Who Can Decontrol CUI?

Organizations working closely with government entities, such as the U.S. military, often handle sensitive information, including Controlled Unclassified Information (CUI). For national security, it’s critical to manage CUI properly, including knowing who can decontrol CUI and how to safeguard it.

Understanding the processes for controlling and decontrolling CUI ensures your organization meets compliance requirements and protects sensitive data. In this guide, we break down the responsibilities and steps your team may need to follow

Who Is In Charge of Decontrolling CUI?

Per the Department of Defense (DoD) Instruction 5200.48, there are three primary parties authorized to decontrol CUI:

1. Information Originator: The individual or office that originally created or provided the information.
2. Original Classification Authority (OCA): If the information is included in a classification guide, the OCA has the authority to decontrol it.
3. Designated Decontrol Offices: Specific offices assigned by the DoD to handle the decontrol of CUI.
   

Understanding these roles is essential for safeguarding CUI and protecting U.S. national security. Key points include:

• What decontrolling CUI means: The process of officially removing CUI designation from information.
• Why CUI must be protected: Prevents unauthorized access to sensitive but unclassified information.
• How DoD-specific CUI is protected: Follows strict policies and procedures outlined in DoD guidance.
  

For organizations pursuing DoD contracts, working with a qualified compliance partner ensures proper handling of CUI, strengthens data protection practices, and helps achieve preferred contractor status.

 

What Does it Mean to Decontrol CUI?

Under 32 CFR § 2002.4, decontrolling CUI refers to removing any safeguards or restrictions that limit the dissemination of Controlled Unclassified Information (CUI). Decontrol can occur automatically or through direct action by the Office of the Director of National Intelligence (ODNI) or its components.

Agencies are encouraged to decontrol CUI as soon as possible, unless conflicts of interest exist. According to 32 CFR § 2002.18, CUI may also be decontrolled under the following conditions:

• Legal or Policy Changes:  When laws or policies no longer require CUI to be controlled.
• Proactive Disclosure: When the Original Classification Authority (OCA) or designating agency publicly releases the information.
• FOIA or Privacy Act Requests: When disclosure is authorized under these acts.
• Predetermined Date or Event: When a law or regulation specifies a date or condition for disclosure.
  

Additionally, the OCA or other authorized bodies may decontrol CUI in response to requests from authorized holders or as part of a broader declassification process (e.g., Executive Order 13526).

Once CUI is decontrolled, authorized holders are no longer required to apply safeguards and must remove CUI markings. However, decontrol does not automatically authorize public release.

 

What is CUI, and Why is it Critical to Protect?

While decontrolling CUI is tightly regulated, safeguarding CUI is equally, if not more, critical. Controlled Unclassified Information (CUI) is government created or owned information that is not officially classified but could still compromise national or international security if accessed inappropriately.

Because CUI is unclassified, it is particularly vulnerable and must be protected. Unlike classified information, which is inherently restricted, unclassified CUI covering areas like defense, national infrastructure, trade secrets, and law enforcement requires deliberate controls to prevent unauthorized access.

Several industry regulations mandate the protection of CUI. For example, the Defense Federal Acquisition Regulation Supplement (DFARS) requires that any organization handling CUI implement robust security measures. This includes adherence to DFARS compliance requirements, which leverage controls outlined in the National Institute of Standards and Technology (NIST) Special Publications 800-171 and 800-172.

Protecting CUI ensures compliance, safeguards sensitive information, and helps organizations maintain eligibility for government contracts.

 

 

 

How Do DoD Stakeholders Safeguard CUI?

While CUI exists across multiple sectors, its most critical applications and the strictest regulations apply to defense-related information. For DoD-related CUI, the key questions are: who can decontrol it, who is responsible for safeguarding it, and how should it be protected.

DFARS compliance is the primary method for protecting CUI and is mandatory for all stakeholders in the Defense Industrial Base (DIB) working with the DoD. Organizations handling CUI within the DIB must implement stringent security measures to meet federal standards.

If your organization seeks a DoD contract, it will also need to comply with the Cybersecurity Maturity Model Certification (CMMC). Updated in 2021, CMMC defines three levels of certification depending on contract requirements:

• Level 1: Foundational: Implements 17 practices from NIST SP 800-171.
• Level 2:  Advanced: Implements all 110 practices from NIST SP 800-171.
• Level 3:  Expert: Implements a subset of practices from NIST SP 800-172.
  

Beyond implementing the required controls, organizations must assess and verify their cybersecurity maturity through self-assessments, third-party assessments, or government-led audits to ensure compliance and secure DoD contracts.

 

Protect CUI and Sensitive Data with RSI Security

So, who can decontrol CUI? The Original Classification Authority (OCA), the CUI originator, or the designated decontrol offices are responsible for officially decontrolling information. In practice, DoD entities overseeing contracts are primarily responsible for decontrol, but your organization may still need to remove safeguards and CUI markings from its files once decontrol occurs.

Even more importantly, organizations must ensure that all CUI they are authorized to hold is fully protected until decontrol. Implementing NIST and CMMC controls is the most effective way to safeguard CUI, and partnering with a DoD compliance expert can streamline compliance processes and reduce risk.

For guidance on protecting CUI and sensitive data, contact RSI Security today and ensure your organization stays compliant, audit-ready, and secure.

Download Our CMMC Checklist