Who Can Decontrol CUI and What Is an OCA’s Role?

Meta description: Learn who can decontrol Controlled Unclassified Information (CUI), what an Original Classification Authority (OCA) does, and how to handle CUI markings and release decisions.

Controlled Unclassified Information (CUI) is unclassified information that the government requires people to safeguard or restrict from dissemination under applicable laws, regulations, or government-wide policies. Decontrolling CUI removes those CUI handling controls when they are no longer required—but it does not automatically make the information public. The authority to decontrol depends on the agency’s rules and the person’s role. An Original Classification Authority, or OCA, has a different job: deciding whether information warrants classification as national security information. An OCA does not automatically have authority to decontrol CUI.

What Does It Mean to Decontrol CUI?

Under the federal CUI program, decontrol is the authorized removal of CUI safeguarding or dissemination controls from information that no longer requires them. The definition appears in 32 CFR Part 2002, the regulation that establishes government-wide CUI program requirements. Decontrol is a formal handling decision, not an informal deletion of a banner or marking.

Decontrolling information changes its CUI status. It does not, by itself, establish that the information can be freely shared with anyone or posted online. Other restrictions may still apply, including privacy protections, export controls, intellectual property rights, contractual requirements, law-enforcement sensitivities, or classification requirements. A separate disclosure review may be needed before release outside the authorized audience.

Decontrol also differs from declassification. Declassification concerns information that was classified under an executive order and is no longer classified. CUI is unclassified information, so the relevant action is decontrol—not declassification. If a document contains both classified information and CUI, each portion must be handled under the rules that apply to its status.

Who Can Decontrol CUI?

The federal CUI regulation recognizes an authorized holder’s role in determining whether information in their possession can be decontrolled, subject to agency policy and applicable law. An authorized holder is generally a person or organization with lawful possession of or access to CUI who is permitted to handle it. This can include federal employees, agency contractors, and other recipients whose access is authorized.

That does not mean every recipient can independently remove CUI controls whenever they believe the information is no longer sensitive. Agencies establish procedures that identify who may make or approve decontrol decisions, what records must be checked, and how the decision must be documented. The original agency or information owner may retain decision-making authority, and the material may be subject to rules that limit a recipient’s discretion.

In practice, a person should confirm their authority before changing a CUI marking. The governing agency policy, contract, security plan, information-sharing agreement, or records-management direction may specify that only a particular program office, information owner, or designated official can make the decision. If the authority is unclear, the safe course is to retain the controls and ask the responsible agency contact.

Typical Responsibilities in a Decontrol Decision

• Information owner or originating agency: Identifies the applicable CUI category and establishes or communicates handling requirements.
• Agency-designated official: Makes or approves decontrol decisions when agency policy assigns that responsibility to the role.
• Authorized holder: Follows the agency’s process and may make a determination only when the person’s authority and the governing rules permit it.
• Contractor or service provider: Follows contract terms and agency instructions; contractor possession alone does not create unrestricted authority to decontrol government information.

The same individual may hold more than one role, but authority comes from the applicable rules and appointment—not simply from job title, seniority, or access to the material.

What Is an OCA?

An Original Classification Authority is an official authorized to make an original classification decision under the applicable national security classification system. The president and agency heads with classification authority may designate officials to classify information originally, within the limits of their delegated authority. Executive Order 13526 and its implementing rules govern much of this system.

An OCA decides whether information meets the criteria for classification, identifies the appropriate classification level, and sets a duration for classification as required by the rules. The decision must be based on an authorized category of national security information and a determination that unauthorized disclosure could reasonably be expected to cause identifiable or describable damage to national security.

OCAs are distinct from derivative classifiers. An OCA makes an original classification decision. A derivative classifier applies an existing classification decision to a new document or material, following source documents or a security classification guide. Neither role automatically confers CUI decontrol authority.

Does an OCA Have Authority to Decontrol CUI?

Not solely because the official is an OCA. OCA authority concerns classified national security information. CUI authority is governed by the CUI program, the originating agency’s policies, and any applicable legal or contractual requirements. An OCA may also be appointed to a separate CUI role, but that appointment—not the OCA designation itself—would be the basis for making a CUI decontrol decision.

An OCA may encounter information that has been marked CUI but appears to warrant classification, or classified material that also includes CUI components. Those situations require careful review. The official must follow the classification system and agency procedures, and should coordinate with the relevant CUI program office or information owner. A CUI marking cannot be removed merely to avoid a classification determination, and classified markings cannot be replaced with CUI markings without a valid basis.

In short, the two systems answer different questions. An OCA determines whether information qualifies for national security classification. A properly authorized CUI decision-maker determines whether CUI controls remain necessary under the governing CUI rules. One person can perform both functions only if they hold the required authority for each.

When Can CUI Be Decontrolled?

CUI can be considered for decontrol when the requirements supporting its CUI status no longer apply, or when the applicable authority determines that the controls are no longer necessary under the rules. The reason may be that the information’s sensitivity has changed, a legal or regulatory restriction has expired, or the agency has determined that the information no longer falls within an authorized CUI category. The exact test depends on the category and governing authority.

The presence of an old date, a completed project, or a public version of similar information is not enough by itself. A document may contain details that remain protected even after related information has been released. For example, a public report may omit personal information, security details, or technical data that remain restricted in an internal version.

Some CUI is CUI Specified, meaning the underlying law, regulation, or government-wide policy specifies particular handling requirements. Other CUI is CUI Basic, for which the CUI program’s standard controls apply without additional category-specific handling instructions. The distinction matters because specific authorities may establish different conditions for access, dissemination, or removal of controls.

How to Decontrol CUI Responsibly

Agencies may prescribe different processes, but a sound review generally checks the information’s source, category, applicable authority, and current handling requirements before changing its status. The person handling the material should not rely only on a label or an assumption that the information is old or widely known.

1. Identify the CUI: Review the markings, cover sheets, metadata, source documents, and any cited category or dissemination control.
2. Find the governing rule: Consult the CUI Registry, applicable law or regulation, agency policy, and any contract or information-sharing terms.
3. Confirm decision authority: Determine whether the agency permits the holder to decide or requires approval from a designated official or the originating agency.
4. Assess the information: Check whether the category still applies and whether the material contains other protected information, including classified portions.
5. Document the decision: Record the basis, approver, date, and scope of the decision as agency procedures require.
6. Update markings and systems: Remove or revise CUI markings only as directed, and update digital records or distribution instructions consistently.
7. Check disclosure separately: Confirm that other legal, privacy, security, or contractual restrictions do not prevent the intended sharing or release.

When only part of a document qualifies for decontrol, the decision may apply to that portion rather than the entire record. Agencies should preserve any controls that still apply to the remaining content and make the distinction clear in accordance with their procedures.

Decontrol Is Not the Same as Public Release

One of the most important practical distinctions is that decontrolled does not necessarily mean publicly releasable. Decontrol removes CUI program controls; disclosure is a separate decision governed by the circumstances and other applicable rules. A federal agency may still need to review a record under the Freedom of Information Act (FOIA), privacy laws, procurement rules, or another disclosure process before providing it to the public.

Likewise, a contractor should not publish decontrolled material simply because a CUI banner has been removed. A contract may impose separate restrictions, and the government may retain rights or approval requirements over information produced under the contract. Contractors should follow the contract’s terms and the contracting agency’s written direction.

Decontrol also does not necessarily require every recipient to discard the information or erase its history. Records-retention rules, audit requirements, and agency instructions may require preserving the document and documenting its status change. The correct treatment depends on the record and the governing policy.

Common Mistakes to Avoid

• Assuming an OCA controls all sensitive information: OCA authority applies to original classification decisions, not automatically to CUI.
• Removing markings without approval: A recipient should verify the agency’s decontrol process and their own authority first.
• Treating decontrol as public release: Other disclosure restrictions can remain in force after CUI controls are removed.
• Confusing decontrol with declassification: Declassification applies to classified information; decontrol applies to CUI.
• Ignoring mixed-content records: A document may include CUI, classified information, and other protected material, each requiring separate handling.
• Relying on age or public availability alone: Similar information being public does not prove that every detail in a particular record is releasable.

Where to Verify CUI and Classification Requirements

For a specific decision, the most useful starting points are the originating agency’s CUI policy, its designated CUI program office, and the official responsible for the information. The National Archives and Records Administration’s CUI Program publishes government-wide program information, while the CUI Registry lists approved categories and authorities. The regulatory framework is in 32 CFR Part 2002.

For classification questions, agencies should consult their security classification officials and applicable classification guidance. Executive Order 13526, available through the Federal Register, describes original classification authority and the rules for classifying national security information. Agency-specific procedures remain important because they identify delegated roles and operational approval paths.

Bottom line: An authorized holder may be able to decontrol CUI when the governing rules and agency procedures permit it, but authority should be verified before markings or controls are changed. An OCA’s role is to make original national security classification decisions; OCA status alone does not authorize CUI decontrol or public release.