Who Has the Authority to Decontrol CUI?

Only the executive branch agency that originally designated the information holds the authority to decontrol Controlled Unclassified Information (CUI). Under 32 CFR Part 2002, that designating agency is the sole entity that can formally remove CUI safeguarding and dissemination controls. Contractors, grantees, and other non-federal recipients cannot decontrol CUI on their own, though they can ask the designating agency to do so.1eCFR. 32 CFR 2002.18 – Decontrolling

Why the Designating Agency

The regulation defines the designating agency as the executive branch agency that originally designated, or approved the designation of, a specific item of information as CUI.2eCFR. 32 CFR 2002.4 – Definitions That agency applied the controls in the first place based on a law, regulation, or government-wide policy, so it is the entity in a position to judge when the controls are no longer warranted.

The National Archives and Records Administration (NARA) runs the CUI program overall as the executive agent, with day-to-day management by the Information Security Oversight Office.3eCFR. 32 CFR 2002.6 – CUI Executive Agent (EA) NARA sets and oversees program-wide rules, but it does not reach into individual documents and lift another agency’s CUI markings.

Who Inside the Agency Signs Off

An agency may designate in its CUI policies which personnel are authorized to decontrol, provided those designations are consistent with the governing law, regulation, and government-wide policy.1eCFR. 32 CFR 2002.18 – Decontrolling

In practice the authority sits with the agency’s CUI Senior Agency Official (SAO), who oversees the CUI program and establishes the processes for handling decontrol, or with a CUI Program Manager the SAO designates.4eCFR. 32 CFR 2002.8 – Roles and Responsibilities The SAO is also the office responsible for building the processes that receive decontrol requests from authorized holders.

Contractors and Other Non-Federal Holders

Contractors, grantees, state and local partners, and other non-executive branch entities that hold CUI cannot decontrol it. They must handle the information according to the CUI program rules, and their agreements with the government must include provisions requiring that compliance.5eCFR. 32 CFR 2002.16 – Accessing and Disseminating Even adding extra dissemination controls is reserved to the designating agency; other holders who want to add controls have to request permission.

How an Authorized Holder Can Request Decontrol

Authorized holders may request that the designating agency decontrol certain CUI when they believe the information no longer needs protection.1eCFR. 32 CFR 2002.18 – Decontrolling The request goes to the designating agency, whose SAO is responsible for the intake process.4eCFR. 32 CFR 2002.8 – Roles and Responsibilities

The regulation does not set a government-wide timeline for a response. Each agency writes its own procedures, so turnaround varies. Until the designating agency acts, the information stays under its existing CUI controls, and the holder must continue safeguarding it accordingly.

Challenging a designation is a separate matter from requesting decontrol. If you believe information was improperly marked CUI in the first place, or that it should have been marked and wasn’t, 32 CFR 2002.50 gives you the right to challenge the designation through the designating agency’s process, with escalation under 32 CFR 2002.52.6eCFR. 32 CFR 2002.50 – Challenges to Designation of Information as CUI

When the Authority Is Exercised

Agencies should decontrol CUI as soon as practicable once it no longer requires safeguarding, unless doing so would conflict with the governing law or policy. Decontrol can occur automatically when a specified condition is met, or through a deliberate agency decision.1eCFR. 32 CFR 2002.18 – Decontrolling

The regulation identifies four automatic triggers:

  • The law, regulation, or government-wide policy requiring the controls no longer applies, and the authorized holder has appropriate authority under that original legal basis.
  • The designating agency makes an affirmative decision to release the information publicly.
  • The agency discloses the information under an information access statute such as FOIA or the Privacy Act, and the agency has incorporated that disclosure into its official public release processes.
  • A date or event specified at the time of designation occurs, unless the governing law requires coordination first.

Beyond those triggers, the designating agency can decontrol CUI in response to an authorized holder’s request, or concurrently with a declassification action when the CUI portions independently qualify.1eCFR. 32 CFR 2002.18 – Decontrolling

Decontrol Is Not Public Release

Removing CUI controls does not mean the information is cleared for the public. Any public release of formerly controlled information must still comply with applicable laws and agency release policies.1eCFR. 32 CFR 2002.18 – Decontrolling Decontrol only means the CUI program’s handling rules no longer govern that specific information.

FOIA sits in a similar spot. A CUI marking has no bearing on a FOIA decision; agencies evaluate FOIA requests on the content and applicable exemptions, regardless of any CUI label.7eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) And releasing information under FOIA does not automatically decontrol it. That release counts as decontrol only if the agency has tied its FOIA disclosures to its official public release processes.

What Doesn’t Count, and What Happens if Someone Tries

Two things the regulation expressly rules out: an unauthorized disclosure of CUI is not decontrol, and neither is any attempt to decontrol information in order to conceal or avoid accountability for such a disclosure.1eCFR. 32 CFR 2002.18 – Decontrolling Only the designating agency, acting through its authorized personnel, can lift the controls.

Removing CUI controls without authority is treated as misuse of CUI, which covers intentional violations and unintentional errors alike. Agencies have authority to take administrative action against personnel who misuse CUI, and where the underlying law or policy for a specific CUI category sets its own sanctions, the agency must apply those.7eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) For non-federal entities, consequences flow through the government agreement, which must state that misuse is subject to penalties established in applicable laws and policies and must require the entity to report any non-compliance to the disseminating agency.5eCFR. 32 CFR 2002.16 – Accessing and Disseminating

The short version stays the same throughout: the authority to decontrol CUI belongs to the designating agency. Everyone else’s role is to request, to comply, and to keep safeguarding the information until that agency acts.