Who Has the Authority to Decontrol CUI?

Controlled Unclassified Information (CUI) does not remain controlled forever, but removing its controls is not simply a matter of deleting a banner or deciding that a document seems harmless. Under the federal CUI program, decontrol must follow the responsible agency’s rules and the applicable legal requirements. In general, an authorized holder may decontrol CUI only when permitted by agency policy and when the information no longer requires CUI safeguarding or dissemination controls. The agency that designated the information, or another office it has authorized, may also make that decision.

What Decontrolling CUI Means

Decontrolling CUI means ending the safeguarding or dissemination controls that apply to information designated as CUI. It is a formal information-management action—not merely a change in a document’s appearance. The governing framework is Executive Order 13556 and its implementing regulation, 32 CFR Part 2002.

Decontrol is different from removing a CUI marking without authorization. A document may contain a marking such as “CUI,” “CUI//SP,” or “CUI//NOFORN.” Those markings communicate handling requirements; deleting them does not itself end the requirements. Until an authorized decontrol decision is made, the information must continue to be handled under applicable agency policy, law, regulation, and agreements.

Decontrol also does not mean that information is automatically public, unrestricted under every law, or eligible for destruction. A record may no longer be CUI and still be subject to privacy protections, export controls, contractual limits, records-retention rules, or other disclosure restrictions.

Who Can Decontrol CUI?

The short answer is that the agency that designated the information as CUI sets the rules for who may decontrol it. Under 32 CFR § 2002.18, agencies must establish policies and procedures for decontrolling CUI. An authorized holder can decontrol information when the agency’s policy permits and the relevant conditions are met. If the holder lacks that authority, the decision should be referred to the designating agency or an official it has authorized.

An authorized holder is a person or organization with a lawful government purpose for accessing or possessing the information. Possession alone does not necessarily grant decision-making authority. For example, a contractor may be authorized to handle CUI under a contract but may not be authorized to decide that the government’s CUI controls have ended.

Agencies may delegate decisions to designated officials, offices, or roles. The exact delegation varies by agency and by the type of information. A security manager, program office, records official, contracting officer, or other employee should not be assumed to have decontrol authority unless the applicable agency policy or delegation gives it to them.

What the Federal Rule Requires

The main federal requirements appear in 32 CFR § 2002.18. In practical terms, agencies must maintain procedures for decontrol, and CUI should be decontrolled when it no longer requires the protections that led to its designation, consistent with applicable laws, regulations, and government-wide policy. An agency’s implementing policy determines who can make or approve the decision and how it must be documented.

That distinction matters: the federal regulation establishes the program-wide framework, but it does not give every employee, recipient, or contractor a general right to remove controls. The designating agency’s rules remain central. The National Archives and Records Administration (NARA), which oversees the CUI program, provides government-wide guidance; agencies implement that guidance through their own policies and procedures.

When May CUI Be Decontrolled?

CUI may be eligible for decontrol when the reason for controlling it no longer applies or when the applicable control period ends, provided the law and agency policy allow decontrol. The circumstances depend on the CUI category and the authority under which the information was designated.

• A specified period has expired: Some information has a time-based control or decontrol instruction. The instruction must be followed as written, including any conditions or exceptions.
• The underlying sensitivity has changed: A change in circumstances may mean the information no longer needs CUI safeguards. An authorized official must assess this under the governing policy rather than relying on a recipient’s personal judgment.
• The governing law or regulation permits release: If a control is based on a statute or regulation, the applicable legal requirements must still be satisfied. A change in operational circumstances does not override a continuing legal restriction.
• The designating agency approves decontrol: When the holder is not authorized to make the decision, the holder should obtain direction from the agency or delegated official responsible for the designation.

Not every CUI marking includes a decontrol date, and the absence of a date does not mean that the information is immediately free of controls. The applicable agency policy, source material, contract, or other governing instruction should be checked.

Who Does Not Automatically Have Authority?

Receiving, creating, or storing CUI does not automatically confer authority to decontrol it. The following people and organizations should not assume they can independently end controls:

• Any person who can open the file: Access rights are not the same as decontrol authority.
• A contractor or subcontractor: Contractual access and handling responsibilities do not, by themselves, authorize a contractor to change a government designation. The contract and agency instructions determine the contractor’s role.
• A downstream recipient: A recipient should not disregard controls because the information came from another organization or appears outdated.
• An employee who created a document: Creating or compiling information does not necessarily make that employee the designating official.
• A records custodian or system administrator: Technical ability to edit a file or remove a banner is not a policy delegation.

In some situations, an employee may be authorized under agency procedures to make the decision. The key question is not job title alone, but whether the designating agency’s policy authorizes that person or role to decontrol the specific information.

How to Handle CUI From Another Agency

Information may be shared among agencies, contractors, and other authorized recipients. The receiving organization must follow the handling instructions and agreements that apply. If it believes the information no longer requires CUI controls, it should contact the designating agency or its designated point of contact rather than treating its own assessment as an approval.

This is especially important when a document contains information from multiple sources. One portion may be eligible for decontrol while another remains protected. A recipient should not remove the overall CUI marking until authorized officials have reviewed the material and determined what controls remain. The agency may direct the holder to redact specific information, issue a replacement document, or retain the markings.

What Contractors Should Do

Contractors handling CUI should use the contract, its security requirements, and the agency’s written instructions as the starting point. Requirements may appear in contract clauses, statements of work, program guidance, or agency-specific CUI policies. The precise obligations depend on the contract and applicable rules.

If a contractor believes a file has reached its decontrol date, contains an incorrect marking, or no longer needs CUI protection, the safest course is to ask the contracting officer or the agency’s designated CUI contact for written direction. A contractor should not infer decontrol authority from permission to use or share information for contract performance. Until the agency responds, the contractor should continue to protect the information as required.

Contractors should also distinguish between an authorized decontrol decision and a marking correction. If a marking appears inconsistent with the content or contract instructions, the contractor should report the discrepancy through the designated process. Correcting an apparent marking problem without approval could create an unauthorized disclosure or handling violation.

Decontrol Is Not the Same as Public Release

Removing CUI controls does not, by itself, authorize public release. Decontrol addresses the CUI program’s safeguarding and dissemination controls. Separate laws and policies may still govern access or disclosure, including privacy requirements, trade-secret protections, export-control rules, procurement restrictions, and records-management obligations.

Likewise, a request under the Freedom of Information Act (FOIA) is not a shortcut for a holder to decontrol information. Agencies process FOIA requests under the statute and decide whether information must be disclosed or may be withheld under an exemption. A document’s CUI status and its FOIA treatment are related to information protection but are not identical decisions.

Decontrol also does not mean “unclassified” in the broad sense of being unrestricted. CUI is already unclassified information; it is controlled because an applicable law, regulation, or government-wide policy requires protection. Once CUI controls end, other restrictions may remain.

Recommended Steps Before Removing CUI Markings

1. Identify the source and category. Review the markings, source document, CUI category, contract instructions, and any cited authority.
2. Check the relevant agency policy. Confirm whether the holder’s role is authorized to make the decontrol decision and whether specific approval or documentation is required.
3. Verify that the basis for control has ended. Check dates, conditions, and continuing legal or regulatory requirements. Do not assume that age or public availability alone ends CUI controls.
4. Contact the designating agency when uncertain. Request direction from the appropriate agency office or delegated official, particularly for information created by another organization or containing multiple sources.
5. Document and apply the decision as instructed. Follow agency procedures for recording approval, updating markings, notifying recipients, and handling copies.
6. Check for other restrictions. Even after CUI decontrol, protect information as required by other applicable laws, contracts, and policies.

Common Misunderstandings About CUI Decontrol

“The document is old, so it is no longer CUI.” Age alone is not enough. A time-based instruction may apply, but the holder should verify the relevant policy and conditions.

“The file has no CUI banner, so it is unrestricted.” A missing or incorrect marking does not necessarily change the information’s status. The source, content, and governing instructions may still require protection.

“The recipient can remove the label.” A recipient may decontrol only when authorized under the designating agency’s policy. The ability to edit a document is not permission to end its controls.

“Decontrolled means public.” Decontrol ends applicable CUI controls; other disclosure limits may continue to apply.

For a specific case, the controlling references are the current text of 32 CFR Part 2002, the designating agency’s CUI policy, and any applicable contract or information-sharing instructions. When authority is unclear, the appropriate response is to preserve the existing controls and seek written guidance from the designating agency or its authorized representative.