General guidelines for Handling Controlled Unclassified Information (CUI) as you Telework (2024)

FAQs

General guidelines for Handling Controlled Unclassified Information (CUI) as you Telework? ›

CUI must be stored or handled in controlled environments that prevent or detect unauthorized access. Limit and control access to CUI within the workforce by establishing electronic barriers. When Reproducing or Faxing CUI, you may use agency-approved equipment. Look for signs on approved equipment.

CUI must be stored or handled in controlled environments that prevent or detect unauthorized access. Limit and control access to CUI within the workforce by establishing electronic barriers. When Reproducing or Faxing CUI, you may use agency-approved equipment. Look for signs on approved equipment.

CUI is Government-created or owned UNCLASSIFIED information that allows for, or requires, safeguarding and dissemination controls in accordance with laws, regulations, or Government-wide policies.

Yes, personnel can take CUI home. CUI materials hand-carried out of the office or approved telework location must have a CUI cover sheet (Standard Form 901) on top of the documents, with all materials placed in an opaque envelope, without CUI markings or indications on the outermost layer.

Forms that contain CUI, must be marked accordingly, when filled in. It is mandatory to include banner markings to indicate that an email contains CUI. If an email is forwarded, the banner marking must be carried forward. If sending an attachment that contains CUI, the name of the file can contain a CUI indicator.

NARA has the authority to manage CUI Programs across the Federal government.

Final Answer

True statements about CUI include its requirement for protection due to sensitivity and its governance by specific regulations or policies, but it is not classified information.

Reminder: CUI must not be stored on nongovernment systems or storage devices (personal computers, USBs, etc.)

If needed, employees should consult their supervisor if they have any questions regarding the proper handling of sensitive information. Here are some general guidelines to consider as you telework with CUI: CUI should not be stored on personal systems. Printing and hard copy storage should be kept to a minimum.

CUI Basic is the subset of CUI for which the authorizing law, regulation, or government-wide policy does not set out specific handling or dissemination controls. Agencies handle CUI Basic according to the uniform set of controls set forth in DODI 5200.48 and the DOD CUI Registry.

What are the 2 types of CUI? ›

Types of CUI: CUI Basic vs CUI Specified

An investigation into the CUI category for the data will reveal its type: CUI-Basic or CUI Specified.

Controlled Unclassified Information is unclassified information the United States Government creates or possesses that requires safeguarding or dissemination controls limiting its distribution to those with a lawful government purpose.

CUI is best understood by first knowing what does not qualify as CUI. Put simply, any information classified under Executive Order No. 13526 and the Atomic Energy Act cannot be considered CUI. In other words, any classified information labeled “classified,” “secret,” or “top-secret” cannot be designated as CUI.

Standard commercially available telephone lines are acceptable for the discussion of CUI. Be aware of the surroundings so unauthorized persons are not within hearing distance.

In accordance with Part 2002 of Title 32, CFR, CUI requires safeguarding or dissemination controls identified in a law, regulation, or government-wide policy for information that does not meet the requirements for classification in accordance with E.O. 13526.

The basis for the handling and storage of classified data is the need to protect national security information from unauthorized disclosure.

If company A needs to email company B a CUI document, NIST control SC. 3.185 states, cryptographic mechanism must be in place to prevent unauthorized disclosure of CUI during transmission.