Controlled Unclassified Information (CUI): An Overview

1. Controlled Unclassified Information (CUI): An Overview

2. May 9th Presidential Memorandum On May 9, 2008, the President released the Memorandum for the Heads of Executive Departments and Agencies on the Designation and Sharing of Controlled Unclassified Information. The purpose of the Framework is to standardize practices and thereby improve the sharing of information.

3. CUI Governance Structure CUI Executive Agent CUI Council Departments and Agencies

4. The CUI Council The CUI Council will carry out the following functions as directed by the President: • Serve as the primary advisor to the Executive Agent on issues pertaining to the CUI Framework • Advise the Executive Agent in developing procedures, guidelines, and standards necessary to establish, implement, and maintain the CUI Framework; • Ensure coordination among the depts. and agencies participating in the CUI Framework; and • Resolve complaints and disputes among departments and agencies about proper designation or marking of CUI.

5. Two Private Sector Representatives Frederick V. Riccardi • Senior Executive DirectorSecurity and Mission AssuranceManTech International Corporation • National Defense Industrial Association – Chairman Industrial Security Committee 2008-2009 • Nominated by the NISPPAC membership for representation on CUI Council Turner D. Madden, Esquire • Madden & Patton, LLC • Vice Chairman of the Partnership for Critical Infrastructure and the Co-Chairman of the Commercial Sector Coordinating Council for the U.S. Department of Homeland Security • Elected by the sub-sector chairs in the Commercial Sector • Nominated by the industry members of the Critical Infrastructure Partnership Advisory Council (CIPAC) for representation on CUI Council

6. CUI Framework Implementation Timeline Overview08/21/08 Guiding Documents CUI Council Meetings CUI Council Initial Meeting Aug 21 Every 3rd Thurs as needed Stand-up CUIC Sep 18 CUIC Nov 20 Full Implementation of CUI Framework May 2013 Departments & Agencies Identify reps Outreach Phase Department & Agencies submit Plans to CUIO Data call due Sep 4 CUIC Oct 16 CUIC Dec 18 Planning Phase Implementation Phase Date May 08 Jun Jul Aug Sep 08 Oct Nov Dec 08………Sep 09 Oct 09 Oct 10 Oct 11 Oct 12 FY 08FY09 FY10 FY 11 FY12 FY 13 Phase Stand-up Initial Outreach Planning Implementation – Phase I Implementation – Phase II Dept Agency Letter Jun 27 FY10 FY11 FY12 – FY 13 FY09 Monitor Department & Agency compliance with CUI policy, standards, and markings Evaluate effectiveness of CUI Implementation Policy and Guidance Update Policy and Guidance as necessary Annual Report Alignment of Policy Markings with Exceptions Alignment of Regulatory Markings Confirm necessary changes to regulation and statute Annual Report Presidential CUI Memo May 9 NARA CUI Memo May 21 CUIO at PM- ISE PR Aug 28 Finalize Department & Agency Plans Activate Registry Initiate CUI 201Training Identify and designate CUI Alignment of Policy-based Markings Begin federal rule-making process Annual Report Milestones for Implementation Draft Implementing Guidance Safeguarding Dissemination Designating Marking Initiate CUI 101Training Design Registry Review Department & Agency Plans Annual Report CUI Council Letter Jul 9 Background CUI Framework May 20 CUIO Review Data call Updates/ Outreach CUIO Brief to ISC Jul 16 Outreach to Departments & Agencies Jun-Aug Updated data call to Departments & Agencies Aug 8

7. FY09 Priorities • Development of Centralized Implementation Plan • Set priorities for implementation • Establish milestones for alignment to CUI Framework • Establish training schedule • Development of Implementation Policies • Define Safeguarding Standards • Define Department and Agency CUI Dissemination Policies • Develop detailed guidance on CUI life cycle, portion marking, and application of CUI Framework to archived information • Establish Centralized CUI Training (“CUI 101”) • Begin the development of Department- and Agency-specific Implementation Plans • Establish Department- and Agency-specific CUI Training (“CUI 201”) The intent is to provide departments and agencies the information that they need to plan for implementation and align this implementation with their normal budget cycles.

8. Guiding Principles

9. Safeguarding introduced to CUI Council 18 Sep 08 Discussed at five Council sessions Working Group formed 25 Sep 08 Strawman language discussed and vetted at three WG sessions Draft strawman guidance organized into six general sections: General Policy - Storage Waivers for Exigent Situations - Transmission Controls in Use - Destruction Draft Interim Guidance briefed at 19 Feb 09 CUI Council Retained in “draft” status until other focus areas drafted and vetted through same CUIO process Policy Development Process

10. CUI Policy is being organized under eight primary focus areas development development development development development Draft Draft Draft Draft Draft Policy Development – Stage in Process • Safeguarding • Dissemination • Dispute Resolution • Markings • Designation • Life Cycle • Exceptions • Penalties/Enforcement Intro Final Intro Final Intro Final Final Intro Final Intro

11. Designation Specified Dissemination Registry Training Outreach Other Implementation Preparation Activities

12. Contact Information Controlled Unclassified Information Office National Archives and Records Administration 700 Pennsylvania Avenue, N.W., Room 100 Washington, DC 20408-0001 (202) 357-6870 (voice) (202) 357-6871 (fax) cui@nara.gov (email) www.archives.gov/CUI (website)