EDUCAUSE Comments: DHS Controlled Unclassified Information (CUI) Provision

Abstract

EDUCAUSE joined the Council on Government Relations (COGR), the Association of American Universities (AAU), and the Association of Public and Land-grant Universities (APLU) in comments to the U.S. Department of Homeland Security (DHS) about its proposed new CUI grants and contracts provision. DHS intends for the new provision to serve as its implementation of the National Archives and Records Administration (NARA) CUI regulation, which established uniform CUI standards for federal agencies. (Colleges and universities receiving DHS grants and contracts would have to adhere to the provision’s requirements in managing CUI related to their DHS projects, and those requirements would impact institutional information security policies and practices.)

In the letter to DHS, the associations note that the Department’s proposed provision deviates substantially from NARA’s uniform requirements. It also includes categories of information in its scope that are not contained in NARA’s CUI registry, which is supposed to serve as the definitive listing of what the federal government considers as CUI. Thus, the associations argue that DHS should avoid both creating unnecessary confusion and establishing a precedent on agency customization of the NARA CUI requirements by modifying its proposed CUI provision to align with the NARA regulation.