Author: ecoren

Agency Considerations when allowing employees to telework with Controlled Unclassified Information (CUI) during the COVID-19 pandemic

by ecoren, posted in General updates, Uncategorized

The CUI program has a lot of flexibility built in to allow agencies to accomplish their mission, including while employees are teleworking.

Agencies must ensure CUI is safeguarded in accordance with 32 CFR 2002 (the CUI Program’s implementing directive) and the applicable laws, regulations, and government-wide policies. In doing so agencies must establish controlled environments where CUI can be effectively safeguarded. 

Telework agreements can be used to spell out whether or not CUI is permitted, as well as, which categories of CUI employees can use while teleworking. The agreement should also outline what controls (physical or electronic) need to be in place to ensure adequate protection.

Here are some common issues agencies may encounter as they allow employees to telework with CUI:

1. Increased potential for CUI to be overheard or observed with more people likely to be in the home

2. Difficulty securing devices used for telework (computers, cell phones, tablets, routers, modems)

3. Ensuring compliance with current policies and limiting use of unauthorized equipment and media

4. Enabling employees to accomplish their tasks and adjusting expectations limit use of unauthorized workarounds

Agencies, in consultation with CUI Program Officials, should develop additional guidance that addresses each of the issues described above.  Front-line supervisors should initiate discussions with their employees to assist and determine the best ways to ensure the protection of CUI while teleworking.

General guidelines for Handling Controlled Unclassified Information (CUI) as you Telework

by ecoren, posted in Uncategorized

As we all work to do our jobs in the changing work environment during the COVID-19 crisis, those who work with CUI should continue to make sure they safeguard CUI.

In many cases, CUI can be worked on, in a telework environment, as long as the proper controls are in place to achieve a controlled environment (physical and electronic) and agency policies allow it.

Make sure to follow any agency policy or guidance, especially interim guidance issued in response to COVID-19 as standard practices may have been changed to allow for greater telework participation. If needed, employees should consult their supervisor if they have any questions regarding the proper handling of sensitive information.

Here are some general guidelines to consider as you telework with CUI: 

  1. CUI should not be stored on personal systems. 
  2. Printing and hard copy storage should be kept to a minimum.  
  3. Agency sponsored/approved virtual desktops (or similar) should be used. 
  4. Personal email accounts should not be used to store or transmit CUI.