Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

CUI Dissemination and Decontrolling: What DoD Personnel Need to Know

2 Jul 2026 · 4 min

Watch on YouTube

3:39

The video provides a comprehensive instructional overview of how Department of Defense (DoD) personnel must handle Controlled Unclassified Information (CUI). It outlines that CUI dissemination must serve a lawful government purpose, not be limited by an authorized Limited Dissemination Control, and must not be prohibited by law. When sharing CUI with non‑executive branch agencies, all recipients must be authorized and understand handling requirements. Dissemination may use any method that meets safeguarding standards, with text, email, and voicemail required to meet at least a “moderate confidentiality impact” per NIST guidelines. Agencies are advised to enter formal agreements with non‑executive entities that incorporate compliance with Executive Order 13556 and the CUI Registry; if formal agreements are not feasible, strong encouragement to follow the same safeguards is recommended. The same safeguards apply when sharing CUI with foreign entities. The presentation lists exceptions where agreements are not required—Congress, courts of competent jurisdiction, the Comptroller General, and releases under FOIA or the Privacy Act. It explains that limited dissemination controls may be applied only with executive‑agent approval, must be listed in the CUI Registry, and are limited to lawful purposes. Upon receipt, CUI should be decontrolled as soon as practical once the controlling policies no longer apply, either by agency decision, a predetermined date/event, or public release. Agencies must designate authorized personnel responsible for decontrolling CUI, and decontrolling removes the need to follow CUI handling rules but does not permit public release. Authorized holders may remove or strike through CUI markings when further disseminating. Finally, the video warns that misuse or unauthorized disclosure of CUI is subject to penalties under applicable laws, regulations, and policies. A brief promotional segment for Atlantic Training’s Wave HR platform is interspersed but is not part of the policy guidance.

Chapters

The dissemination of CUI should be done in a way that furthers a lawful government purpose, isn't restricted by an authorized Limited Dissemination Control, and isn't prohibited by law. When disseminating information to a non-executive branch agency, there's a reasonable expectation that all intended recipients are authorized to receive CUI and understand its handling. CUI can then be disseminated by any method that meets safeguarding requirements and ensures it's received promptly. When using methods like text messaging, email, or voicemail, agencies should follow the "No less than moderate confidentiality impact value" set forth by the National Institute of Standards and Technology . It's recommended that agencies enter into formal agreements with non-executive branch entities receiving CUI that include a requirement for the receiving agency to comply with Executive Order 13556 regarding CUI and the CUI Registry. If this isn't possible, communication between agencies should strongly encourage the receiving entity to protect CUI following all orders, regulations, and the CUI Registry. When CUI must be shared with foreign entities, the same processes and safeguards must be in place.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
However, agencies should also use their best judgment in determining what information is shared and how it's disseminated to best safeguard CUI. The misuse of any CUI is subject to penalties set forth by applicable laws, regulations, and government policies. There are a few exceptions to this, however. Agencies don't need to enter into an agreement regarding CUI with Congress, a court of competent jurisdiction, the Comptroller General, or information released under FOIA or a Privacy Act request. It's sometimes necessary for agencies to put limited dissemination controls on information. These controls need to be approved by the executive agent and listed in the CUI registry and can only be used to further a lawful government purpose. Once agencies receive the information, it should be decontrolled as soon as practical when policies no longer require its control. As CUI, when the designating agency decides to release the information publicly, or once a predetermined date or event occurs. In their CUI policies, agencies should designate authorized personnel to be responsible for decontrolling CUI following regulations and policies. It's important to note that decontrolling CUI relieves agencies from handling information following CUI guidelines, but doesn't authorize it for public release. When being further disseminated, agency policy allows authorized holders to remove or strikethrough markings that indicate information as controlled on the first or cover page of the document. Unfortunately, even with policies and safeguards in place, misuse and unauthorized disclosures can occur.