Skip to main content

🔔 Notifications Hub: See compliance updates in one place

ISOO (Information Security Oversight Office)

The Information Security Oversight Office sits inside NARA and runs the federal CUI program. Executive Order 13556 (November 2010) created the program. ISOO owns the CUI Registry at archives.gov/cui, publishes 32 CFR Part 2002 (the rule that governs CUI handling), and coordinates with agencies on how CUI is marked, safeguarded, decontrolled, and disposed of.

  • glossary
  • What ISOO Does for the CUI Program

What ISOO Does for the CUI Program

  • Maintains the CUI Registry: the authoritative list of CUI categories with the legal authority behind each one.
  • Publishes and updates 32 CFR Part 2002, the regulation that sets CUI handling requirements.
  • Reviews agency CUI implementation and resolves disputes about what qualifies as CUI.
  • Provides marking guidance: what the CUI banner looks like, where it goes, how to show category and distribution controls.

Where Contractors Touch ISOO's Work

You don't deal with ISOO directly. You deal with its outputs. When you apply a CUI Basic banner to a document per 32 CFR Part 2002, you're following ISOO rules. When you check whether 'Basic Financial Information' is a valid CUI category, you're checking ISOO's Registry. When DFARS 252.204-7012 points you to NIST 800-171 for CUI protection, the reason CUI is defined that way traces back to ISOO.

CUI Basic vs CUI Specified

CUI Basic gets the standard handling in 32 CFR Part 2002 and SP 800-171. CUI Specified means a specific law or regulation adds extra handling requirements on top of the baseline. Example: CUI//SP-HLTH (health information) has HIPAA overlay. CUI//SP-PROPIN (proprietary manufacturer information) has its own access restrictions. Check the Registry to see which category your information falls into and whether it is Basic or Specified.

Why This Matters to CMMC

CMMC Level 2 is the DoD's verification layer on top of NIST 800-171, which exists because of the CUI program ISOO runs. If ISOO changes the CUI Registry tomorrow, agency contracting officers can update what counts as CUI in new contracts. Your contracts stay under the rules in effect when they were awarded, but new contracts can change scope.