2. Briefing Outline CUI Program Phased Implementation
Benefits
Executive Order 13556
Defining the World of CUI
Categories and the CUI Registry
Basic and Specified CUI
Phased Implementation
Approach to Contractor Environment
CUI and IT Implementation
NIST Special Publication
Moderate Baseline (Select Controls)
32 CFR Part 2002 (Draft policy points)

3. Why is the CUI Program necessary?
Executive departments and agencies apply their own ad-hoc policies and markings to unclassified information that requires safeguarding or dissemination controls, resulting in:
An inefficient patchwork system with more than 100 different policies and markings across the executive branch
Inconsistent marking and safeguarding of documents
Unclear or unnecessarily restrictive dissemination policies
Impediments to authorized information sharing

4. What are the benefits of the CUI Program?
One uniform, shared, and transparent system for safeguarding and disseminating CUI that:
Establishes common understanding of CUI control
Promotes information sharing
Reinforces existing legislation and regulations
Clarifies difference between CUI controls and FOIA exemptions

5. Executive Order 13556 Established CUI Program
In consultation with affected agencies (CUI Advisory Council)
Designated an Executive Agent (EA) to implement the E.O. and oversee department and agency actions to ensure compliance.
National Archives and Records Administration
Information Security Oversight Office
An open and uniform program to manage all unclassified information within the executive branch that requires safeguarding and dissemination controls as required by law, regulation, and Government-wide policy

6. Where do we begin? Define the world of CUI
EO called for a review of the categories, subcategories, and markings currently used by agencies.
Agencies submitted to NARA/ISOO what they were protecting and the basis for that protection
Over 2,200 submissions were received
Information types were grouped together, legal authorities were examined, and a CUI Registry was published.

7. Approved CUI Categories
82 Subcategories (examples listed)
Agriculture
Law Enforcement
Controlled Technical Information
Legal
Copyright
NATO
Critical Infrastructure
Nuclear
Export Control
Patent
Emergency Management
Privacy
Financial
Proprietary Business
Foreign Government
Safety Act Information
Geodetic Product Information
Statistical
Immigration
Tax
Information Systems Vulnerability Information
Transportation
Intelligence
1. Agriculture
2. Copyright
3. Critical Infrastructure
4. Emergency Management
5. Export Control
6. Financial
7. Foreign Government
8. Geodetic Product Information
9. Immigration
10. Information Systems
Vulnerability Information
11. Intelligence
12. Law Enforcement
• Bank Secrecy
• DNA
• Investigation
13. Legal
14. NATO
15. Nuclear
16. Patent
• Financial
• Health Information
• Personnel
17. Privacy
18. Proprietary Business
• Census
• Investment Survey
19. Safety Act Information
20. Statistical
21. Tax
22. Transportation

8. Online Registry 23 Categories 82 Sub-categories
23 Categories
82 Sub-categories
315 unique Control citations
106 unique Sanction citations

9. Two types: Basic and Specified
CUI Basic versus CUI Specified
CUI Basic = LRGWP identifies an information type and says protect it.
CUI Specified = LRGWP identifies an information type and says protect it but specifies exactly how it should be protected or handled.

10. Category Creation Sample of analysis (Legal/Witness Protection):
Identify information types and any specific protection/handling requirements

11. Category Creation Who can designate the information?
Who can authorize the dissemination (sharing)?
What information needs to be protected?

12. Phased Implementation
E.O Sec. 5.  Implementation (b):
After a review of agency plans, and in consultation with affected agencies and the Office of Management and Budget, the Executive Agent shall establish deadlines for phased implementation by agencies.

13. Phased Implementation
As of 3/17/15
Day 0
Day 180
Year 1
Year 3-4
Planning
Readiness
Initiation
Final
Identify and initiate planning activities for CUI implementation
Prepare environment and workforce for the CUI transition
Begin implementation of CUI practices
Begin Phase Out of obsolete practices
Full Implementation of the CUI program
Phases
Publish CUI Training (Day 180)
Provide Additional Guidance as needed
Establish Schedule for On-site Reviews
Provide Training Support & Consultation
Publish 32 CFR Part 2002 Rule & Supplemental Guidance (Day 0)
Augment Registry
Provide Awareness Materials & Products
Consult with OMB & Provide Budget Guidance
Review Agency Policies
Oversee Executive Branch Implementation
Resolve Disputes & Complaints
Initiate On-site Reviews
Oversee Executive Branch Implementation
Collect Reporting Data
Key EA Activities
Monitor & Report on Phased Implementation
Develop & Publish Policy*
Develop Training/Awareness
Develop IT Transition Plan
Continue Internal Budget Planning
Develop Self-Inspection Plan
Develop Process to Manage CUI Status Challenges
Assert Physical Safeguarding*
Conduct Training*
Initiate Awareness
Prepare IT Transition
Continue Internal Budget Planning
Initiate CUI Implementation
Handle
Recognize
Receive
Initiate IT Transition
Permit Creation of CUI
Initiate Self-Inspection Program
Eliminate Old Markings
Assure use of only New Markings
Complete IT Transition
Meet Refresher Training Requirements
Key D/A Activities
IOC
FOC
*Required for IOC

14. What is needed to implement a CUI Program?
32 CFR Part 2002 is scheduled to be published in 2016
Policy
Roles and Responsibilities
Identify CUI handled
Specialized implementation
Suitable physical environment
Training (of all affected personnel)
Basic
Specified
Suitable electronic environment
Moderate Confidentiality
180 Days
Year 1
Year 3-4

15. CUI Approach for Contractor Environment
E.O
Registry
32 CFR 2002 & Supplemental Guidance
FAR
Industry
Government
NIST SP
Until the formal process of establishing a single FAR clause takes place, the CUI requirements in NIST SP may be referenced in federal contracts consistent with federal law and regulatory requirements.
The Department of Defense is in the process of revising its DFARS to reference the new publication.

16. Three-part Plan for CUI Protection
Federal CUI rule (32 CFR Part 2002) to establish the required controls and markings for CUI governmentwide.
NIST Special Publication to define security requirements for protecting CUI in nonfederal information systems and organizations.
Federal Acquisition Regulation (FAR) clause to apply the requirements of the federal CUI rule and NIST Special Publication to contractors.

17. NIST Special Publication 800-171
This publication provides federal agencies with recommended requirements for protecting the confidentiality of CUI:
when the CUI is resident in nonfederal information systems and organizations;
when the information systems where the CUI resides are not used or operated by contractors of federal agencies or other organizations on behalf of those agencies; and
where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category or subcategory listed in the CUI Registry.
The requirements apply to all components of nonfederal information systems and organizations that process, store, or transmit CUI, or provide security protection for such components.

18. Development of Requirements
The basic security requirements are obtained from FIPS Publication 200, which provides the high-level and fundamental security requirements for federal information and information systems.
The derived security requirements, which supplement the basic security requirements, are taken from the security controls in NIST Special Publication
Starting with the FIPS Publication 200 security requirements and the security controls in the moderate baseline (i.e., the minimum level of protection required for CUI in federal information systems and organizations), the requirements and controls are tailored to eliminate requirements, controls, or parts of controls that are:
Uniquely federal (i.e., primarily the responsibility of the federal government);
Not directly related to protecting the confidentiality of CUI; or
Expected to be routinely satisfied by nonfederal organizations without specification.

19. Security Requirements: 14 Families
Access Control.
Audit and Accountability.
Awareness and Training.
Configuration Management.
Identification and Authentication.
Incident Response.
Maintenance.
Media Protection.
Physical Protection.
Personnel Security.
Risk Assessment.
Security Assessment.
System and Communications Protection
System and Information Integrity.
Obtained from FIPS 200 and NIST Special Publication

20. Structure of NIST SP
Basic Security Requirements & Derived Security Requirements
Tables that illustrate the mapping of CUI requirements to security controls in:
National Institute of Standards and Technology Special Publication (NIST SP)
International Organization for Standardization / International Electrotechnical Commission (ISO/IEC) 27001

21. Moderate Baseline (Select Controls)
Access Control, , Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
Awareness and Training, 3.2.3, Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Audit and Accountability, 3.3.2, Ensure that the actions of individual information system users can be uniquely traced to those users so they can be held accountable for their actions.
Incident Response, 3.6.1, Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities.
Media Protection:
3.8.1, Protect (i.e., physically control and securely store) information system media containing CUI, both paper and digital.
3.8.3, Sanitize or destroy information system media containing CUI before disposal or release for reuse.

22. Moderate Baseline (Select Controls)
Physical Protection, , Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
Identification and Authentication, 3.5.3, Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
Multifactor authentication requires two or more different factors to achieve authentication. Factors include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).
The requirement for multifactor authentication should not be interpreted as requiring federal Personal Identity Verification (PIV) card or Department of Defense Common Access Card (CAC)-like solutions. A variety of multifactor solutions (including those with replay resistance) using tokens and biometrics are commercially available. Such solutions may employ hard tokens (e.g., smartcards, key fobs, or dongles) or soft tokens to store user credentials.

23. Moderate Baseline (Select Controls)
System and Information Integrity:
3.14.6, Monitor the information system including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
3.14.7, Identify unauthorized use of the information system.
Security Assessment, , Monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.

24. Moderate Baseline (Select Controls)
Systems and Communications Protection:
3.13.8, Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
, Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
A cryptographic module validated by the Cryptographic Module Validation Program (CMVP) to meet requirements specified in FIPS Publication (as amended). As a prerequisite to CMVP validation, the cryptographic module is required to employ a cryptographic algorithm implementation that has successfully passed validation testing by the Cryptographic Algorithm Validation Program (CAVP).

25. 32 CFR Part 2002 DRAFT New Terms…
Lawful Government purpose is any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes within the scope of its legal authorities.
Legacy material is unclassified information that was marked or otherwise controlled prior to implementation of the CUI Program.
Uncontrolled unclassified information is information that neither the Order (EO 13556) nor classified information authorities cover as protected. Although this information is not controlled or classified, agencies must still handle it consistently with Federal Information Security Management Act (FISMA) requirements.
Decontrolling occurs when an agency removes safeguarding or disseminating controls from CUI that no longer requires them.

26. Limitations on applicability
DRAFT
Limitations on applicability of agency CUI policies
Agency policies pertaining to CUI do not apply to entities outside that agency unless the CUI Executive Agent approves their application and publishes them in the CUI Registry.
Agencies may not levy any requirements in addition to those contained in the Order, this Part, or the CUI Registry when entering into contracts, treaties, or other agreements about handling CUI by entities outside of that agency.

27. 32 CFR Part 2002: Sharing DRAFT Access and Dissemination (Sharing)
Lawful Government purpose is any activity, mission, function, operation, or endeavor that the U.S. Government authorizes or recognizes within the scope of its legal authorities.
Agencies should permit access and dissemination of CUI, provided such access or dissemination:
Abides by the law, regulation, or Government-wide policy that established the CUI category or subcategory;
Furthers a Lawful Government Purpose;
Is not restricted by an authorized limited dissemination control established by the CUI Executive Agent; and,
Is not otherwise prohibited by law.

28. 32 CFR Part 2002: Marking DRAFT
Agencies must uniformly and conspicuously apply CUI markings to all CUI prior to disseminating it unless otherwise specifically permitted by the CUI Executive Agent or as provided below.
When marking is excessively burdensome, an agency’s CUI senior agency official may approve waivers of all or some of the marking requirements for CUI designated within that agency.
The CUI banner marking must appear, at a minimum, at the top center of each page containing CUI

29. CONTROLLED/Categories or Subcategories//Dissemination
Banner Marking
DRAFT
The banner marking consists of the CUI control marking, category markings (if required), and dissemination control markings.
CONTROLLED/Categories or Subcategories//Dissemination
CUI Control Marking
Category
Marking
(if required)
Dissemination
Control
Top center of each page containing CUI
The CUI control marking (the word “CONTROLLED” or the acronym “CUI”) is mandatory for all CUI banners.
Category markings are mandatory in the case of CUI Specified, and for CUI Basic when required by agency policy. Either complete category names or abbreviations may be used in banners to designate the categories of CUI contained within the document.
All dissemination control markings must be approved by the CUI EA and published in the CUI Registry. Access to and dissemination of CUI must be allowed as extensively as necessary, consistent with or in furtherance of a Lawful Government Purpose.
CONTROLLED

30. Portion Marking DRAFT Portion Marking = Best Practice
Portion marking is permitted and encouraged to facilitate information sharing and proper handling of the information. Portion markings must use only those abbreviations that are approved and listed in the CUI Registry. When used, the abbreviations, in parentheses, are placed at the beginning of the portion to which they apply and throughout the entire document.
Department of Good Works
Washington, D.C
June 27, 2013
MEMORANDUM FOR THE DIRECTOR
From: John E. Doe, Chief Division 5
Subject: (U) Examples
(U) We support the President by ensuring that the Government protects and provides proper access to information to advance the national and public interest.
(CUI) We lead efforts to standardize and assess the management of classified and controlled unclassified information through oversight, policy development, guidance, education, and reporting.
CONTROLLED
Portion
Markings
Portion Marking = Best Practice

31. Forms & s
DRAFT
CONTROLLED

32. Marking Handbook

33. Coversheet Consolidation

34. New Coversheets: Optional Forms
Optional Form Basic CUI Coversheet. Acceptable for all forms of CUI.
Optional Form 902. Category/Subcategory CUI Coversheet. Acceptable for all forms of CUI. Categories or Subcategories can be identified in the spaces provided.
Optional Form 903. Detailed CUI Coversheet. Acceptable for all forms of CUI. The space indicated can be used to convey specific categories or subcategories used, special instructions, or relevant points of contact.

35. Legacy Information DRAFT
Sensitive unclassified information that was marked prior to the implementation of the CUI Program which meets the standards for CUI is considered legacy information.
Agencies are not required to review and re-mark legacy information until and unless the information is re-used, restated, or paraphrased. In such instances, pre-CUI markings must not be carried forward. If the information falls under the CUI Program, new documents containing the information must be marked in accordance with CUI directives.

36. Reproducing CUI
DRAFT
You may reproduce (e.g., copy, scan, print, electronically duplicate) CUI in furtherance of a lawful Government purpose.
When reproducing CUI documents on equipment such as printers, copiers, scanners, or fax machines, you must ensure that the equipment does not retain data or otherwise sanitize it in accordance with NIST SP

37. Controlled Environments
DRAFT
Controlled environment is any area or space an authorized holder deems to have adequate physical or procedural controls (e.g., barriers and managed access controls) for protecting CUI from unauthorized access or disclosure.
When outside a controlled environment, you must keep the CUI under your direct control or protect it with at least one physical barrier. You or the physical barrier must reasonably protect the CUI from unauthorized access or observation.
Reception Area used to control access to workspace.

38. General Safeguarding Policy
DRAFT
Agencies must safeguard CUI at all times in a manner that minimizes the risk of unauthorized disclosure while allowing for access by authorized holders.
For categories designated as CUI Specified, personnel must also follow the procedures in the underlying law, regulation, or Government-wide policy that established the specific category or subcategory involved.
Safeguarding measures that are authorized or accredited for classified information are sufficient for safeguarding CUI.

39. Destruction
DRAFT
When destroying CUI, including in electronic form, you must do so in a manner that makes it unreadable, indecipherable, and irrecoverable, using any of the following:
Guidance for destruction in NIST SP , Security and Privacy Controls for Federal Information Systems and Organizations, and NIST SP , Guidelines for Media Sanitization;
Any method of destruction approved for Classified National Security Information, as delineated in 32 CFR , Destruction, or any implementing or successor guidance; or
Any specific destruction methods required by law, regulation, or Government-wide policy for that item.

40. Questions?

41. Contact Information
Information Security Oversight Office National Archives and Records Administration 700 Pennsylvania Avenue, N.W., Room 100 Washington, DC (202) (voice) (202) /6872 (fax)