Understanding Who Can Decontrol CUI: A Comprehensive Guide
The term "Controlled Unclassified Information" (CUI) might sound technical, but it's a crucial concept for many individuals and organizations working with the U.S. government. Understanding who has the authority to "decontrol" this information – meaning to remove its CUI designation – is essential for compliance and proper information management. This article will break down the intricacies of CUI decontrol for the average American reader.
What Exactly is CUI?
Before we dive into decontrol, let's briefly define CUI. Controlled Unclassified Information is information that, although not classified, requires safeguarding or dissemination controls pursuant to and consistent with applicable laws, regulations, and government-wide policies. Think of it as sensitive information that isn't top secret but still needs to be protected from unauthorized disclosure. Examples might include certain types of business data submitted to the government, personally identifiable information (PII) of individuals, or proprietary research data.
The Authority to Control and Decontrol CUI
The power to designate information as CUI, and consequently to decontrol it, primarily rests with federal agencies. However, the process isn't arbitrary. It's governed by strict regulations and policies, primarily outlined in Executive Order 13556 and its implementing directive, 32 CFR Part 2002 (CUI Executive Agent Directive).
Who Holds the Original Control?
Generally, the federal agency that originates the information or receives it from a non-federal source and has a specific legal basis for controlling it is the "Original Control Authority" (OCA). The OCA is responsible for identifying the information as CUI, assigning the appropriate CUI markings, and establishing any necessary safeguarding or dissemination controls.
Therefore, the primary entities that can initiate the decontrol of CUI are:
- The Original Control Authority (OCA): This is the agency or component within an agency that initially designated the information as CUI. The OCA has the inherent authority to review its prior designations and determine if the information no longer meets the criteria for CUI.
- The CUI Executive Agent: The National Archives and Records Administration (NARA) serves as the CUI Executive Agent. NARA is responsible for overseeing the CUI program government-wide. While individual agencies decontrol their own CUI, NARA can provide guidance and, in certain circumstances, may influence or direct decontrol decisions to ensure consistency and compliance with the overarching CUI framework.
How Does Decontrol Happen?
Decontrol is not simply a matter of deciding to no longer protect information. It involves a formal process and specific criteria:
- Review of Safeguarding Requirements: The OCA must determine if the legal, regulatory, or policy basis for controlling the information has changed or no longer applies. For instance, if a law that mandated the control of certain data is repealed, the information might be eligible for decontrol.
- NARA Approval (in some cases): While agencies have a degree of autonomy in decontrolling their CUI, significant decisions or policy changes related to decontrol may require consultation with or approval from NARA to ensure alignment with government-wide CUI policy.
- Formal Notification and Documentation: Once a decision to decontrol is made, it must be properly documented. This includes notifying any parties who were previously subject to the CUI controls and updating any internal agency policies or systems that reflect the CUI designation.
- Removal of Markings: The CUI markings must be officially removed from the information once it is decontrolled.
Can Non-Federal Entities Decontrol CUI?
Generally, non-federal entities (like contractors, grantees, or researchers) who receive CUI from the government cannot unilaterally decontrol it. They are bound by the terms of their agreements with the government and must adhere to the CUI controls imposed by the originating agency. If a non-federal entity believes CUI in its possession should be decontrolled, it must typically request the originating federal agency (the OCA) to review and make that determination.
Key Takeaway: The authority to decontrol CUI ultimately resides with the federal agency that initially designated it as CUI, with oversight and guidance from the CUI Executive Agent (NARA). Non-federal entities must work through the federal agency.
Why is Decontrol Important?
Decontrolling information that no longer requires safeguarding is crucial for several reasons:
- Efficiency: It reduces the burden of managing and protecting information that doesn't pose a significant risk if disclosed.
- Accessibility: It can make information more accessible for authorized users and the public when appropriate, fostering transparency and innovation.
- Compliance: It ensures that agencies are only applying CUI controls where they are legally and contractually required, avoiding overreach and unnecessary restrictions.
Frequently Asked Questions (FAQ)
How does an agency decide to decontrol CUI?
An agency decides to decontrol CUI when the original basis for its control no longer exists. This could be due to changes in laws, regulations, or policies, or if the information is no longer deemed to require safeguarding or dissemination controls. The agency must follow established procedures and may need to consult with NARA.
Why can't a contractor just decide to decontrol CUI they possess?
Contractors and other non-federal entities are custodians of CUI based on their agreements with the government. They do not hold the inherent authority to designate or decontrol CUI. They must rely on the originating federal agency to make such determinations.
What happens if CUI is decontrolled?
When CUI is decontrolled, it means the specific safeguarding and dissemination controls associated with that designation are lifted. The information is no longer subject to CUI requirements, though other applicable laws or policies might still apply. The CUI markings must be removed.
Can NARA force an agency to decontrol CUI?
While NARA, as the CUI Executive Agent, provides oversight and guidance, the primary responsibility for designating and decontrolling CUI lies with individual federal agencies. NARA can offer recommendations and interpretations to ensure consistency, and in some situations, may have a role in approving significant decontrol decisions to maintain program integrity.
