The Information Security Oversight Office published a draft document on the Federal Register outlining how agencies should designate, mark and manage dissemination of controlled unclassified information (CUI).
The draft document explains what data qualifies as CUI, procedures for transmitting, safeguarding and "decontrolling" the information and establishing a management structure around CUI policies.
Proposed Rule: Controlled Unclassified Information
The new rule would apply to all executive branch agencies, as well as information regularly disseminated to organizations outside the executive branch.
"Prior to the CUI Program, agencies often employed ad hoc, agency-specific policies, procedures and markings to handle this information," the proposed rule reads. "This patchwork approach caused agencies to mark and handle information inconsistently, implement unclear or unnecessarily restrictive disseminating policies and create obstacles to sharing information."
Agencies used more than 100 different markings to identify CUI in the past, prompting President Obama to issue an executive order in 2010 to streamline the governing regulations.
More: Executive order tightens rule on 'controlled unclassified' info
"An executive branch-wide CUI policy balances the need to safeguard CUI with the public interest in sharing information appropriately and without unnecessary burdens," the draft document states.
The National Archives and Records Administration is charged with ensuring agencies follow CUI policies, however departments also need to designate senior officials to oversee compliance at each agency.
These CUI officials should be members of the Senior Executive Service (or equivalent) and designate a CUI program manager to help them with oversight and establishing training programs for employees.
Agencies and other stakeholders have until July 7 to comment on the proposed rule.
Aaron Boyd is an awarding-winning journalist currently serving as editor of Federal Times — a Washington, D.C. institution covering federal workforce and contracting for more than 50 years — and Fifth Domain — a news and information hub focused on cybersecurity and cyberwar from a civilian, military and international perspective.
