Transitioning to CUI: When Organizations are Moving at Different Paces

Moving the entire Executive branch to change course is similar to getting an aircraft carrier battle group to turn. Each component element has unique specs and circumstances, but they must function as a unified whole.

Not surprisingly as agencies move forward with their implementation, we are getting questions about the interaction between organizations that are at different stages of implementation.

The simple answer is:

• Follow any specific requirements as needed and apply your agency’s existing policies and practices that are in effect at the time you are taking your action.

The more complex answer is:

• If you and the organization you receive the information from have an information sharing agreement in place, then follow the information sharing agreement.
• If no information sharing agreement governs the situation, then follow the best practices below.
  • If your agency has not yet implemented, but you receive CUI from an organization that has, then use your existing pre-CUI policies to safeguard according to the law, regulation, or government-wide policy that authorizes that CUI category.
  • If your agency has implemented, but receive CUI marked with Legacy Markings from an organization that has not yet implemented, then use your existing CUI policies to safeguard according to the law, regulation, or government-wide policy that authorizes that CUI category.

Please note that since all CUI categories are based on requirements in law, regulation, or government-wide policy, those authorities and their requirements existed prior to CUI implementation and must be followed regardless of CUI implementation status.