CUI Decontrol
Also known as: Decontrolling CUI
CUI decontrol is the removal of safeguarding and dissemination controls from Controlled Unclassified Information when those controls are no longer required by the underlying law, regulation, or policy. Only the designating agency, or a holder acting under its written guidance, may decontrol CUI.
In more detail
Decontrol happens when the reason for control expires: the designating agency decides controls no longer apply, a set decontrol date or event in the markings is reached, or the information is approved for public release.
Recipients and contractors cannot decontrol on their own initiative. Holding information a long time, or believing it is harmless, does not end its CUI status; only the designating authority does.
Decontrolled information must have its markings addressed so it is not treated as CUI indefinitely, but decontrol is not automatic authorization for public release, which remains a separate agency decision.
Related terms
- Controlled Unclassified Information
Controlled Unclassified Information (CUI) is unclassified information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. It is explicitly marked CUI by the originating agency and triggers NIST SP 800-171 protections, and at the contractual level, CMMC Level 2.
- CUI Marking
A CUI marking is the standardized label, at minimum the banner CUI or CONTROLLED at the top of each page, that identifies a document as Controlled Unclassified Information. The authorized holder who creates the document is responsible for applying CUI markings and dissemination instructions at the time of creation.
- 32 CFR Part 2002
32 CFR Part 2002 is the National Archives final rule that implemented Executive Order 13556 across the federal government, defining how agencies designate, mark, safeguard, and disseminate CUI. It is the source of the marking requirements that distinguish CUI from FCI.
- NARA CUI Registry
The NARA CUI Registry is the official, public list of every category and subcategory of information that qualifies as Controlled Unclassified Information across the federal government. It is the authoritative source for determining whether a given type of information is CUI.