CUI Notice 2019-03.pdf

INFORMATION SECURITY OVERSIGHT OFFICE

NATIO Al. ARCHIVFS ,111d RrCURDS ADMINISTRArlO

700 Pr , SYIVA IA AVrNur. w. ROO,\,\ inn WA�HINt�TON. DC .l().l(lX-llO(li ll'll'll'.111" l1il'l'S.g()l'/i,0<1

�1S00

INFORMATION SECURITY

OVERSIGHT OFFICE

CUI Notice 2019-03: Destroying Controlled Unclassified Information (CUI) in paper form

July 15, 2019 Purpose

1. This Notice provides guidance for destroying (via single and multi-step methods) Controlled Unclassified Information in paper form.

2. Th.is Notice rescinds CUI otice 2017-02 Controlled Unclassified Information and Multi-Step Destruction.

Background

3. The Director of the Information Security Oversight Office (ISOO), exercises Executive Agent (EA) responsibilities for the CUI Program. Title 32 CFR Part 2002 Controlled nclassified Information (September 14 2016) establishes CUI Program requirements for designating, safeguarding, disseminating marking decontrol ling, and disposing of CUI.

4. The CUI regulation requires that agencies destroy CUI "in a manner that makes it unreadable, indecipherable, and irrecoverable," (32 CFR 2002.14(f)(2)). It also prescribes National Institute of Standards and Technology (NIST) Special Publication (SP) 800-88, Revision l: Guidelines for Media Sanitization (December 2014) (NIST SP 800-88, rev 1) destruction methods, or any destruction method approved for Classified National Security Information (32 CFR 2001.47), unless the CUI category's authority mandates other destruction methods (CUI Specified categories). Agencies must also use any destruction method specifically required by law, regulation, or Government-wide policy for CUI Specified categories.

5. This Notice clarifies certain aspects of the requirements for destroying paper CUL NIST SP 800- 88, rev l, describes authorized methods for destroying other media types that contain CUI.

Single-step paper destruction standard

6. For the single-step paper destruction method agencies must:

a. Use cross-cut shredders that produce 1 mm x 5 mm (0.04 in. x 0.2 in.) particles (or smaller);

or

b. Pulverize/disintegrate paper using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen.

(NIST SP 800-88, rev 1, Table A-1: Hard Copy Storage Sanitization)

7. The ational Security Agency SA) maintains an Evaluated Products List (EPL) of equipment it authorizes to destroy hard copy (paper) Classified ational Security Information. This equipment also meets CUI single-step paper destruction standards. The most updated SA EPL for "Paper Shredders can be found at:

https://www.nsa.gov/resourccs/evervone/media-destruction/

This guidance document does not have the force and effect of law and is not meant to bind the public, except as authorized by law or regulation or as incorporated into a contract. Accordingly, with regard to the public, this document only provides clarity regarding existing requirements under the law or agency policies. This guidance document is binding on agency actions as authorized under applicable statute, executive order, regulation, or similar authority.is

Multi-step paper destruction standard

8. We have noted concerns raised by agencies that the primary destruction method for paper can be costly and may have negative effects on recycling waste paper after the shredding process.

Paragraph 9 of this Notice is intended to help address these concerns while still satisfying the regulatory requirement for disposing of CUI.

9. A multi-step destruction process in which an agency shreds CUI to a degree that doesn't meet th Table A-1 standards, and then recycles or destroys it (or has a contractor or shared service provider shred and/or recycle/destroy), is a permitted alternative once your organization has verified and found this method satisfactory. Agencies that use a multi-step destruction process must follow the guidelines in this Notice and the attached document, and the process must result in CUI that is unreadable, indecipherable, and irrecoverable. However, the standards described i paragraph 6 of this Notice (NIST SP 800-88, rev l,Table A-1: Hard Copy Storage Sanitization) are still required for destroying CUI via a single-step method.

10. The alternative method provided for in paragraph 9 is supported by NIST SP 800-88, rev 1, which states, "Methods not specified in this table may be suitable as long as they are verified and found satisfactory by the organization" (Appendix A - Minimum Sanitization Recommendations).

11. Recycling hard copy (paper) satisfies CUI destruction requirements as part of a multi-step destruction process only ifthe process recycles the CUI into new paper. Recycling processes that convert paper into other products do not always render the CUI unreadable, indecipherable, and irrecoverable, and thus may not meet the CUI Program's standards.

Consolidating CUI and physical security

12. The physical security standards for CUI remain in effect until the information is destroyed in accordance with the standards of the CUI Program. Agencies maintain discretion to determine those controls necessary to meet the safeguarding requirements set forth in 32 CFR 2002.14.

13. Agencies may consolidate CUI prior to shredding, recycling, or destroying it. This includes shre bins and bum bags within the agency's controlled environments, and interim storage or contractor facilities.

a. Agencies must protect consolidated (e.g., baled) material that they collect and/or store at interim storage facilities (or by contractors) within a controlled environment that prevents access by unauthorized people.

b. Procedures must be in place to account for and track consolidated CUI until it is destroyed/recycled to the standards of the CUI Program.

Jn~A,g

MARK A. BRADLEY

Director

Attachment e n d