Understand how to identify and send Controlled Unclassified Information
If you hold a personnel clearance (PCL), it’s likely you will at some point work with Controlled Unclassified Information (CUI). CUI is sensitive information that isn’t classified but still needs some level of protection and safeguarding. If CUI is obtained by adversaries, it can put you and your company at risk, and aggregated CUI is one of the most significant risks to national security since it doesn’t have the same controls as classified information.
CUI became the official federal government designation for this type of information in July 2020. This replaced agency-specific markings such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU) and Law Enforcement Sensitive (LES). You may still see FOUO on some documents, as it’s still used on legacy information, but it’s no longer added to new information. If you come across FOUO documents, do not change the designation to CUI.
Related: FAQs About the New NISPOM Rule
You’ll recognize CUI based on the markings. On physical documents, it will be marked with the acronym at the top and bottom of every page. If you receive CUI in an email, the subject line will indicate the email contains CUI, and the body of the email will indicate where the CUI begins and ends.
If you mishandle CUI, you’ll likely face consequences from your company based on their graduated scale of disciplinary action. Your company is the most likely to face consequences from CUI ending up in the wrong hands, which could look like a loss of profit if you lose a contract due to breached trust. Typically, this won’t put your company’s FCL at risk.
In your time as a cleared employee, there will likely be a point where you’ll have to send CUI, and there are specific rules for how this must be done.
Sending CUI
When sending CUI, send it out in the same way you received it. For example, if you received it originally in an email format, you’ll send it out in an email, making sure to add the designations to your subject line and email body. If you need to send out FOUO information over email, use the FOUO designation in the subject line rather than CUI.
When sending out CUI for the first time, how you send it will depend on the type of document you’re sending out. If it’s a document you can scan, email will be best, but if it requires wet signatures, use mail. This can be interagency mail systems, the USPS or commercial delivery services, and using automated tracking is the best practice. However, make sure you do not place markings on the package or envelope.
CUI can be more easily shared with others than classified information. However, you don’t want to send it to just anyone. Make sure to keep the information spread limited to only people working on the contract the CUI is pertinent to.
While CUI may not carry the weight of classified, secret or top secret information, its protection is still key to your company’s security, and ultimately national security. For more information, the Center for Development of Security Excellence (CDSE) offers a course that covers CUI and unauthorized disclosure. You can also download Adamo’s printable CUI brochure, which gives an overview of CUI and can be used as a training resource.
Learning the ins and outs of maintaining a facility clearance (FCL) or managing PCLs can be a time-consuming process, especially if you’re adding the FSO role on top of other responsibilities for your job. Our FSO support services can help take some of the work off your plate, opening you up to tackle what really matters. Contact us today to learn more about how our team can help you.
