The National Archives and Records Administration (NARA) serves as the Controlled Unclassified Information (CUI) Executive Agent (EA). NARA has the authority and responsibility to manage the CUI Program across the Federal government.

How can we protect CUI?

1. Level 1 suggests performing basic cyber hygiene practices like installing anti-virus software and regularly changing passwords to safeguard Federal Contract Information (FCI).
2. Level 2 describes an “intermediate level of cyber hygiene” that begins implementing NIST SP 800-171 requirements to secure CUI.

Why do we protect CUI?

Controlled Unclassified Information (CUI) is information requires special handling, protection and dissemination controls even though it isn't classified information. These security controls protect the data's integrity and privacy, and are essential practices for contractors handling this type of information.

Who is responsible for identifying CUI?

You see, Section 3.4(a) of the DoDI 5200.48 says: The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category.

Who should be responsible for protecting our personal data?

According to PwC, consumers expect companies to protect their data proactively; 92% of consumers say companies must be proactive about data protection, 82% agree that the government should regulate how companies use private data, and 72% think that businesses, not the government, are best equipped to protect them.

Who is responsible for protecting Cui DoD?

Who is responsible for protecting CUI markings and dissemination instructions?

The authorized holder of a document or material is responsible for determining, at the time of creation, whether information in a document or material falls into a CUI category. If so, the authorized holder is responsible for applying CUI markings and dissemination instructions accordingly.

What level of confidentiality is required for CUI?

CUI will be classified at a “moderate” confidentiality level and follow DoDI 8500.01 and 8510.01 in all DOD systems. Non-DoD systems must provide adequate security with requirements incorporated into all legal documents with non-DoD entities following DoDI 8582.01 guidelines.

Is CUI basic confidentiality?

– Any specific destruction methods required by law, regulation, or Government-wide policy for that item. Purpose of the CUI Program is to provide a uniform and consistent system for protecting CUI throughout executive branch. Baseline standard for protecting CUI is no less than moderate confidentiality.

Does CUI need to be encrypted?

Answer: Yes. CUI must be encrypted in transit.

What is required to access controlled unclassified information?

CUI requires an organization or individual to have a “lawful governmental purpose” for access which, is a lower standard than the “need-to-know” required for classified access.

What marking is required on a DoD document containing controlled unclassified information?

It is mandatory to include a banner marking at the top of the page to alert the user that CUI is present. What is the purpose of the ISOO CUI Registry?

What is DoD implements CUI?

DoDI 5200.48 implements the DOD CUI program as required by EO 13556.

Does CUI replace ITAR?

Some types of information are simple to identify as CUI. “Export control” includes any information that is subject to export control, such as International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR)—this would be CUI.

What is the CUI basic?

CUI Basic is the subset of CUI for which the authorizing law, regulation, or Government-wide policy does not set out specific handling or dissemination controls. Agencies handle CUI Basic according to the uniform set of controls set forth in this part and the CUI Registry.

What makes a document CUI?

CUI is government created or owned information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and government wide policies. ... It is not corporate intellectual property unless created for or included in requirements related to a government contract.

Who can destroy CUI?

Therefore, all CUI paper MUST be destroyed using a high security shredder that produces a final particle size of 1mmx5mm or less, such as those listed on the NSA/CSS 02-01 EPL for classified paper destruction. All of SEM's high security shredders meet this mandate.

What is the purpose of the ISOO CUI?

The CUI Registry is a catalogue of what the Executive branch should be protecting. The CUI Registry identifies all approved CUI categories and subcategories , provides general descriptions for each, identifies the basis for controls, establishes markings, and includes guidance on handling procedures.

Can CUI be emailed?

Emailing CUI

The body of the email must not contain any CUI; it must be in an encrypted attachment. The applicable CUI marking must be included at the top of each email. ... It is best practice to include an indicator marking such as “Contains CUI” at the end of the subject line.

What is the correct banner marking for unclassified documents with CUI?

(U) Banner line. o (CUI) At a minimum, CUI markings for unclassified documents will include the acronym “CUI” at the top and bottom of each page.

Is CUI export controlled?

Note: not all CUI is export controlled, but all “technical data” is CUI if there is an underlying government contract identifying the CUI.

What is the purpose of ISOO CUI registry quizlet?

What is the purpose of the ISOO CUI Registry? A Gov't wide online repository for Federal-lvl guidance regarding CUI policy and practice. What level of system and network configuration is required for CUI? Administrative, civil, or criminal sanctions may be imposed if there is an unauthorized disclosure (UD) of CUI?

What are the 6 categories of CUI?

• Ammonium Nitrate.
• Chemical-terrorism Vulnerability Information.
• Critical Energy Infrastructure Information.
• Emergency Management.
• General Critical Infrastructure Information.
• Information Systems Vulnerability Information.
• Physical Security (PHYSEC)

What marking acronym is required on a DoD document?

At initial CUI implementation, the only authorized marking for DoD CUI documents is the acronym “CUI” in the banner and footer of the document.

What are the names of the policies that provide guidance for the DoD information security program?

The Undersecretary of Defense for Intelligence, or USD(I), provides implementation guidance for the Information Security Program within the DoD.

What is the difference between CUI and unclassified?

CUI is unclassified information that requires additional protection or safeguarding. The U.S. government is taking a new approach in marking and handling CUI, which can lead to best practices in the private sector by modeling proper protection methods for sensitive information.