CUI Destruction
Also known as: Destroying CUI
CUI destruction is the disposal of Controlled Unclassified Information in a way that makes it unreadable, indecipherable, and irrecoverable. That phrase is the standard: the goal of destroying CUI is that the information cannot be recognized or reconstructed afterward.
In more detail
For paper, that means cross-cut shredding, pulping, or burning rather than a wastebasket. For electronic media, agencies and contractors follow NIST SP 800-88 media sanitization guidance: cryptographic erase, overwrite, degauss, or physically destroy, depending on the media and its reuse.
Simple deletion does not qualify. Files in a recycle bin, unwiped drives in surplus laptops, and decommissioned copiers with intact storage are the classic failure modes.
CMMC Level 1 contractors have a parallel obligation for their own scope: one of the 15 FAR 52.204-21 safeguarding requirements is sanitizing or destroying media containing Federal Contract Information before disposal or reuse, so the same shredder and wipe habits apply even when no CUI is involved.
Related terms
- Controlled Unclassified Information
Controlled Unclassified Information (CUI) is unclassified information that requires safeguarding or dissemination controls under law, regulation, or government-wide policy. It is explicitly marked CUI by the originating agency and triggers NIST SP 800-171 protections, and at the contractual level, CMMC Level 2.
- Federal Contract Information
Federal Contract Information (FCI) is non-public information provided by or generated for the federal government under a contract to develop or deliver a product or service. It is the information type protected under FAR 52.204-21 and is the trigger for CMMC Level 1.
- Safeguarding Requirement
A safeguarding requirement is one of the 15 specific security practices enumerated in FAR 52.204-21(b)(1) that contractors must apply to Covered Contractor Information Systems. The 15 safeguarding requirements are the entire substantive content of CMMC Level 1.
- 32 CFR Part 2002
32 CFR Part 2002 is the National Archives final rule that implemented Executive Order 13556 across the federal government, defining how agencies designate, mark, safeguard, and disseminate CUI. It is the source of the marking requirements that distinguish CUI from FCI.