At some point, CUI can stop being sensitive. A contract ends, a law changes, information becomes publicly available, or a project wraps up and the data no longer needs protecting. When that happens, the information can be decontrolled, meaning the CUI designation is formally removed and the safeguarding requirements no longer apply. 

But decontrol isn't something you can do yourself as a contractor, and understanding exactly who holds that authority matters for how you manage CUI across its full lifecycle.

Defense contractors cannot decontrol CUI

Defense contractors do not have the authority to decontrol CUI. Under 32 CFR §2002.18, decontrol authority rests with the designating agency: the federal executive branch agency that originally applied or approved the CUI designation. Even authorized holders at other agencies can't decontrol CUI unilaterally. They can request that the designating agency decontrol it, but they can't remove the designation themselves.

This is one of the most practically important things contractors get wrong. Deciding that information "doesn't seem sensitive anymore" or has been publicly referenced elsewhere doesn't change its CUI status. Only the designating agency can make that determination. Until they do, the information is still CUI, and you're still obligated to protect it accordingly.

The CUI decontrol process

According to 32 CFR §2002.18, decontrol comes in two varieties: automatic decontrol and positive (or affirmative) decontrol.

• Automatic decontrol occurs when a pre-determined date or triggering event arrives, the governing law or policy no longer requires the information to be controlled, or the designating agency publicly releases the information under Freedom of Information Act (FOIA) or other applicable statutes. Some CUI documents are marked with a specific decontrol date or event at the time of creation, which is the clearest and most efficient path. When that date or event arrives, the information decontrols without requiring any additional action.
• Positive decontrol happens when the designating agency makes an active decision to remove the CUI designation, including in response to a request from an authorized holder. An agency can also decontrol CUI concurrently with a declassification action under Executive Order 13526, as long as the information properly qualifies for CUI decontrol at the same time.

CUI decontrol vs. destruction

Decontrol and destruction are separate actions that serve different purposes.

Decontrol removes the CUI designation from information that still exists. It relieves authorized holders from CUI handling requirements, but it doesn't authorize public release. Information that has been decontrolled may still be protected under other regulations, including privacy laws, procurement regulations, and FOIA exemptions entirely independent of its former CUI status. Removing the CUI label doesn't remove those other obligations.

Destruction eliminates the information entirely, using approved methods that render it unreadable and irrecoverable. Destruction is governed by the agency's records retention schedule and approved destruction procedures, not by the decontrol process. You can destroy CUI without decontrolling it, and you can decontrol CUI without destroying it. 

As a contractor, if you receive a decontrol notification from your designating agency, you're relieved of CUI handling requirements but still need to follow applicable law before releasing or sharing that information. 

What happens after CUI decontrol

When CUI is decontrolled, authorized holders must clearly indicate that the information is no longer controlled whenever they restate, paraphrase, reuse, publicly release, or donate it. For existing documents, agency policy may allow authorized holders to strike through or remove CUI markings on the cover page and the first page of any attachments, rather than re-marking every single page. If you incorporate decontrolled CUI into a newly created document, all CUI markings for that information must be removed from the new document entirely.

Source: DoD CUI Program Decontrol

The DoD's standard practice, per the DoD CUI Program's official marking guidance, is to draw a line through the CUI banner on the first page and add a formal DECONTROLLED block that includes the controller, CUI category, dissemination control, point of contact with contact information, date, and authority. If you're a DoD contractor receiving a decontrolled document, this is what you should expect to see indicating the change in status.

One additional practical note from the DoD CUI Program: decontrol the document before requesting a public release review. The information remains protected under other applicable law until it's formally authorized for public release, which is a separate process from the decontrol itself.

Both 32 CFR §2002.18 and NARA’s official training guidance explicitly say that unauthorized disclosure of CUI does not constitute decontrol. If someone shares CUI without authorization, the information doesn't lose its CUI status — the disclosure is a violation, not a decontrol event. 

What to do if you think your CUI should be decontrolled

If you're handling CUI that you believe no longer requires protection, you can submit a request to the designating agency to have it decontrolled. You can't make the decision yourself, but you do have a formal channel to flag it. You also have the right to challenge a CUI designation if you believe information has been improperly designated. The process starts by notifying the agency that provided you with the information, which must loop in the designating agency (if they're not the same).

If you receive information that you believe should be marked as CUI, contact the originator or your government contracting activity. Do not mark or decontrol it yourself.