CINXE.COM

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>Memorandum For The Heads Of Executive Departments And Agencies</title> <meta name="date" content="2008-05-09"/> <meta name="description" content="This memorandum (a) adopts, defines, and institutes "Controlled Unclassified Information" (CUI) as the single, categorical designation henceforth throughout the executive branch for all information within the scope of that definition, which includes most information heretofore referred to as "Sensitive But Unclassified" (SBU) in the Information Sharing Environment (ISE), and (b) establishes a corresponding new CUI Framework for designating, marking, safeguarding, and disseminating information designated as CUI. The memorandum's purpose is to standardize practices and thereby improve the sharing of information, not to classify or declassify new or additional information."/> <meta name="document.type" content="Executive Act, Memorandum"/> <meta name="WT.cg_n" content="News Policies"/> <meta name="WT.cg_s" content="May 2008"/> <link rel="home" title="Home" href="/index.html" /> <style type="text/css" media="screen"> @import "/css/infocus-main-nd.css"; </style> <link rel="stylesheet" type="text/css" media="print" href="/css/print.css" /> <link rel="stylesheet" type="text/css" title="main" href="/css/news-pages.css" /> <link rel="home" title="Home" href="/index.html" /> <script src="/js/general.js" type="text/javascript"></script>  <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-WLMC86');</script>  </head> <body onload="javascript: showCurYear();">  <noscript><iframe alt="Google Tag Manager" src="https://www.googletagmanager.com/ns.html?id=GTM-WLMC86" height="0" width="0" style="display:none;visibility:hidden" title="Google Tag Manager"></iframe></noscript>   <div id="whcontainer"> <div id="menufloat">This is historical material, "frozen in time." The web site is no longer updated and links to external web sites and some internal pages will not work.</div> <div id="hidden"><img src="/imgs/print_banner.png" alt="print-only banner" /></div> <div id="whheader" title="The White House"> <a href="/index.html"><img src="/imgs/wh_banner.jpg" alt="The White House" border="0" align="left" class="noprint" /></a>  <a href="#whitebox" id="main" style="position: absolute; top: 2.5em; left: -1000em; width: 20em;" class="noprint">Skip Main Navigation</a>  <div align="right" id="banner-nav"><a href="/president/" title="President">PRESIDENT</a> | <a href="/vicepresident/" title="Vice President">VICE PRESIDENT</a> | <a href="/firstlady/" title="First Lady">FIRST LADY</a> | <a href="/mrscheney/" title="Mrs. Cheney">MRS. CHENEY</a> | <a href="/news/" title="News">NEWS</a></div> <div align="right" id="banner-subnav"><a href="/government/" title="Your Government">Your Government</a> | <a href="/history/life/" title="History & Tours">History & Tours</a> | <a href="/kids/" title="Kids">Kids</a> | <a href="/email/" title="E-mail">E-mail</a> | <a href="/espanol/index.es.html" title="En Español">En Español</a></div> <div id="search_area"> <form accept-charset="UTF-8" action="https://search.archives.gov/search/docs" id="search_form" method="get" name="search"> <input id="affiliate" name="affiliate" type="hidden" value="national-archives" /> <input name="query" class="searchfield" maxlength="500" tabindex="1" title="Enter search terms here" />     <input type="hidden" name="dc" id="dc" value="3560" /> <input name="submit" type="image" src="/imgs/searchbutton.gif" alt="Search" tabindex="2" class="noprint" title="Submit" /> </form> </div> <div align="right" id="banner-subnav2"> <a href="/podcasts/" title="Podcasts">Podcasts</a> <a href="/podcasts/" title="Podcasts"><img src="/imgs/pod3.jpg" alt="Podcasts" width="27" height="22" border="0" /></a>   <a href="/rss/" title="RSS Feeds">RSS Feeds</a> <a href="/rss/" title="RSS Feeds"><img src="/imgs/rss3.jpg" alt="RSS Feeds" width="18" height="22" border="0" /></a></div> </div>  <div id="containerbg">  <div id="leftcol">  <img src="/imgs/infocus_top2.jpg" alt="In Focus" width="234" height="50" /><br clear="left" /> <div id="leftbox"> <ul> <li><a href="/infocus/afghanistan/">Afghanistan</a></li> <li><a href="/infocus/africa/">Africa</a></li> <li><a href="/infocus/budget/">Budget Management</a></li> <li><a href="/infocus/defense/">Defense</a></li> <li><a href="/infocus/economy/">Economy</a></li> <li><a href="/infocus/education/">Education</a></li> <li><a href="/infocus/energy/">Energy</a></li> <li><a href="/infocus/environment/">Environment</a></li> <li><a href="/infocus/globaldiplomacy/">Global Diplomacy</a></li> <li><a href="/infocus/healthcare/">Health Care</a></li> <li><a href="/infocus/homeland/">Homeland Security</a></li> <li><a href="/infocus/immigration/">Immigration</a></li> <li><a href="/infocus/internationaltrade/">International Trade</a></li> <li><a href="/infocus/iraq/">Iraq</a></li> <li><a href="/infocus/judicialnominees/">Judicial Nominations</a></li> <li><a href="/infocus/mideast/">Middle East</a></li> <li><a href="/infocus/nationalsecurity/">National Security</a></li> <li><a href="/infocus/veterans/">Veterans</a></li> </ul> <span style="display:block; position:relative; float:right; top:4px; right:4px; margin-top:8px;"> <a href="/infocus/"><img src="/imgs/arrow.gif" alt="More Issues" width="12" height="11" /></a> </span> <span style="display:block; position:relative; float:right; top:2px; right:10px; margin-top:8px;"> <a href="/infocus/">more issues</a> </span> <br clear="all" /><br clear="all" /></div>  <div class="divider-nd">News</div> <div class="leftboxb"> <ul> <li><a href="/news/">Current News</a></li> <li><a href="/news/briefings/">Press Briefings</a></li> <li><a href="/news/proclamations/">Proclamations</a></li> <li><a href="/news/orders/">Executive Orders</a></li> <li><a href="/radio/">Radio</a></li> <li><a href="/news/setting-record-straight/">Setting the Record Straight</a></li> </ul> <span style="display:block; position:relative; float:right; top:4px; right:4px; margin-top:8px;"> <a href="/news/"><img src="/imgs/arrow.gif" alt="More News" width="12" height="11" /></a> </span> <span style="display:block; position:relative; float:right; top:2px; right:10px; margin-top:8px;"> <a href="/news/">more news</a> </span> <br clear="all" /> <br clear="all" /> </div>  <div class="divider-nd">News by Date</div> <div class="leftboxb"> <script src="/js/news_menu.js" type="text/javascript"> </script> <noscript> <ul> <li><a href="/news/releases/2009/01/">January 2009</a></li> <li><a href="/news/releases/2008/12/">December 2008</a></li> <li><a href="/news/releases/2008/11/">November 2008</a></li> <li><a href="/news/releases/2008/10/">October 2008</a></li> <li><a href="/news/releases/2008/09/">September 2008</a></li> <li><a href="/news/releases/2008/08/">August 2008</a></li> <li><a href="/news/releases/2008/07/">July 2008</a></li> <li><a href="/news/releases/2008/06/">June 2008</a></li> <li><a href="/news/releases/2008/05/">May 2008</a></li> <li><a href="/news/releases/2008/04/">April 2008</a></li> <li><a href="/news/releases/2008/03/">March 2008</a></li> <li><a href="/news/releases/2008/02/">February 2008</a></li> <li><a href="/news/releases/2008/01/">January 2008</a></li> <li><a href="/news/releases/2007/12/">December 2007</a></li> <li><a href="/news/releases/2007/11/">November 2007</a></li> <li><a href="/news/releases/2007/10/">October 2007</a></li> <li><a href="/news/releases/2007/09/">September 2007</a></li> <li><a href="/news/releases/2007/08/">August 2007</a></li> <li><a href="/news/releases/2007/07/">July 2007</a></li> <li><a href="/news/releases/2007/06/">June 2007</a></li> <li><a href="/news/releases/2007/05/">May 2007</a></li> <li><a href="/news/releases/2007/04/">April 2007</a></li> <li><a href="/news/releases/2007/03/">March 2007</a></li> <li><a href="/news/releases/2007/02/">February 2007</a></li> <li><a href="/news/releases/2007/01/">January 2007</a></li> <li><a href="/news/releases/2006/12/">December 2006</a></li> <li><a href="/news/releases/2006/11/">November 2006</a></li> <li><a href="/news/releases/2006/10/">October 2006</a></li> <li><a href="/news/releases/2006/09/">September 2006</a></li> <li><a href="/news/releases/2006/08/">August 2006</a></li> <li><a href="/news/releases/2006/07/">July 2006</a></li> <li><a href="/news/releases/2006/06/">June 2006</a></li> <li><a href="/news/releases/2006/05/">May 2006</a></li> <li><a href="/news/releases/2006/04/">April 2006</a></li> <li><a href="/news/releases/2006/03/">March 2006</a></li> <li><a href="/news/releases/2006/02/">February 2006</a></li> <li><a href="/news/releases/2006/01/">January 2006</a></li> <li><a href="/news/releases/2005/12/">December 2005</a></li> <li><a href="/news/releases/2005/11/">November 2005</a></li> <li><a href="/news/releases/2005/10/">October 2005</a></li> <li><a href="/news/releases/2005/09/">September 2005</a></li> <li><a href="/news/releases/2005/08/">August 2005</a></li> <li><a href="/news/releases/2005/07/">July 2005</a></li> <li><a href="/news/releases/2005/06/">June 2005</a></li> <li><a href="/news/releases/2005/05/">May 2005</a></li> <li><a href="/news/releases/2005/04/">April 2005</a></li> <li><a href="/news/releases/2005/03/">March 2005</a></li> <li><a href="/news/releases/2005/02/">February 2005</a></li> <li><a href="/news/releases/2005/01/">January 2005</a></li> <li><a href="/news/releases/2004/12/">December 2004</a></li> <li><a href="/news/releases/2004/11/">November 2004</a></li> <li><a href="/news/releases/2004/10/">October 2004</a></li> <li><a href="/news/releases/2004/09/">September 2004</a></li> <li><a href="/news/releases/2004/08/">August 2004</a></li> <li><a href="/news/releases/2004/07/">July 2004</a></li> <li><a href="/news/releases/2004/06/">June 2004</a></li> <li><a href="/news/releases/2004/05/">May 2004</a></li> <li><a href="/news/releases/2004/04/">April 2004</a></li> <li><a href="/news/releases/2004/03/">March 2004</a></li> <li><a href="/news/releases/2004/02/">February 2004</a></li> <li><a href="/news/releases/2004/01/">January 2004</a></li> <li><a href="/news/releases/2003/12/">December 2003</a></li> <li><a href="/news/releases/2003/11/">November 2003</a></li> <li><a href="/news/releases/2003/10/">October 2003</a></li> <li><a href="/news/releases/2003/09/">September 2003</a></li> <li><a href="/news/releases/2003/08/">August 2003</a></li> <li><a href="/news/releases/2003/07/">July 2003</a></li> <li><a href="/news/releases/2003/06/">June 2003</a></li> <li><a href="/news/releases/2003/05/">May 2003</a></li> <li><a href="/news/releases/2003/04/">April 2003</a></li> <li><a href="/news/releases/2003/03/">March 2003</a></li> <li><a href="/news/releases/2003/02/">February 2003</a></li> <li><a href="/news/releases/2003/01/">January 2003</a></li> <li><a href="/news/releases/2002/12/">December 2002</a></li> <li><a href="/news/releases/2002/11/">November 2002</a></li> <li><a href="/news/releases/2002/10/">October 2002</a></li> <li><a href="/news/releases/2002/09/">September 2002</a></li> <li><a href="/news/releases/2002/08/">August 2002</a></li> <li><a href="/news/releases/2002/07/">July 2002</a></li> <li><a href="/news/releases/2002/06/">June 2002</a></li> <li><a href="/news/releases/2002/05/">May 2002</a></li> <li><a href="/news/releases/2002/04/">April 2002</a></li> <li><a href="/news/releases/2002/03/">March 2002</a></li> <li><a href="/news/releases/2002/02/">February 2002</a></li> <li><a href="/news/releases/2002/01/">January 2002</a></li> <li><a href="/news/releases/2001/12/">December 2001</a></li> <li><a href="/news/releases/2001/11/">November 2001</a></li> <li><a href="/news/releases/2001/10/">October 2001</a></li> <li><a href="/news/releases/2001/09/">September 2001</a></li> <li><a href="/news/releases/2001/08/">August 2001</a></li> <li><a href="/news/releases/2001/07/">July 2001</a></li> <li><a href="/news/releases/2001/06/">June 2001</a></li> <li><a href="/news/releases/2001/05/">May 2001</a></li> <li><a href="/news/releases/2001/04/">April 2001</a></li> <li><a href="/news/releases/2001/03/">March 2001</a></li> <li><a href="/news/releases/2001/02/">February 2001</a></li> <li><a href="/news/releases/2001/01/">January 2001</a></li> </ul> </noscript> <br clear="all" /></div>  <div class="divider-nd">Appointments</div> <div class="leftboxb"> <ul> <li><a href="/news/nominations/">Nominations</a></li> </ul> <br clear="all" /></div>  <div class="divider-nd">Federal Facts</div> <div class="leftboxb"> <ul> <li><a href="/news/fsbr.html">Federal Statistics</a></li> </ul> <br clear="all" /></div>  <div class="divider-nd">West Wing</div> <div class="leftboxb"> <ul> <li><a href="/news/west-wing.html">History</a></li> </ul> </div> <br clear="left" /> </div>  <div id="whitebox_top"></div> <div id="whitebox"> <div id="news_container">  <table border="0" cellspacing="0" cellpadding="0" width="621" summary="Breadcrumbs, Print"> <tr valign="top"> <td align="left" width="310"> <font face="Arial, Helvetica, Sans-Serif" size="1">  <a href="/index.html">Home</a> > <a href="/news/">News & Policies</a> > <a href="/news/releases/2008/05/">May 2008</a> </font> <br/> </td> <td align="right" width="311"> <div id="print-email">  <a href="/news/releases/2008/05/print/20080509-6.html"><img src="/imgs/release_tools_icons_print.gif" width="19" height="18" border="0" alt="Printer-Friendly Version"/>Printer-Friendly Version</a>   <a href="#" onclick="javascript:popup('/mailthispage.html','300','130');"> <img src="/imgs/release_tools_icons_email.gif" width="19" height="18" border="0" alt="Email this page"/>Email This Page</a> </div> </td> </tr> </table><br />  <p align="right"><font size="1"> For Immediate Release<br/> Office of the Press Secretary<br/> May 9, 2008 </font> <p> <font face="Arial, Helvetica, sans-serif" color="#003399" size="3"><b> Memorandum For The Heads Of Executive Departments And Agencies </b></font> <br/> <p> <table align="right" border="0" cellpadding="0" cellspacing="0" width="205"> <tbody><tr><td> <div id="release-tools"> <div id="release-tools-top"></div> <div id="release-tools-content"> <br/><img src="/imgs/release_tools_icons_rss.gif" alt="RSS Feed" width="19" height="18">  <a href="/rss/news.xml">White House News</a> <br> </div> <div id="release-tools-bot"></div> </div> </td></tr></tbody> </table> <p> <p>SUBJECT: Designation and Sharing of Controlled Unclassified Information (CUI)</p> <p><U>Purpose</U></p> <p>(1) This memorandum (a) adopts, defines, and institutes "Controlled Unclassified Information" (CUI) as the single, categorical designation henceforth throughout the executive branch for all information within the scope of that definition, which includes most information heretofore referred to as "Sensitive But Unclassified" (SBU) in the Information Sharing Environment (ISE), and (b) establishes a corresponding new CUI Framework for designating, marking, safeguarding, and disseminating information designated as CUI. The memorandum's purpose is to standardize practices and thereby improve the sharing of information, not to classify or declassify new or additional information.</p> <p> <U>Background  The Current SBU Environment</U></p> <p> (2) The global nature of the threats facing the United States requires that (a) our Nation's entire network of defenders be able to share information more rapidly so those who must act have the information they need, and (b) the United States Government protect sensitive information, information privacy, and other legal rights of Americans. A uniform and more standardized governmentwide framework for what has previously been known as SBU information is essential for the ISE to succeed. Accordingly, this memorandum establishes a standardized framework designed to facilitate and enhance the sharing of Controlled Unclassified Information.</p> <p> <U>Definitions</U></p> <p> (3) In this memorandum, the following terms have the meaning indicated:</p> <p> a. "Controlled Unclassified Information" is a categorical designation that refers to unclassified information that does not meet the standards for National Security Classification under Executive Order 12958, as amended, but is (i) pertinent to the national interests of the United States or to the important interests of entities outside the Federal Government, and (ii) under law or policy requires protection from unauthorized disclosure, special handling safeguards, or prescribed limits on exchange or dissemination. Henceforth, the designation CUI replaces "Sensitive But Unclassified" (SBU).</p> <p> b. "CUI Council" is a subcommittee of the Information Sharing Council (ISC), created by the Intelligence Reform and Terrorism Prevention Act of 2004 (Public Law 108-458) (IRTPA).</p> <p> c. "CUI Framework" refers to the single set of policies and procedures governing the designation, marking, safeguarding, and dissemination of CUI terrorism-related information that originates in departments and agencies, regardless of the medium used for the display, storage, or transmittal of such information.</p> <p> d. "CUI Framework Standards Registry" (the "CUI Registry") refers to the official list of, and recognized standards for, CUI markings including "safeguarding," and "dissemination" maintained by the Executive Agent.</p> <p> e. "Departments and Agencies" means executive agencies as defined in section 105 of title 5, United States Code; the United States Postal Service; but not the Government Accountability Office.</p> <p> f. "Enhanced Safeguarding" is a handling requirement that means the information so designated is subject to measures more stringent than those normally required because inadvertent or unauthorized disclosure would create a risk of substantial harm. This requirement is indicated by the marking "Controlled Enhanced."</p> <p> g. "Executive Agent" means the National Archives and Records Administration (NARA).</p> <p> h. "Information" means any communicable knowledge or documentary material, regardless of its physical form or characteristics, that is owned by, is produced by or for, or is under the control of the Federal Government. </p> <p> i. "Information Sharing Environment" means an approach that facilitates the sharing of "terrorism information," as defined by section 1016 of IRTPA.</p> <p> j. "Safeguarding" means measures and controls that are prescribed to protect controlled unclassified information.</p> <p> k. "Sensitive But Unclassified" refers collectively to the various designations used heretofore within the Federal Government for documents and information that are sufficiently sensitive to warrant some level of protection from disclosure but that do not warrant classification.</p> <p> l. "Specified Dissemination" is a handling instruction that means the information so designated is subject to additional instructions governing the extent to which dissemination is permitted.</p> <p> m. "Standard Dissemination" is a handling instruction that means dissemination is authorized to the extent it is reasonably believed that dissemination would further the execution of lawful or official mission purpose, provided that individuals disseminating this information do so within the scope of their assigned duties.</p> <p> n. "Standard Safeguarding" is a handling requirement that means the information so designated is subject to baseline safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. This requirement shall be indicated through the use of the marking "Controlled."</p> <p> o. "Terrorism-Related Information" means (i) information, as defined by Implementing Recommendations of the 9/11 Commission Act of 2007, Public Law 110-53, section 504; (ii) homeland security information, as defined by 6 U.S.C. 482(f); and (iii) law enforcement information relating to terrorism.</p> <p><U>Policy  The CUI Framework</U></p> <p> (4) The uniform use of CUI is essential to fostering an effective ISE. All departments and agencies shall apply the CUI Framework, which consists of the following policies and standards, as outlined in paragraphs 5-19 for the designation, marking, safeguarding, and dissemination of any CUI terrorism-related information within the ISE that originates in departments and agencies, regardless of the medium used for its display, storage, or transmittal.</p> <p>(5) All CUI shall merit one of two levels of safeguarding procedures: standard (marked "Controlled") or enhanced (marked "Controlled Enhanced").</p> <p>(6) All CUI shall merit one of two levels of dissemination controls: "Standard Dissemination" or "Specified Dissemination."</p> <p>(7) All CUI shall be (a) categorized into one of three combinations of safeguarding procedures and dissemination controls, and (b) so indicated through the use of the following corresponding markings:</p> <p> (i) <strong>"<U>Controlled with Standard Dissemination</U>"</strong> meaning the information requires standard safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Dissemination is permitted to the extent that it is reasonably believed that it would further the execution of a lawful or official purpose. </p> <p> (ii) <strong>"<U>Controlled with Specified Dissemination</U>"</strong> meaning the information requires safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Material contains additional instructions on what dissemination is permitted.</p> <p> (iii) <strong>"<U>Controlled Enhanced with Specified Dissemination</U>"</strong> meaning the information requires safeguarding measures more stringent than those normally required since the inadvertent or unauthorized disclosure would create risk of substantial harm. Material contains additional instructions on what dissemination is permitted.</p> <p>(8) Any additional CUI markings may be prescribed only by the Executive Agent. Use of additional CUI markings is prohibited unless the Executive Agent determines that extraordinary circumstances warrant the use of additional markings. </p> <p>(9) Departments and agencies shall apply the CUI Registry's standards. The originator of CUI may not impose any additional safeguarding or dissemination requirements upon the recipient(s). No department or agency shall create CUI categories or rules outside the CUI Framework.</p> <p>(10) Recipients of CUI shall report any unauthorized or inadvertent disclosures to the designating agency.</p> <p>(11) All CUI shall be marked in a clear manner and conform to statutory and regulatory requirements, if any, regarding markings. Recipients of CUI that is not marked shall mark the information appropriately and inform the originator that it has been so marked.</p> <p>(12) Wherever possible, it is expected that departments and agencies will re-mark archived or legacy material when it is incorporated into the ISE.</p> <p>(13) CUI markings may inform but do not control the decision of whether to disclose or release the information to the public, such as in response to a request made pursuant to the Freedom of Information Act (FOIA).</p> <p>(14) Originating departments and agencies shall retain control of decisions regarding whether to disseminate CUI materials beyond their Standard or Specified Dissemination instructions, including any dissemination to the media or general public.</p> <p>(15) Material that contains both CUI and non-CUI information, or that contains multiple categories of CUI, should be marked accordingly by portions such that those categorical distinctions are apparent.</p> <p>(16) The CUI markings shall be incorporated into ISE-related information technology (IT) projects under development or developed in the future and shall be reflected in plans for new information technologies. </p> <p>(17) The CUI markings shall be used regardless of the medium through which the information appears or conveys. Oral communications should be prefaced with a statement describing the controls when necessary to ensure that recipients are aware of the information's status.</p> <p>(18) Departments or agencies shall not impose safeguarding requirements or dissemination controls on information in the ISE that is neither classified nor CUI.</p> <p>(19) When a department or agency receives CUI originating from a State, local, tribal, private sector, or foreign partner, any nonfederal legacy markings shall be retained, unless the originator authorizes its removal.</p> <p>(20) Implementation of the CUI Framework shall commence upon the date of this memorandum and shall be completed within 5 years.</p> <p><U>CUI Framework Implementation</U></p> <p>(21) The Executive Agent shall be responsible for overseeing and managing implementation of this CUI Framework.</p> <p>(22) The Executive Agent shall have the following authorities and responsibilities:</p> <p> a. Develop and issue CUI policy standards and implementation guidance consistent with this memorandum, including appropriate recommendations to State, local, tribal, private sector, and foreign partner entities for implementing the CUI Framework. As appropriate, establish new safeguarding and dissemination controls, and, upon a determination that extraordinary circumstances warrant the use of additional CUI markings, authorize the use of such additional markings;</p> <p> b. Establish and chair the CUI Council;</p> <p> c. Establish, approve, and maintain safeguarding standards and dissemination instructions, including "Specified Dissemination" requirements proposed by the heads of departments and agencies;</p> <p> d. Publish the CUI safeguarding and dissemination standards in the CUI Registry; </p> <p> e. Monitor department and agency compliance with CUI policy, standards, and markings;</p> <p> f. Establish baseline training requirements and develop an ISE-wide CUI training program to be implemented by departments and agencies;</p> <p> g. Provide appropriate information regarding the CUI Framework to the Congress, to State, local, tribal, and private sector entities, and to foreign partners;</p> <p> h. Advise the heads of departments and agencies on the resolution by the CUI Council of complaints and disputes among such departments and agencies concerning the proper designation or marking of CUI; and</p> <p> i. Establish, in consultation with affected departments and agencies, a process that addresses enforcement mechanisms and penalties for improper handling of CUI.</p> <p>(23) A CUI Council is hereby established as a subcommittee of the ISC. Its members shall be drawn from the ISC's membership. The CUI Council shall:</p> <p> a. Serve as the primary advisor to the Executive Agent on issues pertaining to the CUI Framework;</p> <p> b. Advise the Executive Agent in developing procedures, guidelines, and standards necessary to establish, implement, and maintain the CUI Framework;</p> <p> c. Ensure coordination among the departments and agencies participating in the CUI Framework;</p> <p> d. Advise the Executive Agent on the resolution of complaints and disputes among departments and agencies about proper designation or marking of CUI; and</p> <p> e. As appropriate, consult with the ISC's State, Local, Tribal, and Private Sector Subcommittee.</p> <p>(24) The head of each department and agency with possession of terrorism-related information shall: </p> <p> a. Ensure the implementation of the CUI Framework within such department or agency;</p> <p> b. Promulgate guidance for the implementation of the CUI Framework within such department or agency, consistent with ISE-wide CUI policies issued by the CUI Executive Agent, as established in paragraph 21;</p> <p> c. Adopt markings listed in the CUI Registry maintained by the Executive Agent as the exclusive CUI markings used by such department or agency, consistent with paragraphs 5-8 of this memorandum;</p> <p> d. Propose any necessary "Specified Dissemination" instructions to the Executive Agent for approval and listing in the CUI Registry;</p> <p> e. Designate an appropriately qualified senior official from within the department or agency as its representative on the CUI Council;</p> <p> f. Implement a CUI training program for their respective department or agency, based on the ISE-wide training program established by the Executive Agent, and ensure all appropriate personnel (i) understand CUI policies and procedures, and (ii) can apply them when creating, disseminating, or safeguarding CUI material;</p> <p> g. Establish a process that enables their respective department or agency to address noncompliance with the new CUI Framework within the agency, and ensure management and oversight issues or concerns can be elevated to the appropriate department or agency decision-makers;</p> <p> h. Establish a process within their respective department or agency that, where appropriate, promptly raises to the Executive Agent matters of concern regarding the Framework; and</p> <p> i. Ensure full implementation of the CUI Framework, consistent with policies, guidance, and standards established by the Executive Agent, within 5 years of the date of this memorandum.</p> <p><U>Designating CUI</U></p> <p>(25) Information shall be designated as CUI and carry an authorized CUI marking if:</p> <p> a. a statute requires or authorizes such a designation; or</p> <p> b. the head of the originating department or agency, through regulations, directives, or other specific guidance to the agency, determines that the information is CUI. Such determination should be based on mission requirements, business prudence, legal privilege, the protection of personal or commercial rights, safety, or security. Such department or agency directives, regulations, or guidance shall be provided to the Executive Agent for review.</p> <p>(26) Notwithstanding the above, information shall not be designated as CUI:</p> <p> a. to (i) conceal violations of law, inefficiency, or administrative error; (ii) prevent embarrassment to the Federal Government or any Federal official, any organization, or agency; (iii) improperly or unlawfully interfere with competition in the private sector; or (iv) prevent or delay the release of information that does not require such protection;</p> <p> b. if it is required to be made available to the public; or</p> <p> c. if it has already been released to the public under proper authority.</p> <p><U>Exceptions to CUI</U></p> <p>(27) This memorandum requires that all CUI originated by departments and agencies and shared within the ISE shall conform to the policies and standards for the designating, marking, safeguarding, and disseminating established in accordance with this memorandum. However, infrastructure protection agreements not fully accommodated under the CUI Framework (and its associated markings, safeguarding requirements, and dissemination limitations) shall be considered exceptions to this CUI Framework. Infrastructure protection exceptions include and apply to information governed by or subject to the following regulations:</p> <p> a. 6 CFR Pt. 29  PCII (Protected Critical Infrastructure Information);</p> <p> b. 49 CFR Pts. 15 (Department of Transportation) & 1520 (Department of Homeland Security/Transportation Security Administration)  SSI (Sensitive Security Information);</p> <p> c. 6 CFR Pt. 27  CVI (Chemical Vulnerability Information); and</p> <p> d. 10 CFR Pt. 73  SGI (Safeguards Information).</p> <p>(28) The CUI Framework shall be used for such information to the maximum extent possible, but shall not affect or interfere with specific regulatory requirements for marking, safeguarding, and disseminating.</p> <p>(29) The affected department or agency is authorized to select the most applicable CUI safeguarding marking for the regulation. Any additional requirements for the safeguarding beyond that specified under the CUI Framework shall be appropriately registered in the CUI Registry. Any regulatory marking shall follow the CUI marking, and a specified dissemination instruction shall articulate any additional regulatory requirements.</p> <p><U>General Provisions</U></p> <p>(30) This memorandum:</p> <p> a. shall be implemented in a manner consistent with applicable law, including Federal laws protecting the information privacy rights and other legal rights of Americans, and subject to the availability of appropriations;</p> <p> b. shall be implemented in a manner consistent with the statutory authority of the principal officers of departments and agencies as heads of their respective departments or agencies;</p> <p> c. shall not be construed to impair or otherwise affect the functions of the Director of the Office of Management and Budget relating to budget, administrative, and legislative proposals; and</p> <p> d. is intended only to improve the internal management of the Federal Government and is not intended to, and does not, create any rights or benefits, substantive or procedural, enforceable at law or in equity by a party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.</p> <p>GEORGE W. BUSH</p> <p align="center"># # #</p>  <div id="print-email">  <a href="/news/releases/2008/05/print/20080509-6.html"><img src="/imgs/release_tools_icons_print.gif" width="19" height="18" border="0" alt="Printer-Friendly Version"/>Printer-Friendly Version</a>   <a href="#" onclick="javascript:popup('/mailthispage.html','300','130');"> <img src="/imgs/release_tools_icons_email.gif" width="19" height="18" border="0" alt="Email this page"/>Email This Page</a> </div> </div> </div>  <div id="footer"><img src="/imgs/2colbg_bot.jpg" alt="decoration" height="25px" width="900px" align="top" /><br clear="left" /></div> </div>  <div id="footer_links"> <a href="/president/">President</a> | <a href="/vicepresident/">Vice President</a> | <a href="/firstlady/">First Lady</a> | <a href="/mrscheney/">Mrs. Cheney</a> | <a href="/news/">News & Policies</a><br /> <a href="/history/">History & Tours</a> | <a href="/kids/">Kids</a> | <a href="/government/">Your Government</a> | <a href="/appointments/">Appointments</a> | <a href="/oa/jobs/">Jobs</a> | <a href="/contact/">Contact</a> | <br /> <a href="/accessibility.html">Accessibility</a> | <a href="/search">Search</a> | <a href="/privacy.html">Privacy Policy</a> | <a href="/help.html">Help</a> | <a href="/sitemap.html">Site Map</a></div> </body> </html>