CUI Coversheet and Labels

sf combimed

There’s a completely new look on the horizon for the identification of CUI products.  One part involves the individual document(s); the other involves all the other media forms.  Also, the color for the new forms is purple, and thus it will be instantly distinguishable from all other forms!

The CUI coversheets themselves  have been reduced to one, and while that one is reminiscent of the Optional Forms (OF) 901, OF 902 and OF 903, and OF 903, it has evolved into the Standard Form (SF) 901.  It can be downloaded from either the ISOO or General Services Administration (GSA) website.  It is still a fillable form and is provided at no cost (see ISOO Notice 2019-01).  You may continue to use the old forms until existing supplies have been depleted, however they can no longer be downloaded.  The SF 901 is available for download immediately, and as before, once it is affixed to the top of the document(s), it remains attached until the document(s) no longer requires protection, is properly secured, and/or is decontrolled or destroyed.

coversheet image

The new SF 902 is is a standard size label, much like the ones authorized for classified media, and is used to identify and protect electronic media and other media that contain CUI.  It is used instead of the SF 901 for media other than documents.  If your agency determines, as part of its risk management strategy, that a standard size label is required, the SF 902 will be used.  It must be affixed to the medium containing CUI in a manner that would not adversely affect operation of the equipment in which the medium is used, and once it has been applied, it cannot be removed.  This form is not yet available, but soon will be.  It is expected to be available for purchase through GSA, but the exact date is yet to be determined.  Also it will be not be downloadable, as it comes in a pad of about 50 sheets (5-1/4 X 4-1/4″ sheet of six 2-1/8 X 1-1/4″ labels), and its cost is to be approximately $25.00 per pad.

sf902big

The new SF 903 is a thumb drive size label  The SF 903 is used to identify and protect electronic media that contains CUI.  If your agency determines, as part of its risk management strategy, that a thumb drive size label is required, the SF 903 will be used.  The SF 903 is affixed to a thumb drive containing CUI in a manner that would not adversely affect either operation of the drive or operation of the medium in which it is inserted, and as with the SF 902, once it has been applied, it cannot be removed.  This form also is not yet available, but soon will be.  It is expected to be available for purchase through GSA, but the exact date is yet to be determined.  Similar to the SF 902,  this form will not be downloadable, as it comes in a pad of about 50 sheets (5-1/4 X 4-1/4″ sheet of twelve 2-1/8 X 5/8″ labels), and its cost is to be approximately $25.00 per pad.

sf903big

Please direct any questions regarding this post to: CUI@nara.gov

Slides from CUI Briefing to Stakeholders on 11/14/2018

Please see the attached slides: Nov, 14 Briefing to Stakeholders

We had great attendance in our webinar yesterday with some great participation in the Q&A period. Thank you to all those who attended. The following topics were covered during the webinar:

  • A brief overview of the CUI program;
  • An update on agency implementation efforts;
  • The status and plans for a CUI Federal Acquisition Regulation Rule;
  • CUI Industry Day Agenda; and,
  • Time for Questions and Answers.

 

CUI Updated Training Videos

ISOO has developed seven new training modules. These videos offer the most up-to-date information about the CUI Program.

Agencies (and stakeholders) may wish to use these videos to supplement their CUI Program training. However, it is important to note that ISOO does not track completion of these modules, so if your organization wishes to require viewing of these videos as part of your CUI training program, you must download and run them from organization’s training platform.  MP4 versions will be made available for download from the CUI Registry in the coming weeks.

Slides from CUI Briefing to Stakeholders on 2/15/2018

We had great attendance in our webinar yesterday with some great participation in the Q&A period. Thank you to all those who attended. The following topics were covered during the webinar:

A brief overview of the CUI program;
A summary of the upcoming changes to the CUI Registry;
An update on agency implementation efforts;
A review of all existing notices, policies, training and resources currently available from the CUI Registry;
The status and plans for a CUI Federal Acquisition Regulation Rule; and
Time for Questions and Answers.
Please see the slides attached: Feb 15, 2018 Webex

Q&As from the webinar will be posted soon.

CUI Program update to stakeholders

​The next scheduled webinar will be February 15, 2018 (1-3 EDT). All subscribers to the CUI Blog will receive links and call-in information to access the webinar prior to the event. The webinar will include:

  • A brief overview of the CUI program;
  • A summary of the upcoming changes to the CUI Registry;
  • An update on agency implementation efforts;
  • A review of all existing notices, policies, training and resources currently available;
  • from the CUI Registry;
  • The status and plans for a CUI Federal Acquisition Regulation Rule; and
  • Time for Questions and Answers.

CUI and re-marking legacy Information

Agencies can waive the requirement to re-mark legacy information with the new CUI markings while the CUI is in their control.  The CUI Program does not require the agencies to re-mark unless reusing and sharing the information with others outside of their agency.  In addition, because the CUI regulation also contains flexibility in handling such things as existing on-line databases with numerous PDF documents, a flash screen may suffice to alert users that a law, Federal regulation, or Government-wide policy requires safeguarding and dissemination controls.

The CUI Program and budget considerations

Under the FOUO (For Official Use Only) system (and multiple other protection schemes), agencies are already spending money on protecting the same (or even a greater) range of unclassified information as identified in the CUI Registry.  This includes marking, safeguarding measures, and training.  The CUI Program’s requirements were based on the baseline for current protection measures purposely.  In fact, Executive Order Continue reading “The CUI Program and budget considerations”

The CUI Registry and agency employees

Employees that handle CUI in the course of doing agency business are not expected to go directly to and interpret the laws, Federal regulations, and Government-wide policies to determine what unclassified information is controlled, nor will they be responsible for interpreting those authorities and assessing what requirements apply to a given document in their hands or on their systems.  They will be going to their agency information management policies, on which they are trained.  This is what takes place now and will continue in the future.  However, with the advent of the CUI Program and oversight functions, agency policies will be reviewed periodically to ensure they are in line with CUI Program requirements and underlying authorities, and to ensure they are providing sufficient information for employees to carry out both the required protections and permissible sharing.

Will the CUI Program cause an expansion of the use of Exemption 3 of the Freedom of Information Act (FOIA)?

The full implementation of CUI is unlikely to cause an expansion of the use of Exemption 3 statutes by agencies, and in fact is more likely to produce the opposite effect by prohibiting agencies from marking and controlling information unless a valid law, Federal regulation, or Government-wide policy authorizes it. The CUI Program, for the first time, establishes a clear distinction between a marking purporting to control Continue reading “Will the CUI Program cause an expansion of the use of Exemption 3 of the Freedom of Information Act (FOIA)?”

Questions and answers: CUI Program

1. What is the Controlled Unclassified Information (CUI) Program?

The CUI Program is a Government-wide program that standardizes the way the executive branch manages unclassified information that requires safeguarding or dissemination controls required by law, Federal regulation, and Government-wide policy. This Program replaces existing agency programs like For Official Use Only (FOUO), Sensitive But Continue reading “Questions and answers: CUI Program”