Responsibility for protecting Controlled Unclassified Information is shared across four layers: the National Archives and Records Administration sets government-wide policy, each executive branch agency implements that policy internally, contractors and other outside recipients protect CUI under the terms of their agreements, and every individual who handles CUI is personally accountable for following the rules. No single office owns CUI security. Anyone who creates, receives, or touches the information carries a piece of the duty.
The Layered Structure at a Glance
CUI is government information that isn’t classified but that a law, regulation, or government-wide policy requires be safeguarded or handled with limits on who can see it.1eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.4 Definitions Because the category spans everything from law enforcement records to export-controlled technical data to protected personal information, the protection scheme has to work across the whole federal government and the vast network of contractors, grantees, universities, and state and local partners who work with it.
The framework, established by Executive Order 13556 in 2010, replaced a patchwork of agency-specific markings with a single uniform program.2The White House. Executive Order 13556 – Controlled Unclassified Information The layers below all trace back to that order.
NARA and ISOO Set the Rules
Executive Order 13556 designated the National Archives and Records Administration as the CUI Executive Agent responsible for building and overseeing the program.2The White House. Executive Order 13556 – Controlled Unclassified Information NARA delegated the day-to-day work to the Director of the Information Security Oversight Office. ISOO staff develop policy and guidance, review how agencies implement the program, approve CUI categories, and maintain the CUI Registry, the public online repository listing every authorized CUI category, its markings, and the legal authority behind it.3eCFR. 32 CFR 2002.6 – CUI Executive Agent (EA)
ISOO also resolves disputes about the program and reports to the President on agency compliance at least every two years.4GovInfo. 32 CFR 2002.8 – Roles and Responsibilities Nothing an agency or contractor does can conflict with what ISOO publishes.
Agencies and the Senior Agency Official
Every executive branch agency must designate a CUI Senior Agency Official who oversees the agency’s entire CUI program. The SAO establishes internal policies, sets up processes for reporting and investigating CUI misuse, and keeps the agency’s approach aligned with ISOO’s government-wide directives.5eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.8 Roles and Responsibilities Agencies write their own CUI policies, but those policies cannot conflict with the CUI Registry or 32 CFR Part 2002.
On the technical side, federal agencies must protect CUI on their information systems in accordance with FIPS Publication 199, FIPS Publication 200, and NIST Special Publication 800-53, which together set the security categorization, minimum security requirements, and specific controls for federal systems.6eCFR. 32 CFR 2002.14 – Safeguarding Those documents are binding, not advisory.
Contractors, Grantees, and Other Outside Recipients
Responsibility follows CUI when it leaves federal walls. The regulation applies indirectly to every non-executive branch entity that receives CUI, including contractors, grantees, state and local agencies, tribal governments, and universities. The mechanism is contractual: agencies must enter into written agreements requiring these entities to handle CUI in accordance with Executive Order 13556, 32 CFR Part 2002, and the CUI Registry.7eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.16 Accessing and Disseminating
When a formal agreement isn’t possible but the mission requires sharing CUI, the agency must still communicate that the government strongly encourages the recipient to protect the information under the same standards, and that those protections should follow the CUI if it gets shared further.7eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.16 Accessing and Disseminating
Defense Contractors: DFARS and NIST SP 800-171
Defense contractors carry the heaviest, most prescriptive obligations. DFARS clause 252.204-7012 requires contractors handling covered defense information to implement the 110 security requirements in NIST SP 800-171 Revision 2.8Acquisition.GOV. 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting Those controls span access management, audit logging, incident response, encryption, and physical security. Contractors must flow down the clause to subcontractors whose performance involves CUI, without altering the substantive requirements. If a subcontractor won’t comply, it should not have CUI on its systems.9Department of Defense. Safeguarding Covered Defense Information – The Basics
Cyber incidents involving covered defense information must be reported within 72 hours of discovery.8Acquisition.GOV. 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting The clock starts when your organization identifies the incident, not when you finish investigating it.
CMMC Certification
The Cybersecurity Maturity Model Certification program adds a verification layer on top of NIST SP 800-171. Rather than only self-attesting, contractors must now undergo assessments. The program rolled out in phases starting November 10, 2025. During Phase 1, which runs through November 2026, solicitations include requirements for CMMC Level 1 or Level 2 self-assessments, and some procurements may require a full third-party assessment by an authorized C3PAO.10DoD CIO. About CMMC
CMMC Level 2 maps directly to the 110 NIST SP 800-171 Revision 2 requirements. When a third-party assessment is required, the C3PAO conducts it, enters results into the CMMC eMASS system, and the resulting certification is valid for three years, provided the contractor submits an annual affirmation of continued compliance.11eCFR. 32 CFR Part 170 – Cybersecurity Maturity Model Certification (CMMC) Program Contractors that can’t fully meet every requirement at assessment time may use a Plan of Action and Milestones only if their score meets at least 80 percent of the requirements and the gaps don’t involve certain critical controls. Open POA&M items must be closed within 180 days.10DoD CIO. About CMMC
Every Individual Handler
Organizational policies and technical controls only work if the people handling CUI follow them. Every individual who touches CUI, whether a federal employee, a contractor, or a state agency worker operating under a CUI agreement, bears direct responsibility.
Sharing Only With Those Who Need It
CUI should only be shared with someone who has a lawful government purpose to receive it. The regulation defines that term broadly, covering any activity, mission, function, or operation the U.S. government authorizes or recognizes as within its legal authorities, including those of non-executive branch entities like state and local law enforcement.1eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.4 Definitions Before sharing, the holder must reasonably expect that every intended recipient meets that standard and has a basic understanding of how to handle the information. At the same time, agencies are not supposed to restrict access beyond what’s genuinely necessary; if there’s significant doubt about whether a dissemination restriction is appropriate, the default should be not to apply it.12eCFR. 32 CFR 2002.16 – Accessing and Disseminating
Marking, Safeguarding, and Destroying
All CUI must carry a banner marking that includes the word “CONTROLLED” or the acronym “CUI,” plus the relevant category or subcategory marking for CUI Specified information. If an agency holds CUI that hasn’t been marked, it must mark it before sharing. Alternative methods like digital splash screens, user access agreements, or signs in storage areas are allowed when marking every document isn’t practical, provided the CUI status is readily apparent. CUI markings should never appear on the outside of an envelope or package.13eCFR. 32 CFR 2002.20 – Marking
Authorized holders must take reasonable precautions against unauthorized disclosure. That means establishing controlled environments where unauthorized individuals cannot access, observe, or overhear CUI. When CUI leaves that environment, it must remain under the holder’s direct control or behind at least one physical barrier.6eCFR. 32 CFR 2002.14 – Safeguarding Printers and copiers used for CUI must either not retain data or be sanitized afterward.
At end of life, CUI must be destroyed in a way that makes it unreadable, indecipherable, and irrecoverable.6eCFR. 32 CFR 2002.14 – Safeguarding Paper CUI requires methods like cross-cut shredding or pulverizing to particle sizes specified in NARA guidance; a standard strip-cut shredder does not meet the standard.14National Archives. Destroying Controlled Unclassified Information (CUI) in Paper Form Electronic CUI must be destroyed following NIST SP 800-88 or the applicable NIST SP 800-53 controls.
Training
Agencies must train all personnel with access to CUI on how to designate it, the relevant categories and subcategories, how to use the CUI Registry, proper markings, and applicable safeguarding and sharing procedures. Training must occur when an employee first begins working at the agency and at least once every two years after that.15eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.30 Education and Training Contractors whose agreements require CUI handling need equivalent training for their workforces.
Reporting Misuse
Non-executive branch entities that receive CUI must report any failure to comply with handling requirements to the agency that shared the information, using methods that agency’s SAO has approved. When the sharing agency isn’t the agency that originally designated the CUI, it must notify the designating agency too.7eCFR. 32 CFR Part 2002 – Controlled Unclassified Information (CUI) – Section 2002.16 Accessing and Disseminating
What Happens When Someone Fails to Protect CUI
Consequences scale with severity and role. Federal employees may face administrative or disciplinary action ranging from verbal counseling and written reprimands to suspension without pay, removal of CUI access, or termination. When a contractor employee is involved, the matter goes to the contracting officer, who decides what remedies to impose under the contract. In serious cases, criminal sanctions may apply.
For defense contractors, the practical fallout can reach beyond a single incident. A failed CMMC assessment means losing eligibility for contracts requiring that certification level, and repeated or egregious security failures can lead to suspension or debarment from government contracting entirely. That is why the responsibility sits at every layer: policy, agency, contractor, and individual. A break at any level puts the information, and the people relying on it, at risk.