Who can decontrol CUI?
Quick answer
Controlled Unclassified Information (CUI) can only be decontrolled by the designating agency, the US government agency that created or designated it, or by people that agency authorizes, following its policies. Authorized holders may decontrol CUI only when the agency’s rules permit it, such as when a set date or event passes.
What is CUI?
CUI is US government information that isn’t classified (like “Secret” or “Top Secret”) but still needs protection under a law, regulation or government-wide policy. Examples include some privacy data, export-controlled technical information, law enforcement records and critical infrastructure details. The National Archives (NARA) oversees the CUI program, which is set out in 32 CFR Part 2002.
Who decides
| Role | What they can do |
|---|---|
| Designating agency | Decides when CUI is decontrolled |
| People the agency authorizes | Decontrol CUI in line with agency policy |
| Other authorized holders (including contractors) | Must protect CUI; can decontrol only if the designating agency permits it |
If you’re unsure, ask the designating agency or your organization’s CUI program office. Don’t decide on your own.
When CUI is decontrolled
The designating agency decontrols CUI when it no longer needs protection, for example:
- When the law or policy that required protection no longer applies
- When the information has been officially released to the public
- When a specified date or event has passed, as marked on the document
- When it’s no longer needed for its controlled purpose
What decontrol does not mean
- Decontrolled CUI is not automatically approved for public release. Agencies still require a separate public release review.
- You don’t have to re-mark old documents to remove CUI labels, but you should follow agency guidance before sharing.
- Information in public sources doesn’t automatically decontrol the government’s copy.
Why it’s a common question
“Who can decontrol CUI?” appears in mandatory CUI training for federal employees and contractors. The expected answer is the designating agency (or those it authorizes).
For other security basics, see what a WHOIS lookup shows.
Sources
Still curious?
Jump to a random question from the archive.