The Intelligence and National Security Alliance (INSA) this week released Complex, Confusing, and Costly: Challenges Implementing the Government’s Controlled Unclassified Information (CUI) Program, a new paper that details the onerous implementation requirements of the government’s CUI Program and offers eight recommendations urgently needed if the program is to succeed.
As part of initiatives to promote greater sharing of terrorism-related information after the 9/11 attacks, the CUI program was established by Executive Order in 2010 to safeguard sensitive information while enhancing information sharing among federal, state, local, and tribal law enforcement agencies, and their private sector partners. However, implementation rules issued in 2017 are so complex, costly, and inconsistently applied that in 2020 the Office of the Director of National Intelligence requested the EO establishing the program be rescinded. Additionally, a September 2021 DoD Inspector General memo highlighted the difficulty of implementing the CUI program across the DoD and its components.
The INSA paper, developed by INSA’s Security Policy Reform Council, captures industry perspectives on the CUI program’s uneven implementation. Notably, the paper finds that an explosion of CUI categories, overly complex protection and handling guidelines, and a lack of strong centralized management authority undermine the program’s effectiveness. At the same time, onerous and inconsistent requirements burden government contractors with the need to establish multiple information management and security practices – all while imposing consequences for failing to adhere to unclear guidance or to protect information whose status can change without warning.
The paper recommends a reevaluation of the program and implementation of several reforms, including reassessing what really needs protection, clarifying the impact of CUI designation on proprietary information, codifying how CUI costs will be calculated, and implementing a mechanism to incorporate industry insights.
