# NARA (National Archives and Records Administration) | Secureframe

> NARA owns the CUI program through ISOO. The CUI Registry, categories defense contractors see, marking standards under 32 CFR Part 2002.

canonical: https://secureframe.com/glossary/nara

NARA is best known for preserving federal records. For defense contractors, NARA matters because Executive Order 13556 named it the CUI Executive Agent. NARA delegates that authority to its Information Security Oversight Office (ISOO), which runs the CUI program day to day. The CUI Registry, CUI marking standards, and 32 CFR Part 2002 all come from NARA through ISOO.

### NARA's CUI Role

EO 13556 created the CUI program in 2010 and told NARA to run it. NARA in turn delegated execution to ISOO. In practice, when people say 'NARA said X about CUI,' they mean ISOO published guidance under NARA's authority. The split matters only if you're reading formal regulatory text; for practical purposes the two are interchangeable.

### The CUI Registry

The CUI Registry at archives.gov/cui is the authoritative list of every CUI category and subcategory. For each entry, it names the law or regulation that authorizes the category, whether the category is CUI Basic (standard handling) or CUI Specified (extra handling on top), and the marking conventions to apply. When you're not sure if something is CUI, the Registry is where to look.

### CUI Categories Defense Contractors See

- **Controlled Technical Information (CTI): milit**ary or space technical data with Distribution Statements B-F.
- **Export Controlled (EXPT):** data subject to ITAR or EAR.
- **Critical Infrastructure (CRIT): inf**ormation related to national critical infrastructure.
- **Proprietary Manufacturer (PROPIN)**: business-sensitive manufacturer information.
- **Privacy**: PII under the Privacy Act and HIPAA-adjacent categories.

### CUI Marking Standards

32 CFR Part 2002 and the CUI Marking Handbook define how to label CUI. The basic marking is the 'CUI' banner at the top of each page. For CUI Specified, add the category code after 'CUI//' (e.g., 'CUI//SP-EXPT'). For limited dissemination controls, add 'NOFORN' or other codes after another slash. If your contract generates CUI, you are responsible for applying correct markings.

### What Changes When CUI Policy Changes

NARA can update the CUI Registry, add new categories, or change marking requirements. Those changes apply to new contracts. Your existing contracts stay under the rules in effect when they were awarded unless a modification is issued. Keep an eye on ISOO notices for pending changes.