The CUI program (32 CFR 2002.4(s)) explicitly
defines decontrolling CUI as the removal of safeguarding or dissemination controls from
CUI that no longer requires controls.
The capability to decontrol CUI (both CUI Basic and CUI Specified), and to remove Limited
Dissemination Controls (applied to promote a Lawful Government Purpose in handling CUI),
belongs to all Authorized Holders, including the designating agencies that originally designate,
or control, information as CUI – but also, Executive branch agencies, and, where
provided in a contract or agreement, non-federal entities handling CUI.
The CUI program requires that agencies implement policies and procedures for decontrolling
CUI, and recommends as a best practice that CUI policy for all Executive branch agencies
(Authorized Holders and designating authorities) authorize and assign agency personnel,
by title and position, to implement agency CUI decontrol policy in accord with the laws,
regulations, and government-wide policies governing CUI.
Nevertheless, it is not a requirement to assign particular individuals with this responsibility
and agencies may use their own discretion in this regard.
The CUI Program authorizes two ways of decontrolling CUI:
CUI may be decontrolled automatically by the end of any requirement to control [such as
a pre-determined event] imposed by applicable laws, regulations, and government-wide policies.
Or, CUI may be decontrolled by a pro-active, positive action taken by the original designating
authority, to remove the applicable controls.
To properly exercise this capability of Decontrolling CUI, Authorized Holders must understand that:
1) unauthorized disclosure of CUI does not constitute decontrol of CUI; and 2) agencies
cannot decontrol CUI to conceal, or avoid accountability for any unauthorized disclosure.
Decontrolling CUI may occur automatically in four ways: 1) public release through an
affirmative decision of the designating agency; 2) statutory release, under the requirements
of FOIA – if no other law, regulation or government-wide policy still requires that
information to be protected; 3) when the CUI simply no longer requires control under the
applicable laws, regulations, or government-wide policies; or 4.) when the designating agency
includes a specific decontrolling indicator, either a date certain or event . In all four
of these ways, CUI may be automatically decontrolled, without any positive actions by the Authorized
Holder.
Note for a non-Federal stakeholder, such as a contractor, decontrol provisions would have
to be included in a contract or agreement.
In contrast to automatic decontrol, which occurs when CUI can no longer be controlled,
CUI may also be decontrolled proactively by designating agencies.
Under the CUI program, designating agencies should have policies and procedures in place
detailing how they may take positive, proactive actions to decontrol CUI that no longer requires
safeguarding or dissemination controls, in two ways -
1.)In response to requests by Authorized Holders of CUI inside or outside the designating
agency.
Any Authorized Holder of CUI may request the designating agency to decontrol that CUI.
And: 2.)
If CUI no longer requires safeguarding or dissemination controls.
Declassification of information under any Executive Order (most recently Executive Order
13526) may cause designating agencies to decontrol any associated or commingled CUI – but only
if that CUI no longer requires controls under laws, Federal regulations, or Government-wide
policies, where these stipulate a date certain or event.
Regarding both automatic and positive decontrol, it is critical to remember that decontrol
alone does not constitute public release.
In addition to spelling out policies and procedures consistent with decontrolling CUI under the
CUI program, policies for each agency should also determine the separate process for public
release.
However, once CUI is properly released according to established agency policy, then public
release automatically decontrols that CUI handled by any Authorized Holders outside
of the designating agency.
In implementing CUI program requirements for the proper decontrol and public release of
CUI, Authorized Holders should always be sure to follow agency policy and procedures.
Decontrolling in itself requires no further marking on CUI until the decontrolled CUI is: 1:
Reused in other forms – for example, through restating or paraphrasing the decontrolled
CUI is a new product; 2.)
Publically released, through official agency policies and procedures;
3.)
Donated to a private institution.
In each of these cases – through public release; when CUI is reused by paraphrase
or restatement; or when CUI is donated to private institutions – agency policies may
require handlers to strike through, or to remove old CUI markings either on the first
page, cover page, or the first page of any attachment.
The CUI program requires that, when transferring records to the National Archives and Records
Administration (NARA), Authorized Holders should always decontrol CUI when possible;
and, when the CUI requires ongoing control, be sure to indicate that on the appropriate
transfer forms [either Transfer Request (TR) in NARA’s Electronic Records Archives (ERA)
or on an SF 258 paper transfer form].
Unless indicated on the appropriate form, NARA may assume decontrol.
Furthermore, whether CUI status is indicated or not, the Archivist of the United States
[AOTUS] may decontrol CUI in records transferred to the National Archives, under his legal
mandate to facilitate public access.
To avoid unauthorized disclosure of CUI, always be careful to follow CUI program requirements
for decontrolling CUI, as implemented through agency policies and procedures.
Remember that under the CUI program: 1.)
Unauthorized disclosure of CUI does not constitute decontrol of CUI; and
2.)
In following agency policies and procedures for decontrolling CUI, agencies
cannot decontrol CUI to conceal, or avoid accountability for any unauthorized disclosure
that may have already occurred by other means.
In handling CUI, always be accountable, and do not decontrol CUI to conceal unauthorized
disclosures.