Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

When CUI Goes Wrong: Unauthorized Disclosures, Misuse, and Your Training Obligations

30 Jun 2026 · 3 min

Watch on YouTube

2:36

The video briefing explains how agencies must handle Controlled Unclassified Information (CUI) when it is misused or improperly disclosed. It defines misuse as using CUI contrary to policy—whether intentional or accidental—and unauthorized disclosure as providing CUI to anyone without a lawful government purpose or the ability to safeguard it. The presenter outlines the reporting requirement to the agency’s Senior Agency Official, the initiation of an administrative inquiry to secure the information, and the range of criminal, civil, and administrative sanctions that may apply. The briefing then details mandatory CUI training: the Senior Agency Official must establish a program covering designation, categories, the CUI registry, marking, safeguarding, dissemination, and decontrolling. All personnel with CUI access must be trained at onboarding and every two years thereafter. A brief promotional interlude advertises Atlantic Training’s Wave management platform for HR and soft‑skill training.

Chapters

Any misuse or unauthorized disclosures of CUI must be reported to the offending agency's Senior Agency Official as soon as possible. Let's take a look at the difference between misuse and unauthorized disclosure. Misuse is when the information is used in a manner contrary to established policies and orders surrounding CUI. Misuse can be intentional violations or unintentional errors in safeguarding and disseminating CUI. An example of this is marking information as CUI when it doesn't qualify as such. Unauthorized disclosure, on the other hand, is when the information is provided to someone without a lawful government purpose or to someone unable to follow CUI safeguards. If misuse is suspected, the agency must begin an administrative inquiry to secure the CUI, gather information, and determine if the information was compromised.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
Laws, regulations, and policies surrounding certain CUI categories or subcategories have established sanctions for misuse and unauthorized disclosure, including criminal, civil, and administrative penalties. One of the best ways to make sure everyone understands how to handle CUI and avoid misuse and unauthorized disclosures is through training. The CUI Senior Agency Official must establish and implement training that addresses the means, Methods and Frequency of CUI Training. All personnel who have access to CUI need to be trained on how to designate CUI, the different categories and subcategories, the CUI registry, and marking, safeguarding, disseminating, and decontrolling CUI. Employees must be trained when they begin working for the agency and then once every 2 years. Handling Controlled Unclassified Information correctly can keep information safe from prying eyes.