Skip to main content
background

NARA (National Archives and Records Administration)

The National Archives and Records Administration (NARA) is the federal agency that preserves and provides access to government records while also serving as the executive agent for the Controlled Unclassified Information (CUI) program. Through its Information Security Oversight Office (ISOO), NARA establishes and maintains the CUI Registry — the authoritative catalog of CUI categories that defines what information defense contractors must protect under DFARS and CMMC requirements.

  • glossary
  • NARA’s Role in the CUI Program

NARA’s Role in the CUI Program

While NARA is widely known as the custodian of the nation’s historical records, its role in the CUI program is directly relevant to defense contractors. Executive Order 13556 designated NARA as the CUI Executive Agent, and NARA delegated this responsibility to the Information Security Oversight Office (ISOO). In this capacity, NARA develops government-wide CUI policy, maintains the CUI Registry, monitors agency compliance with CUI requirements, and provides training and guidance on CUI handling.

The CUI Registry

The CUI Registry, maintained by NARA, is the definitive reference for all authorized CUI categories and subcategories. Each entry in the Registry identifies the legal authority that created the category, the handling requirements that apply, whether the information qualifies as CUI Basic or CUI Specified, and the applicable marking conventions. Defense contractors should consult the Registry when determining whether information they handle qualifies as CUI and which specific protections apply. Common defense-relevant categories include Controlled Technical Information, Export Controlled, and Critical Infrastructure.

CUI Marking Standards

NARA’s CUI marking guidance (32 CFR Part 2002) establishes how CUI must be identified and labeled throughout its lifecycle. Proper CUI marking includes the CUI banner marking at the top of each page, category indicators identifying the specific CUI category, distribution and dissemination controls, and agency or organization identification. Contractors who generate CUI on behalf of the government are responsible for applying correct markings, which requires familiarity with NARA’s marking standards.

Why NARA Matters for Defense Contractors

Defense contractors encounter NARA’s CUI framework through their DFARS and CMMC compliance obligations. The CUI categories defined by NARA determine what information triggers CMMC Level 2 requirements, the CUI marking standards apply to any CUI that contractors generate or handle, records management requirements for CUI follow NARA’s retention schedules, and CUI disposal procedures must align with NARA’s decontrol and destruction guidelines. Understanding NARA’s role in the CUI ecosystem helps contractors implement more accurate and comprehensive information handling procedures.