | publisher = The Office of the White House | date = May 7, 2008 | url = http://www.gpo.gov/fdsys/granule/WCPD-2008-05-12/WCPD-2008-05-12-Pg673/content-detail.html | archiveurl = https://web.archive.org/web/20090601220426/http://www.gpo.gov/fdsys/granule/WCPD-2008-05-12/WCPD-2008-05-12-Pg673/content-detail.html | archivedate = June 1, 2009 | accessdate = October 21, 2008}} [https://georgewbush-whitehouse.archives.gov/news/releases/2008/05/20080509-6.html Alt URL] </ref> Federal contractors who handle CUI will be required to self-assess (or, in some cases, require a government official to review) with the [[Cybersecurity Maturity Model Certification|Cybersecurity Maturity Model Certification (CMMC)]] under the Cyber AB (Accreditation Board).
__TOC__
== History == A [[Presidential memorandum]] of May 9, 2008, signed by President [[George W. Bush]], assigned responsibility to the [[National Archives and Records Administration|National Archives]] (NARA) for overseeing and managing the implementation of the CUI framework.<ref>{{cite press release | title = Archivist of the United States Establishes 'Controlled Unclassified Information Office' | publisher = National Archives and Records Administration | date = May 22, 2008 | url = https://www.archives.gov/press/press-releases/2008/nr08-107.html | accessdate = October 21, 2008}} </ref> This memorandum was rescinded by [[s:Executive Order 13556|Executive Order 13556]] of November 4, 2010, and the guidelines previously outlined within it were expanded upon to improve uniformity across all Federal agencies and to develop a standard policy regarding the controlled unclassification process itself.<ref name="eo13556">{{cite web |url = http://www.gpo.gov/fdsys/granule/FR-2010-11-09/2010-28360/content-detail.html |title = Executive Order 13556 of November 4, 2010; Controlled Unclassified Information |work = Federal Register |series = Volume 75, Issue 216 (November 09, 2010) |pages =68675–68677 |id = FR Doc. No. 2010–28360 }} </ref>
In a similar previous effort, the [[U.S. House of Representatives]] passed the Reducing Information Control Designations Act, {{USBill|111|HR|1323}}, on March 17, 2009. The bill was referred to the [[United States House Committee on Homeland Security|Committee on Homeland Security]] and Governmental Affairs of the 111th Congress in the [[US Senate]], but it was never passed by the Senate.
The doctrine, policy, and processes for Controlled Unclassified Information came out of a study and policy change proposal which originated within the Information Sharing and Collaboration Office of the Information Analysis and Infrastructure Protection Under Secretariat of the [[Department of Homeland Security]] in 2004. The term Controlled Unclassified Information (CUI) was coined by the authors of the study which reviewed over 140 various forms of unclassified information in use throughout the federal government at the time. Authors of the study recommended a new doctrine and policy framework and recommended that ISOO, within the NARA, be charged with implementing and overseeing the new doctrine and policy. At the time of delivery of the policy framework, NARA voiced objections to undertaking the effort due to a lack of resources. The policy recommendation continued to be worked within DHS and the rest of government as part of the Program Manager for the [[Information Sharing Environment]], which moved from DHS to the ODNI. While the executive order, rescission of the order, and subsequent policy structure worked their way through the government, the timeline for the study/ analysis, creation of a draft policy and framework, the political processes, and the resulting policy implementation lasted from 2005 through 2017. The study was led by Grace Mastalli and Richard Russell.
The US Department of Defense has been handling "Controlled Unclassified Information" before the Presidential 2008 memorandum was published and NARA became the Executive Agent in 2010. The DoD term embraced a similar type of data category. However, the DoD and NARA differed then and now (2019) on specific categories of data defined as "CUI". DoDM 5200.01 Vol 4 defines DoD CUI policy until it is revised to align with NARA's definition. The Secretary of the Navy published SECNAV 5510.34 in November 1993 entitled Disclosure of Classified Military Information and Controlled Unclassified Information.
As of December, 2020, the [[Director of National Intelligence]] at the time, [[John Ratcliffe (American politician)|John Ratcliffe]], issued a memorandum to the [[Assistant to the President for National Security Affairs]] asking the [[President of the United States]] ([[Donald Trump|President Trump]]) to rescind EO 13556. In the memo, Director Ratcliffe referred to the policies as "exponentially more complex", and "vastly overcomplicated". According to the memo "As currently conceived, instead of simplifying and replacing a handful document markings with one new CUI marking, the CUI Program has expanded to over 124 categories in 20 groupings, with 60 Specified and 60+ Basic categories." He continued to express concerns from the [[United States Intelligence Community|Intelligence Community]] about significant cost, unclear guidance, and requested recision and a process for presidential action.
DNI Ratcliffe stated that the following rescission, support would be given to an Executive-branch review and replacement of the current [[FOUO]] and related markings to protect unclassified information. No extension of the previous December 31, 2020 timeline has been proposed, which has now passed, and it is currently unclear what action, if any, will be taken on this request.<ref>{{Cite web|last=|first=|access-date=2021-01-06|title=Rescission of Executive Order 13556|url=https://fas.org/sgp/othergov/intel/ratcliffe-cui.pdf|url-status=live|archive-url=https://web.archive.org/web/20201214184030/https://fas.org/sgp/othergov/intel/ratcliffe-cui.pdf |archive-date=2020-12-14 |website=}}</ref><ref>{{Cite web|title=DNI Tries to Abort Controlled Unclassified Info Policy|url=https://fas.org/blogs/secrecy/2020/12/dni-cui/|access-date=2021-01-06|website=Federation Of American Scientists|language=en-US}}</ref> The [[United States Department of Defense|Department of Defense]] has clarified the policy on legacy markings such as FOUO.<ref>{{cite web | title = CUI Awareness and Marking' | publisher = Department of Defense | date = April 1, 2021 | url = https://www.dodcui.mil/Portals/109/Documents/Training%20Docs/21-S-0588%20cleared%20CUI%20Awareness%20Training%20Nov%202020.pdf?ver=eOMZuMPrdLXcnhS6egUe2w%3d%3d | accessdate = September 10, 2021}}</ref> "Information previously marked as FOUO does not need to be re-marked as long it remains under DoD control or is accessed online and downloaded for use within the DoD." Based on CFR 32 Part 2002 each agency will develop the steps to handle legacy markings in their CUI programs.
==Department of Defense Distribution Statements==
The Department of Defense (DoD) has defined 6 distributions, A-F. Technically, Distribution A is not CUI, but Distributions B-F are. The distributions are defined as: {| class="wikitable" |+ DoD CUI Distribution Statements |- ! Distribution !! Description |- | DISTRIBUTION STATEMENT A || Approved for public release: distribution unlimited |- | DISTRIBUTION STATEMENT B || Distribution authorized to U.S. Government agencies |- | DISTRIBUTION STATEMENT C || Distribution authorized to U.S. Government agencies and their contractors |- | DISTRIBUTION STATEMENT D|| Distribution authorized to Department of Defense and U.S. DoD contractors only |- | DISTRIBUTION STATEMENT E || Distribution authorized to DoD Components only |- | DISTRIBUTION STATEMENT F || Further dissemination only as directed by (controlling office) or higher DoD authority |}<ref>{{Cite web|last=|first=|access-date=2023-02-17|title=Rescission of Executive Order 13556|url=https://discover.dtic.mil/wp-content/uploads/2018/09/distribution_statements_and_reasonsSept2018.pdf|url-status=live|archive-url=https://web.archive.org/web/20220712210337/https://discover.dtic.mil/wp-content/uploads/2018/09/distribution_statements_and_reasonsSept2018.pdf |archive-date=2022-07-12 |website=}}</ref>
==References== {{Reflist|2}} [[Category:United States government secrecy]]