Controlled Unclassified Information (CUI)

I was assigned another policy task this week regarding an executive order by the President  (Executive Order) to all departments and agencies outlining an approach to standardize Controlled Unclassified Information (CUI).  CUI is information that is not classified but that requires some levels of safeguard and protection. For example a Commerce document containing classified information on trade negotiations may remain classified until the negotiations are over.  The document could then be labeled Sensitive But Unclassified (SBU). This SBU classification could possibly remain indefinitely until someone within the department later reviews the document again or updates the classification to less tiered unclassified document.  These are some of the changes that need to be looked at when it comes to standardizing unclassified information. Currently, each government agency has their own method of classification on unclassified documents and can change them at will. This executive order along with a general implementation plan will give agencies more structured and standard identification system.   

My task was to identify identical terms and definitions of how CUI was determined in 2006 based on a Government Accountability Report (GAO Report), and the Commerce Manual of Security on Policies and Procedures of 2010. Without getting into much detail, I charted the overlaps and stand alone terms that would be considered CUI. After reviewing this with the director, I believe the plan is to roll some of the detached CUI definitions into broader terms of CUI within Commerce.