On May 22, Archivist of the United States Allen Weinstein announced the establishment of the “Controlled Unclassified Information Office” (CUIO) within the National Archives and Records Administration. Weinstein also announced that William J. Bosanko, director of the Information Security Oversight Office, will head up this newly formed office. The Office is being created in response to the Memorandum for the Heads of Departments and Agencies on the Designation and Sharing of Controlled Unclassified Information (CUI) issued by President Bush on May 9, 2008.
The Presidential memorandum designated the National Archives as responsible for overseeing and managing the implementation of the CUI framework.
The new CUI policy is an attempt by the Bush administration to standardize procedures for the treatment of what is referred to as “Sensitive But Unclassified” (SBU) information. The memorandum issued by the president adopts, defines and institutes “Controlled Unclassified Information” as the new standard for the treatment of such information. There are currently over 100 different markings for sensitive information that has led to over-classification. The new CUI policy would reduce that to three categories.
Three new categories are:
- “Controlled with Standard Dissemination” meaning the information requires standard safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Dissemination is permitted to the extent that it is reasonably believed that it would further the execution of a lawful or official purpose.
- “Controlled with Specified Dissemination” meaning the information requires safeguarding measures that reduce the risks of unauthorized or inadvertent disclosure. Material contains additional instructions on what dissemination is permitted.
- “Controlled Enhanced with Specified Dissemination” meaning the information requires safeguarding measures more stringent than those normally required since the inadvertent or unauthorized disclosure would create risk of substantial harm. Material contains additional instructions on what dissemination is permitted.
The Director of the new CUI Office will:
- Develop and issue CUI policy standards and implementation guidance. As appropriate, establish new safeguarding and dissemination controls, and, upon a determination that extraordinary circumstances warrant the use of additional CUI markings, authorize the use of such additional markings;
- Establish, approve, and maintain safeguarding standards and dissemination instructions, including “Specified Dissemination” requirements proposed by the heads of departments and agencies;
Publish the CUI safeguarding and dissemination standards in the CUI Registry;
- Establish and chair the CUI Council;
- Monitor department and agency compliance with CUI policy, standards, and markings;
Establish baseline-training requirements and develop an ISE-wide CUI training program to be implemented by departments and agencies;
- Provide appropriate information regarding the CUI Framework to the Congress, to State, local, tribal, and private sector entities, and to foreign partners;
- Advise the heads of departments and agencies on the resolution by the CUI Council of complaints and disputes among such departments and agencies concerning the proper designation or marking of CUI; and
- Establish, in consultation with affected departments and agencies, a process that addresses enforcement mechanisms and penalties for improper handling of CUI.