When should CUI be decontrolled?

When should CUI be decontrolled?

• A. When it no longer requires safeguarding; follow DoD records management procedures
• B. After a fixed period of 5 years
• C. Only upon request from the original holder
• D. When the information system is decommissioned

Answer: (A)

CUI is decontrolled when it no longer requires safeguarding or dissemination controls. That means the information has been determined to pose no risk if handled as standard unclassified material and can be treated under normal records management procedures. Once decontrolled, you still follow the DoD records management procedures for disposition, which include how long to retain the material and how to destroy it when appropriate. This is not governed by a fixed time period, so a blanket five-year rule wouldn’t apply. It also isn’t required to wait for a request from the original holder to decontrol, since the responsibility lies with the designated authority who assesses the safeguarding needs. And decommissioning a system isn’t the trigger for decontrol by itself; rather, decommissioning involves proper disposal and disposition of data in line with records management and CUI handling rules, which may include decontrol if the information no longer needs protection.

CUI is decontrolled when it no longer requires safeguarding or dissemination controls. That means the information has been determined to pose no risk if handled as standard unclassified material and can be treated under normal records management procedures. Once decontrolled, you still follow the DoD records management procedures for disposition, which include how long to retain the material and how to destroy it when appropriate.

This is not governed by a fixed time period, so a blanket five-year rule wouldn’t apply. It also isn’t required to wait for a request from the original holder to decontrol, since the responsibility lies with the designated authority who assesses the safeguarding needs. And decommissioning a system isn’t the trigger for decontrol by itself; rather, decommissioning involves proper disposal and disposition of data in line with records management and CUI handling rules, which may include decontrol if the information no longer needs protection.