Transferring Records Containing Controlled Unclassified Information

April 10, 2023

When federal agencies prepare permanent records for transfer into NARA’s archival holdings they must evaluate the presence of Controlled Unclassified Information (CUI). Per 32 C.F.R. § 2002.34, when feasible, agencies must decontrol records containing CUI prior to transferring them to NARA. 

On the Transfer Request (TR) in NARA’s Electronic Records Archives (ERA) 2.0, agencies must identify whether or not permanent records are subject to CUI controls.

• If CUI has been decontrolled in preparation for transfer, select No to the question "Are records subject to Controlled Unclassified Information (CUI) controls?" on the Transfer Request. 
• If an agency cannot decontrol records before transferring them to NARA the agency will select Yes to the question "Are records subject to Controlled Unclassified Information (CUI) controls?" on the Transfer Request (TR). The agency will also enter the Safeguarding and/or Dissemination Authority on the TR. The agency must also cite the applicable FOIA exemption as an Access Restriction on transfer documentation indicating that the records require continued protection.  

Must be decontrolled at transfer examples:

Here are some examples of records that would be subject to CUI in agency custody but would not be subject to CUI controls and must be decontrolled upon transfer into NARA’s archival holdings.

• Privacy information present but persons are deceased.
• Critical Infrastructure information in cartographic records but the infrastructure is no longer in use or existence.
• General Counsel records containing attorney-client privileged or attorney work product information. 

CUI applicable at transfer examples:

Here are some examples of records that would not be decontrolled at transfer.

• Records containing locations of archaeological sites. These records need protection to prevent looting and would be subject to the FOIA (b)(3) Access Restriction and applicable statute(s).
• Records containing trade secrets or other General Proprietary Business Information.  These records need protection to protect confidential business information and would be subject to the FOIA (b)(4) Access Restriction.
• Records containing bank examination reports or other Financial Supervision Information.  These records need protection to protect trust in financial institutions and would be subject to the FOIA (b)(8) Access Restriction.

If Records Management staff have questions pertaining to CUI in their records they should consult their CUI Program Manager or their Office of General Counsel, or review these contacts.