Controlled Unclassified Information Handling

Control Statement

Elements processing, storing, or transmitting controlled unclassified information shall be identified on the terrain overlay, and the boundaries across which that information may move shall be declared.

Purpose. To make CUI movement declarable and therefore detectable, so that handling obligations attach to information rather than to systems.

Discussion

CUI is defined by the information, not by the system, which means it moves — into a spreadsheet, an email, a ticketing system, a contractor's environment — and each move takes the obligation with it. Marking elements is therefore only half the control; declaring permitted flows is what makes an undeclared movement a detectable event rather than an invisible one. The failure mode is a correctly marked estate with no declared flows, in which every element is compliant and the information is nonetheless everywhere.

Goals and Metrics

A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.

Accountability

Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.

Inputs and Outputs

Activities

1. L2Mark elements processing, storing or transmitting controlled unclassified information on the overlay.
2. L2Declare the boundaries across which that information may move.
3. L2Raise a finding for observed flows that were not declared.
4. L3Reconcile marked elements against the agency's CUI categorization record.
5. L3Declare flows by category where categories carry different handling requirements, rather than treating CUI as a single class.
6. L3Extend declaration to flows leaving the authorization boundary — to contractors, to shared services, to other agencies — since those are where handling obligations most often lapse.
7. L3Instrument the declared boundaries sufficiently that an undeclared flow can be observed rather than only prohibited.
8. L4Measure observed flows against declared flows and trend the divergence.
9. L4Measure the proportion of declared boundaries carrying detection, since an undeclared flow across an uninstrumented boundary is not a finding, it is an absence.
10. L5Revise the declared flow set from observed legitimate movement, so the declaration reflects how the mission actually works rather than how it was designed to.

Measurement

Evidence and Assessment

Related Guidance

Position in the Chain

Derived from the other controls’ own declarations, so the two directions cannot disagree.

Where This Control Is Used

Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.