On January 24, 2018, ISOO issued two CUI Notices, one with recommendations for CUI Basic Training, and another regarding the agreements required for sharing CUI between Executive Branch entities and their non-Executive Branch partners.
The Notice on CUI Basic Training (CUI Notice 2018-02) recommends common learning objectives and curriculum design content, training delivery methods, and testing objectives, for Executive Branch entities to incorporate in their required basic-training courses on CUI. The Notice presents these recommendations in the form of a table based on the first three levels of Bloom’s Taxonomy, a classification benchmark for learning objectives that is widely accepted by training professionals.
The Notice on Agreements (CUI Notice 2018-01) provides guidance and recommendations on how information-sharing agreements between Executive Branch entities and their non-Executive Branch partners must convey CUI Program requirements. The Notice excludes reference to guidance for information-sharing with foreign entities.
The Notice explains that as Executive Branch entities implement their own CUI policies, they must negotiate modifications to existing agreements in compliance with the CUI Program. When feasible, Executive Branch entities should enter into written agreements that include explicit CUI requirements.
Such agreements must require non-Executive Branch partners to handle CUI in accord with the CUI Program, subject to applicable penalties, while also stipulating that non-Executive Branch partners must follow methods approved by the Executive Branch entity in reporting any non-compliance with CUI requirements.
As a best practice, the Notice recommends that agreements between Executive Branch entities and their non-Executive Branch partners: 1) identify categories of CUI and specific handling, safeguarding, or dissemination requirements for CUI shared under the agreement; 2) state where the terms of the agreement will be performed; and, 3) indicate specific technical requirements for protecting the CUI, as well as whether a federal or non-federal information system will be used to process, store or transmit it.