Cui Documents Must Be Reviewed According To Which Procedure

Introduction

When handling Controlled Unclassified Information (CUI), organizations must follow a strict review procedure to protect sensitive data while complying with federal regulations. The review process ensures that CUI is correctly identified, marked, stored, transmitted, and ultimately disposed of in accordance with the CUI Program established by the National Archives and Records Administration (NARA) and the Federal Information Security Modernization Act (FISMA). Also, ignoring or shortcutting these steps can lead to data breaches, loss of contracts, and severe legal penalties. This article walks you through the complete CUI document review procedure, explains the legal and technical foundations, and offers practical tips for implementing a compliant workflow in any organization.

Why a Formal Review Procedure Is Essential

• Regulatory compliance – Federal agencies and their contractors are required to implement the CUI Program (32 CFR 2002). Failure to follow the prescribed review steps can result in non‑compliance findings during audits.
• Risk mitigation – Proper review reduces the likelihood that CUI will be accidentally disclosed, mishandled, or stored in unsecured locations.
• Contractual obligations – Many government contracts contain clauses (e.g., DFARS 252.204‑7012) that obligate contractors to protect CUI. A documented review process is often a contractual deliverable.
• Audit readiness – A repeatable, well‑documented procedure makes it easier to demonstrate compliance during internal or external audits.

Overview of the CUI Review Lifecycle

The CUI review lifecycle can be visualized as a four‑phase loop:

1. Identification & Categorization – Determine whether a document contains CUI and assign the appropriate marking.
2. Protection & Handling – Apply security controls (encryption, access restrictions, physical safeguards).
3. Distribution & Access Control – Verify that only authorized personnel receive the document and that transmission methods meet security standards.
4. Disposition & Continuous Monitoring – Track the document’s lifecycle, update markings as needed, and securely destroy or archive when no longer required.

Each phase contains specific tasks, decision points, and documentation requirements. The following sections break down the detailed steps within each phase.

Phase 1 – Identification & Categorization

1.1 Determine Scope of CUI

• Review the CUI Registry (maintained by NARA) to locate the relevant CUI categories (e.g., Controlled Technical Information, Privacy‑Protected Data, Export Controlled Information).
• Cross‑reference contract clauses, memoranda of understanding (MOUs), or agency guidance to confirm which categories apply to your organization.

1.2 Conduct a Document Scan

• Use automated content‑discovery tools (e.g., data loss prevention (DLP) scanners) to flag potential CUI based on keywords, file types, and metadata.
• Complement automated scans with a manual review by a designated CUI Officer or Subject Matter Expert (SME) to catch false positives/negatives.

1.3 Apply Appropriate Markings

• Follow the CUI Marking Guidance (NARA 2020). Required elements include:

  • Banner – “Controlled Unclassified Information” at the top and bottom of each page.
  • Portion Markings – (CUI) or (CUI‑[Category]) for specific sections.
  • Distribution Statement – If required by the originating agency (e.g., “Distribution Statement A”).

• Use bold text for the banner; italic for optional footnotes.

1.4 Record the Identification Decision

• Log each document in a CUI Register:
  • Document title, version, and unique identifier.
  • CUI category and marking level.
  • Reviewer name, date, and justification for classification.

This register becomes the primary evidence during audits.

Phase 2 – Protection & Handling

2.1 Assign Access Controls

• Map each CUI category to a Security Classification Level (SCL) in your organization’s Access Control Matrix.
• Implement role‑based access control (RBAC) so only personnel with a need‑to‑know can open the document.

2.2 Encrypt at Rest and in Transit

• At rest: Use FIPS‑validated encryption (AES‑256) on servers, laptops, and removable media.
• In transit: Require TLS 1.2 or higher for email, file transfers, and web portals.

2.3 Physical Safeguards

• Store printed CUI in locked cabinets within a controlled area.
• Limit physical access to rooms that contain CUI‑bearing workstations.

2.4 Document the Controls

• Attach a Protection Summary to the CUI Register entry, detailing:
  • Encryption algorithms and key management practices.
  • Access control lists (ACLs) and any exceptions granted.
  • Physical security measures.

Phase 3 – Distribution & Access Control

3.1 Verify Recipient Authorization

• Before sending, confirm the recipient’s CUI clearance and need‑to‑know status through the Identity & Access Management (IAM) system.
• For external partners, obtain a CUI Handling Agreement signed by both parties.

3.2 Choose an Approved Transmission Method

3.3 Log Distribution Events

• Record each distribution in the CUI Register: date, sender, recipient, method, and any temporary access approvals.
• Retain logs for minimum 90 days (or longer if required by contract).

3.4 Continuous Monitoring

• Deploy real‑time DLP alerts that trigger when CUI is moved to unauthorized locations or accessed by non‑authorized users.
• Conduct quarterly access reviews to re‑validate need‑to‑know.

Phase 4 – Disposition & Continuous Monitoring

4.1 Review Retention Requirements

• Federal records schedules (e.g., ARC 103) dictate how long CUI must be retained.
• Contractual clauses may impose longer periods. Document the retention timeline in the CUI Register.

4.2 Re‑Mark or De‑Classify

• If a document’s content changes such that it no longer contains CUI, update the markings accordingly.
• Use a de‑classification worksheet signed by the original reviewer and a senior manager.

4.3 Secure Destruction

• Electronic media: Perform cryptographic erasure (NIST SP 800‑88) or use approved data‑wiping tools.
• Paper copies: Shred using cross‑cut shredders that meet DOE‑STD‑2090‑97 standards.

4.4 Archive CUI (When Required)

• Store long‑term archives in FIPS‑validated, air‑gapped storage with controlled access.
• Maintain an archival index linking back to the original CUI Register entry.

4.5 Audit Trail Maintenance

• Preserve the full audit trail (identification, protection, distribution, disposition) for the entire lifecycle of the document.
• Conduct annual internal audits and be prepared for external inspections by the agency sponsor.

Frequently Asked Questions (FAQ)

Q1. How often should the CUI review procedure be updated?
A: Review the procedure at least annually or whenever a new CUI category is added to the Registry, a significant regulatory change occurs, or a major incident reveals gaps.

For more on this topic, read our article on write a summary of 1963 the year that changed everything or check out who was the first african american in the supreme court.

Q2. Can non‑government employees perform the CUI identification step?
A: Yes, provided they have completed CUI awareness training and have been authorized as CUI Reviewers by the organization’s CUI Program Manager.

Q3. What if a document contains both CUI and public information?
A: Use portion markings to isolate the CUI sections. The public portions can be unmarked, but the overall document must still be handled as CUI because it contains protected material.

Q4. Is it acceptable to store CUI on cloud services?
A: Only if the cloud provider meets FedRAMP or equivalent security standards and a Cloud Use Agreement is in place that addresses CUI handling.

Q5. How do I handle CUI that is embedded in images or scanned PDFs?
A: Apply optical character recognition (OCR) tools to extract text for automated scanning, then manually verify and mark the document. Ensure the image file itself is encrypted.

Best‑Practice Checklist

• [ ] Verify the latest CUI Registry version before starting the review.
• [ ] Conduct both automated and manual scans for each document.
• [ ] Apply banner and portion markings in bold, following NARA guidance.
• [ ] Log every identification decision in the CUI Register with justification.
• [ ] Encrypt CUI at rest (AES‑256) and in transit (TLS 1.2+).
• [ ] Enforce role‑based access and maintain up‑to‑date ACLs.
• [ ] Use only approved transmission methods and record each distribution event.
• [ ] Perform quarterly access reviews and monitor DLP alerts.
• [ ] Follow retention schedules; securely destroy or archive when the retention period ends.
• [ ] Keep a complete audit trail for the entire document lifecycle.

Conclusion

A reliable CUI document review procedure is more than a bureaucratic hurdle; it is a critical safeguard that protects national interests, maintains trust with government partners, and shields organizations from costly compliance failures. By systematically identifying, protecting, distributing, and disposing of CUI—while documenting every step in a centralized register—organizations can achieve a high level of confidence that their handling of Controlled Unclassified Information meets both legal mandates and best‑practice standards. Implement the steps outlined above, keep the process under continuous review, and embed a culture of CUI awareness throughout your workforce to stay ahead of evolving security requirements.