An OSC receives an email with "CUI//SP-PRVCY//FED Only" in the body of the message Which organization's website should the OSC go to identify what…

The National Archives and Records Administration (NARA) is the Executive Agent for the Controlled Unclassified Information (CUI) program, as established by Executive Order 13556. NARA maintains the official CUI Registry, which is the authoritative, government-wide online repository for all guidance, policy, and requirements on handling and marking CUI. The marking "CUI//SP-PRVCY//FED Only" contains a CUI category ("Privacy") and a dissemination control ("FED Only"), both of which are defined and listed exclusively in the NARA CUI Registry. Therefore, an OSC must consult NARA's resources to correctly interpret the meaning and handling requirements for this specific marking.

B. CMMC-AB: The Cyber AB is responsible for managing the CMMC ecosystem but does not define CUI categories or markings; it enforces the protection requirements for CUI.

C. DoD Contractors FAQ page: A FAQ page is a supplementary, informal resource. It is not the primary, authoritative source for government-wide CUI marking standards.

D. DoD 239.7601 Definitions page: This refers to a specific DFARS clause related to cloud computing, not the comprehensive government-wide CUI program definitions and marking standards.

1. 32 Code of Federal Regulations (CFR) Part 2002

"Controlled Unclassified Information." Section 2002.14(a) states

"The CUI Executive Agent (EA) maintains the CUI Registry

which is the online

publicly accessible repository for all information

guidance

policy

and requirements on handling CUI

including all authorized CUI categories and subcategories

specified markings

and dissemination controls." NARA is the CUI EA.

2. National Archives and Records Administration (NARA)

CUI Registry. The "Privacy" category is listed under the "Specified" categories list

and "FED ONLY" is listed as a Limited Dissemination Control. This can be verified at: https://www.archives.gov/cui/registry/category-list and https://www.archives.gov/cui/registry/limited-dissemination.

3. Executive Order 13556

"Controlled Unclassified Information" (November 4

2010). Section 2(c) designates the National Archives and Records Administration to act as the Executive Agent to implement this order and oversee agency actions to ensure compliance.

4. DoD Instruction 5200.48

"Controlled Unclassified Information (CUI)" (March 6

2020). Section 3.1.a states that this instruction is in accordance with E.O. 13556 and 32 CFR Part 2002

reinforcing that NARA is the ultimate authority for the CUI program that DoD follows.