What You Need to Know About The DoD Instruction Implementing The CUI Program?

Today, in military and civilian governmental employment, information protection goes beyond the classified.  

There’s a particular type of sensitive information that, although not classified, should still receive adequate protection.  

It’s called Controlled Unclassified Information (CUI), and learning how to handle it is of interest to any individual involved with the Department of Defense (DoD) or one of its contractors. 

Not surprisingly, the most common question of all revolves around which DoD instruction actually implements the DoD CUI program.  

If you are acquainted with this, you can remain compliant and prevent mishaps and mistakes involving sensitive but unclassified information.  

Consider the instruction, discover what CUI entails, and learn how to identify and handle it. 

What DoD Instruction Implements the DoD CUI Program?

The overarching regulation governing the DoD CUI program is the Department of Defense Instruction (DoDI) 5200.48, titled “Controlled Unclassified Information (CUI).”  

Published on March 6, 2020, it puts in place the rules regarding the identification, marking, and protection of CUI within the DoD. 

DoDI 5200.48 connects the Department of Defense with the federal CUI program first required through Executive Order 13556.  

It ensures that the military branches, each defense agency, and each contractor use the same procedures in handling CUI.  

Without uniform markings or procedures used across the various agencies previously, confusion and the risk of unintentional disclosure were created. 

 With a single, definitive system in place, DoDI 5200.48 creates consistency and harmony throughout all DoD activities. 

What Is Controlled Unclassified Information (CUI)?

Controlled Unclassified Information refers to information that requires protection and distribution restriction but lacks classification as Confidential, Secret, or Top Secret.  

It serves as a middle ground between publicly available information and classified information. 

For instance, CUI may contain significant defense technical information, export-controlled specifications, information regarding key infrastructure, or personally identifiable information such as Social Security numbers.  

These are not based on a sufficient classification law, but may still damage national security if disclosed inadvertently, intrude on privacy, or disrupt operations. 

The DoD CUI program works towards preventing such information from being accessed or distributed illegally, while still enabling distribution to individuals who actually need it. 

What Are the Types Of CUI? CUI Basic, Specified And Assets!

In order to handle a wide variety of sensitive information, the DoD further subdivides CUI into CUI Basic and CUI Specified. 

CUI Basic 

CUI Basic is information that is sensitive and should be secured, yet doesn’t carry special rules at law pertaining to how it should be handled.  

Protection rules are minimal and are often straightforward and easy. For instance, internal policies or sensitive messages regarding operations might fall into this category.  

Although this type of information still requires proper handling, the rules are less stringent and carry no special legal restrictions. 

CUI Defined 

CUI Specified covers information with specific rules of treatment because of a law, regulation, or government policy.  

Export-controlled technical data, as outlined in the International Traffic in Arms Regulations (ITAR), is a prime example of this type of information.  

Since they are associated with specific rules of law, CUI Specified entities require higher protections and usually have more descriptive labels. 

Understanding whether information is CUI Basic or CUI Specified is critical because it determines the level of protection required. Misidentifying the category can lead to improper handling and potential violations. 

CUI assets 

When we refer to CUI assets, we are talking about any medium, whether physical or digital, that contains Controlled Unclassified Information. Emails, 

 databases, reports, spreadsheets, and audio recordings are all contenders. If a report includes a single paragraph or a spreadsheet contains a single cell with sensitive material, the whole document becomes a CUI asset. 

We should also label these assets, as once CUI comes into being, the information must be stored, transmitted, and cleared from disposition in accordance with the directions from DoDI 5200.48. 

How Can You Identify CUI

Now that we have understood the concept of “What DoD instruction implements the DoD CUI program?”, let’s take a look at how you can identify the CUI.  

Locating CUI may be challenging, and particularly difficult for individuals dealing with CUI. Nevertheless, good directions are provided by the DoD as an aid. These are valuable pointers: 

Look for CUI Markings 

Seek out tags of the type of “CUI,” “CUI Specified,” or markers that control distribution, e.g., “NOFORN” (Not Releasable to Foreign Nationals. 

Review Source Documents 

If the material originates from a federal contractor or an agency, refer to the original material CUI instructions. 

Use the CUI Registry 

The National Archives CUI Registry is an official listing that shows all CUI and their protection needs. 

Consult Your Security Office 

If you are unsure, ask your facility’s program manager or security officer to verify whether the material or document contains CUI or not.

Read Also: What Is The Goal Of Destroying CUI? Safeguarding Sensitive Data

Common Mistakes In Identifying CUI 

Despite specific directions, error while handling CUI occurs frequently. A common error is assuming that all sensitive material is classified under the CUI, which can result in undue restrictions or wasted funds.  

Conversely, some employees overlook CUI markings and handle sensitive items as if they were nondisclosures, with insufficient safeguards. 

Improper storage is a frequent issue. Storing CUI on personal devices, unauthorized cloud systems, or insecure storage devices is a serious violation.  

Also, emailing CUI to individuals who should not receive it can result in a breach even if it occurs inadvertently.  

Keeping current with DoDI 5200.48, as well as the rules and requirements that are also subject to change over time, is also worthwhile. 

The Importance of Education and Awareness 

To mitigate these risks, the DoD emphasizes the importance of ongoing training and awareness initiatives.  

Staff members, contractor personnel, and military personnel are encouraged to attend regular CUI training sessions to stay current with policies and procedures.  

Training generally entails learning how to identify CUI. It mainly focuses on employing proper markings and making use of authorized systems of storage and transmission. 

As much as it is crucial for organisations, training individuals is also important. Leaders are expected to  

• establish clear guidelines,  

• safeguard their networks, 

• Encourage their staff members to question information 

This can help them to be unsure about how to approach it.