The video explains the Department of Defense’s procedures for safeguarding and marking Controlled Unclassified Information (CUI). It distinguishes between CUI Basic, which follows generic controls listed in the CUI Registry, and CUI Specific, which is subject to additional handling requirements defined by law or policy. Regardless of type, authorized holders must create a controlled environment that prevents unauthorized observation, keep CUI behind a physical barrier when outside that environment, and follow published security requirements. The content outlines permissible shipping methods (USPS, commercial carriers, inter‑office/mail), the need for automated tracking, and mandatory CUI markings on packages. Reproduction of CUI on copiers, scanners, or printers is allowed only for lawful government purposes and must use equipment that does not retain the data. When CUI is no longer needed, it must be destroyed so it is unreadable, indecipherable, and irrecoverable, following either specific legal destruction methods or guidance from the Security and Privacy Controls for Federal Information Systems and media‑sanitization standards. The video then details marking requirements: only markings listed in the CUI Registry may be used, and they must be applied uniformly and conspicuously. A CUI banner must contain three elements—control marking ("controlled" or "CUI"), category/subcategory marking (required for CUI Specific), and limited dissemination markings when applicable. Agency identifiers, decontrolling dates, and points of contact must also be included. Portion markings can be used to differentiate control levels within a document, and draft documents must still be marked appropriately. If a document is incorrectly marked, the receiving agency must notify the sender and request correct markings. The presentation concludes with a brief advertisement for Atlantic Training’s Wave management platform.
Chapters
The Executive Agent issues safeguarding standards for CUI that both minimize the risk of unauthorized distribution while also providing timely access to authorized users. CUI safeguarding standards are divided into two types: CUI Basic and CUI Specified. CUI Basic applies when there are no specific handling or dissemination controls set forth by law or policy. Agencies handle CUI Basic according to controls outlined in the CUI Registry. CUI Basic controls apply when the information provided isn't covered by CUI Specific CUI Specific is just what it sounds like. It's when there is a law or policy that provides specific handling information for the CUI in question. Again, the CUI registry indicates which laws and policies apply. They may or may not be more strict than CUI Basic rules. The biggest difference is in whether or not the underlying authority spells out specific controls to be used or not. No matter which type is used for safeguarding, There are some steps authorized holders of CUI must take to protect against unauthorized disclosure. First, they need to establish a controlled environment that protects the CUI. This includes ensuring that unauthorized individuals can't inadvertently see or hear CUI discussions. The CUI should be in the authorized holder's possession or protected by at least one physical barrier when outside the controlled environment. Finally, they need to follow published security requirements and controls to protect CUI Confidentiality. It's sometimes necessary to ship or mail CUI to an individual or agency. When doing so, authorized holders can use the United States Postal Service, any commercial delivery service, or interoffice or interagency mail systems. Automated tracking and accountability tools should be used, and packages need to be marked that they contain CUI using published marking requirements. CUI can be reproduced on a copier, scanner, or printer, as long as it's for a lawful government purpose and the equipment used doesn't retain any of the information. Once an agency no longer needs the information, authorized holders are allowed to destroy CUI in a way that makes it unreadable, indecipherable, and irrecoverable.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
Some CUI have specific destruction methods required by law. For those that don't, authorized holders must follow guidance from the Security and Privacy Controls for Federal Information Systems and Organizations and guidelines for media sanitization. They can also use any method approved for classified national security information. But how will you know if the information you have received is considered CUI? Luckily, regulations outline how information should be marked to identify it as CUI. First, only those markings listed in the CUI Registry are permitted to be used to identify CUI and must be uniformly and conspicuously applied. If an agency receives information that is incorrectly marked, it's their responsibility to notify the sending agency and request a properly marked document. Information designated as CUI must be marked with a CUI banner marking before dissemination. This banner should include 3 elements: the CUI control marking, the CUI category or subcategory marking, and limited dissemination markings. The CUI control marking consists of either the word "controlled" or the acronym "CUI." The decision on which to use is left up to the agency. The CUI category or subcategory markings are not required for CUI Basic, but may be used at the discretion of the agency. However, CUI Specific mandates that CUI registry categories or subcategories be marked according to the document information. Some CUI is required to include additional information, like warning statements, to be marked. Limited dissemination control markings should be used when the authorized user has placed limits on who can view the information, following CUI registry guidelines. All document markings must also include information that identifies the designating agency, like letterhead or other agency indicators. Designating agencies can also include a decontrolling date in their markings to indicate a specific day or event that makes the decontrolling schedule evident. And a Point of Contact for decontrolling should be included. Authorized Holders are also encouraged to use portion markings to differentiate the control level or category of specific parts of the document. If a document is in draft form, it should still be marked accordingly, and all further updates should contain the appropriate markings. Once it's properly marked, CUI can be disseminated following the proper guidelines.
