CUI Policy and Guidance
Policy and Guidance
The Controlled Unclassified Information Executive Agent (CUI EA) issues guidance to Executive branch departments and agencies that handle unclassified information that requires safeguarding or dissemination controls, pursuant to and consistent with applicable law, regulations, and government-wide policies.
CUI Executive Order
| Date | Title |
| 11/04/2010 | Executive Order 13556 "Controlled Unclassified Information" |
CUI Implementing Regulation
| Date | Title |
| 09/14/2016 | 32 CFR Part 2002 "Controlled Unclassified Information" |
Agency Reporting
| Date | Number | Title |
| 10/03/2023 |
FY 2023 CUI Data Collection Tasker
|
CUI Notices and Executive Agent Guidance
As of 2026, to support a modernized government information management landscape that must consider both classified information and controlled unclassified information as having national security implications, guidance that in the past may have been issued as an ISOO Notice or CUI Notice will be issued in a single series of ISOO Notices. CUI Notices and Executive Agent Guidance issued prior to 2026 continue to remain in effect in their current format and will not be renamed. However, future guidance that may have in the past been issued as a CUI Notice will now be issued as an ISOO Notice. A consolidated listing of ISOO Notices and past CUI Notices and Executive Agent guidance that remain in effect can be found here.
Office of Management and Budget (OMB) Circular No. A-11
OMB Circular No. A-11 provides guidance on preparing the Budget and instructions on budget execution. Section 31.14 requires that agency budget estimates should reflect consideration of Executive Order 13556, Controlled Unclassified Information (CUI), and the policies issued by the National Archives and Records Administration (NARA), 32 CFR part 2002, "Controlled Unclassified Information," with an effective date of November 14, 2016, and CUI Notice 2016-01, "Implementation Guidance for the Controlled Unclassified Information Program," September 14, 2016.
NIST Publications
The following National Institute of Standards and Technology (NIST) publications have been incorporated by reference into the CUI Implementing Directive, 32 CFR Part 2002, and should be consulted for guidance on implementing specific measures to safeguard CUI:
- Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems
- Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems
- NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Federal Information Systems and Organizations
- NIST Special Publication 800-88, Revision 2, Guidelines for Media Sanitization
- NIST Special Publication NIST SP 800-171r3, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
CUI Advisory Council
The CUI EA established the CUI Advisory Council to carry out consultative functions directed by Executive Order 13556.
CUI Registry Committee Charter
Additional Resources
The CUI EA has developed recommendations to assist departments and agencies in development of their CUI programs and submission of information to the EA.