EO 13556 and CVI

Today the White House published Executive Order 13556, Controlled Unclassified Information, in the Federal Register. The EO was signed by President Obama and published on the White House web site last Thursday, November 4th. It “establishes an open and uniform program for managing information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government-wide policies” (FR 75 68675) but excludes classified information.

Provisions

EO 13556 establishes a new class of information, Controlled Unclassified Information (CUI), and it designates the National Archives and Records Administration as the Executive Agent (EA) for implementing the order.

The EO designates CUI categories and subcategories that will “serve as exclusive designations for identifying unclassified information throughout the executive branch that requires safeguarding or dissemination controls, pursuant to and consistent with applicable law, regulations, and Government-wide policies”.

Within 180 days each agency of the Executive Branch will review all current requirements for designating and safeguarding unclassified information and submit a catalogue of those designations to be considered as categories or subcategories of CUI to the EA. The EA will review and approve those categories and subcategories that meet the requirements of §2(a) of the EO. The EA “may resolve conflicts among categories and subcategories of CUI to achieve uniformity and may determine the markings to be used” {§4(a)}.

The EA will publish directives to support this EO. Those directives will establish “policies and procedures concerning marking, safeguarding, dissemination, and decontrol of CUI that, to the extent practicable and permitted by law, regulation, and Government-wide policies, shall remain consistent across categories and subcategories of CUI and throughout the executive branch” {§4(b)}.

A key provision of the EO is the requirement that the requirements will be implemented in a manner consistent with “the statutory authority of the heads of agencies, including authorities related to the protection of information provided by the private sector to the Federal Government” {§6(a)(2)}.

CVI as CUI

It is clear that chemical-terrorism vulnerability information (CVI) will fall under the provisions of EO 13556. As the CVI category is established by regulation (6 CFR 27.400) it is certain that it will survive the initial review of the Secretary and the EA. The disclosure provisions should also remain unchanged. There may need to be some revisions made to the CVI Procedures Manual, depending on the review of the marking and protections provisions by the EA.