Looking Back – EO 13556

Nearly every morning I start my computer time by looking at information from Google about what happened in my blog in the previous 24 hours. Google, and blogspot.com is a Google service, provides interesting pieces of analytical data about my blog readership. One item of particular interest is the top ten blog posts each day. As you would expect, most of those posts were from the last couple of days, but with 16 years of publishing this blog, every once-in-a-while, a blog post from ancient history rises into that list.

Today a blog post from November 2010 made the list, EO 13556 and CVI. It looks at the publication of EO 13556, Controlled Unclassified Information, one of the Obama EOs left in tact by President Trump. It briefly looks at how that EO would affect the then existing Chemical-Terrorism Vulnerability Information (CVI) program in the Chemical Facility Anti-Terrorism Standards (CFATS) program.

Review - GSA Publishes FAR NPRM on Controlled Unclassified Information

Today the GSA (and DOD and NASA) published a notice of proposed rulemaking in the Federal Register (90 FR 4278-4317) on “Federal Acquisition Regulation (FAR): Controlled Unclassified Information (CUI)”. This rulemaking would modify and extend provisions in existing FAR, providing information on how contractors would be expected to handle CUI obtained, used, or created in the course of federal contract work. These rules would implement the requirements of regulations created by the National Archives and Records Administration (NARA) pursuant to the requirements of EO 13556, “Controlled Unclassified Information”.

Background 

The government has long tried to restrict access to sensitive information. National security information is protected by rules related classified information, but those rules do not apply to less sensitive information. Over the years agencies have come up with a number of different information control schemes for various types of information with varying levels of formal and informal rules about how that information should be protected. Needless to say, that odd mix of systems was confusing, unworkable, and, practically speaking, unenforceable.

In 2010 President Obama attempted to address this issue by releasing EO 13556. He designated NARA as the agency responsible for formulating the regulations necessary to implement the requirements outlined in the Executive Order. In 2015 NARA published their regulations at 32 CFR 2002. In general, the NARA CUI rules applied to government organizations, not people outside of the government. The one exception was government contractors that handled CUI as part of their contractual duties to the federal government.

I did a blog post when NARA published their rule. Between it and the notice of proposed rulemaking posts mentioned in that blog post, this provides a good deal of background on the regulation that this rulemaking is trying to adopt into the FAR.

Public Comments

GSA is soliciting public comments on this proposed rule. Comments may be submitted via the Federal eRulemaking Portal (www.Regulation.gov; Docket # 2017-0016, Sequence No. 1). Comments should be submitted by March 17^th, 2025.

 

For more information about this rulemaking, including a discussion of the NIST SP 800-171 cybersecurity requirements, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/gsa-publishes-far-nprm-on-controlled - subscription required.

OMB Approves FAR CUI NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) for the Federal Acquisition Regulations (FAR) on “FAR Case 2017-016, Controlled Unclassified Information (CUI)”. This NPRM was sent to OMB on May 21^st, 2024. This rulemaking has been under consideration since 2017

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“This rule will apply the controlled unclassified information (CUI) program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect, and respond to increasing sophisticated threat actions targeting Federal contractors. This rule is being issued in accordance with the National Archives and Records Administration (NARA) regulations implementing the CUI program per Executive Order 13556 [link added] issued November 4, 2010, as implemented in NARA’s implementing regulations [link added].”

I will probably not be covering this regulation in any depth, but I will at least mention the publication of the NPRM in the appropriate ‘Short Takes’ post.

FAR Sends CUI NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs announced that it had received a notice of proposed rulemaking from FAR on “Federal Acquisition Regulation (FAR); FAR Case 2017-016, Controlled Unclassified Information (CUI)”. This rulemaking has been under consideration since 2017.

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“This rule will apply the controlled unclassified information (CUI) program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect, and respond to increasing sophisticated threat actions targeting Federal contractors. This rule is being issued in accordance with the National Archives and Records Administration (NARA) regulations implementing the CUI program per Executive Order 13556 issued November 4, 2010, as implemented in NARA’s implementing regulations.”

OMB Approves DOD Threat Information Sharing Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule for DOD on “Department of Defense (DoD)-Defense Industrial Base (DIB) Cybersecurity (CS) Activities”. The rulemaking was submitted to OIRA on December 7^th, 2023. The notice of proposed rulemaking was published on May 11^th, 2023.

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“The DIB CS Program currently provides cyber threat information to cleared defense contractors. Proposed revisions would allow all defense contractors who process, store, develop, or transit DoD controlled unclassified information to be eligible for the program and to receive cyber threat information. Expanding participation will allow a broader community of defense contractors to participate in the DIB CS Program and is in alignment with the National Defense Strategy.”

We may see this published later this week in the Federal Register, but it is more likely to appear next week.

Sharing CUI – An Example

A lot of valuable security information is gathered and published as Controlled Unclassified Information (CUI). While not subject to the same controls as classified information, the government still tries to restrict the sharing of such information for a variety of reasons, most of them justifiable. Even when such information is leaked and shared in the press, current government regulations limit the ability of government employees and contractors to use such information.

There are a number of ways that agencies can get around the information sharing limitations associated with CUI. I ran across a time-honored CUI bypass (redaction) in a recent online article found at DomesticPreparedness.com. The actual article is very short, but it provides a link to a presumably officially redacted copy of a report by the DHS Office of the Inspector General on “CBP Outbound Inspections Disrupt Transnational Criminal Organization Illicit Operations”. The original version of the report was marked as “Law Enforcement Sesitive”. While the redaction markings on the document are not annotated as to the authority responsible for the redaction, the redacted report is maintained on the OIG web site, so I think we can safety assume that the rules about sharing CUI are not being violated in this case.

The amount of redacted information included in this non-CUI version of the report is actually relatively small. The example below shows the redactions on page 8 of the report, the first place where data is redacted in this report. Even without knowing what is redacted, it is relatively easy to contextually understand why the blanked out text has been removed.

Paragraph with redacted material on page 8

The most important thing about the redaction efforts in this document is the fact that the redacted material does not materially detract from the information being shared in the report.

Redacting information in an existing CUI labeled report should be less difficult and time consuming than writing an unclassified version from scratch. It should also be easier to review the document for the approval process.

Review - HSAR Final Rule for Protecting CUI

DHS published a Homeland Security Acquisition Regulation (HSAR) final rule in the Federal Register (88 FR 40560-40603) for “Safeguarding of Controlled Unclassified Information”. This final rule implements security and privacy measures to safeguard CUI and facilitate improved incident reporting to DHS. The notice of proposed rulemaking (NPRM) for this action was published on January 19th, 2017.

This final rule is effective July 21^st, 2023.

 

For more details about the changes made from the NPRM, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hsar-final-rule-for-protecting-cui - subscription required.

OMB Approves DHS Contractor CUI Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule for DHS on “Homeland Security Acquisition Regulation: Safeguarding of Controlled Unclassified Information (HSAR Case 2015-001)”. This rule was submitted to OIRA on August 15^th, 2022.

According to the Fall 2022 Unified Agenda listing for this rulemaking:

“This Homeland Security Acquisition Regulation (HSAR) rule would implement security and privacy measures to ensure Controlled Unclassified Information (CUI), such as Personally Identifiable Information (PII), is adequately safeguarded by DHS contractors. Specifically, the rule would define key terms, outline security requirements and inspection provisions for contractor information technology (IT) systems that store, process or transmit CUI, institute incident notification and response procedures, and identify post-incident credit monitoring requirements.”

We may see this rule published later this week in the Federal Register.

DHS Sends Safeguarding CUI HSAR Final Rule to OMB

Yesterday, OMB’s Office of Information and Regulatory Affairs announced that it had received a final rule from DHS on “Homeland Security Acquisition Regulation: Safeguarding of Controlled Unclassified Information (HSAR Case 2015-001)”. The notice of proposed rulemaking (NPRM) for this action was published on January 19^th, 2017.

According to the listing for this rulemaking in the Spring 2022 Unified Agenda:

“This Homeland Security Acquisition Regulation (HSAR) rule would implement security and privacy measures to ensure Controlled Unclassified Information (CUI), such as Personally Identifiable Information (PII), is adequately safeguarded by DHS contractors. Specifically, the rule would define key terms, outline security requirements and inspection provisions for contractor information technology (IT) systems that store, process or transmit CUI, institute incident notification and response procedures, and identify post-incident credit monitoring requirements.”

This rulemaking would be amendments to existing HSAR regulations in 48 CFR Parts 3001, 3002, 3004, and 3052. Interestingly, a recent yet separate FAR regulation NPRM updating CUI requirements for DOD, GSA, and NASA that had been sent to OMB was withdrawn.

Proposed FAR CUI NPRM Withdrawn

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that a Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) submitted by DOD, GSA and NASA on  “FAR Case 2017-016, Controlled Unclassified Information (CUI)” had been withdrawn. No reason was given. This NPRM had been submitted to OIRA on March 7^th, 2022.

According to the abstract in the Spring 2022 Unified Agenda for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration (NARA) Controlled Unclassified Information (CUI) program of Executive Order 13556 of November 4, 2010 as implemented in NARA’s implementing regulations at 32 CFR 2002 [link added], and implement the OMB Memorandum M-17-12, entitled Preparing for and Responding to a Breach of Personally Identifiable Information (PII). This rule will apply the CUI program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect and respond to increasing sophisticated threat actions targeting Federal contractors.”

This rulemaking has been on the Unified Agenda since 2017. There is no record of OMB meetings with stakeholders on this rulemaking.

GAO Report – Protecting DOD’s Controlled Unclassified Information Systems

On Thursday, the Government Accountability Office published a report on “Defense Cybersecurity Protecting Controlled Unclassified Information Systems” (GAO-22-105259). The report looks at how well the DOD is doing in their efforts to get their CUI programs into regulatory compliance. The short answer, according to the GAO’s look at four basic program measures, it that DOD still has a way to go.

The four measures used by GAO to evaluate the DOD’s implementation process are:

• Categorize DOD CUI systems accurately (80 to 89% complete),

• Implement Cybersecurity Maturity Model Certification’s 110 security requirements (70 to 79% complete),

• Implement 266 security controls for moderate confidentiality impact systems (80 to 89% complete), and

• Authorize system to operate on DOD network (90% plus complete).

While this GAO Report just looks at the DOD, the CUI program under 32 CFR 2002 applies to all branches of the Federal Government and their contractors (and in some instances regulated entities). Some common federal information protection schemes that fall under the CUI protection regulations include (but are certainly not limited to):

• Chemical-terrorism Vulnerability Information (CVI),

• Critical Energy Infrastructure Information (CEII),

• Protected Critical Infrastructure Information (PCII), and

• Sensitive Security Information (SSI)

It would be interesting to see how other federal agencies (DOE and DHS for example) fair in their implementation of the §2002 regulations.

FAR NPRM Covering CUI Sent to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a new Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) for “FAR Case 2017-016, Controlled Unclassified Information (CUI)”.

According to the Fall 2021 Unified Agenda listing for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration (NARA) Controlled Unclassified Information (CUI) program of Executive Order 13556 of November 4, 2010 as implemented in NARA’s implementing regulations at 32 CFR 2002, and implement the OMB Memorandum M-17-12, entitled Preparing for and Responding to a Breach of Personally Identifiable Information (PII). This rule will apply the CUI program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect and respond to increasing sophisticated threat actions targeting Federal contractors.”

The NARA CUI rule was published in September 2016. Among other requirements, it requires {32 USC 2002.14(h)(2)} non-governmental entities handling CUI on computer systems to comply with NIST SP 800-171.

OMB Approves NIST SP 800-171 Update

On Monday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced the approval of the National Institute of Standards and Technology’s (NIST) Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations. This update was sent to OMB for approval back in February. Guidance documents are not typically listed in the Unified Agenda and there is nothing on the SP800-171 web site that indicates what types of changes are being made.

This document could be published this week, but the Trump Administration is notoriously slow to publish regulatory documents so there is no telling when this will be published.

This document establishes cybersecurity requirements for electronic systems that store, receive or send Controlled Unclassified Information (CUI). It mainly covers contractors, but facilities covered under the Chemical Facility Anti-Terrorism Standards (CFATS) program would be required to comply with these standards on systems containing Chemical-Terrorism Vulnerability Information (CVI).

NIST Sends SP 800-171 Update to OMB for Review

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received NIST Special Publication 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations) for review. This update was not listed in the Fall 2018 Unified Agenda.

The last revision of this document was published last June. It is not clear what changes that NIST is proposing to make to the document; there is nothing on the SP 800-171 web site.

This document establishes cybersecurity requirements for electronic systems that store, receive or send Controlled Unclassified Information (CUI). It mainly covers contractors, but facilities covered under the Chemical Facility Anti-Terrorism Standards (CFATS) program would be required to comply with these standards on systems containing Chemical-Terrorism Vulnerability Information (CVI).

DHS Publishes Semiannual Regulatory Agenda – 11-16-18

Today the Department of Homeland Security (DHS) published their Fall 2018 Semiannual Regulatory Agenda in the Federal Register (83 FR 58031-58038). This is essentially an abstract of some of the information that was originally published in the Fall 2018 Unified Agenda. This Regulatory Agenda identifies a few of the rulemaking activities from the UA that agencies of DHS probably intend to getting around to in the coming six months or so, but is clearly not any indication of whether or not that activity will actually occur.

Some of the DHS rulemakings from this RA that I will be watching if/when they are actually published will be:

• Ammonium Nitrate Security Program;

• Homeland Security Acquisition Regulation: Safeguarding of Controlled Unclassified Sensitive Information (HSAR Case 2015-001);

• Homeland Security Acquisition Regulation: Information Technology Security Awareness Training (HSAR Case 2015-002);

• Chemical Facility Anti-Terrorism Standards (CFATS);

• Security Training for Surface Transportation Employees;

It is odd that the last of the rulemakings listed above is not actually explicated in the DHS document. Instead, you have to go to the Regulatory Information Service Center’s RA entry in the Federal Register to find the full explanation for the security training rulemaking.

Of course, there is nothing new here that was not published weeks ago in the UA; publishing it in the Federal Register just makes is slightly more official. It does not, however, mean that we will see these specific rulemakings any quicker. Rulemaking is like making fine wines, it takes a long time and you cannot tell until the process is completed how good the product actually is.

Thank goodness we are not relying on paper distribution of the Federal Register anymore, this would be a deforestation product.

NIST Mapping Framework Core to NIST SP 800-171

This week the National Institute of Standards and Technology published a new supporting document for the Cybersecurity Framework on the CSF web page. This is a Excel spread sheet mapping CSF Subcategories to NIST SP 800-171, Revision 1, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

A disclaimer in spread sheet notes that:

“NIST SP 800-171 focuses on protecting the confidentiality of Controlled Unclassified Information (CUI) in nonfederal systems and organizations, and recommends specific security requirements to achieve that objective. The requirements recommended for use in SP 800-171 are derived from FIPS Publication 200 and the moderate security control baseline in NIST Special Publication 800-53 and are based on the CUI regulation (32 CFR Part 2002, Controlled Unclassified Information). The tailoring criteria applied to the FIPS Publication 200 security requirements and the NIST Special Publication 800-53 security controls is not an endorsement for the elimination of those requirements and controls—rather, the tailoring criteria focuses on the protection of CUI from unauthorized disclosure in nonfederal systems and organizations.”

This is another effort by NIST to expand the usefulness of the CSF.

NOTE: The disclaimer cell in the spread sheet is overly large, making it difficult to see the mapping cells. To be able to see a reasonable number of mapping lines, reduce the height of line 2 of the spread sheet or even hide it.

FERC Publishes CEII Revision Final Rule

Today the DOE’s Federal Energy Regulatory Commission (FERC) published a final rule implementing changes to the Critical Energy Infrastructure Information (CEII) program mandated by §61003 (16 USC 824o–1) of the Fixing America's Surface Transportation (FAST) Act (PL 114-94). The notice of proposed rulemaking NPRM (FERC uses a different acronym – NOPR) was published in June of this year. This rule is unlikely to be overturned by the 115^th Congress.

Congressional Mandate

The FAST Act required FERC to:

• Establish criteria and procedures to designate information as critical electric infrastructure information;

• Prohibit the unauthorized disclosure of critical electric infrastructure information;

• Ensure there are appropriate sanctions in place for Commissioners, officers, employees, or agents of the Commission or the Department of Energy [DOE] who knowingly and willfully disclose critical electric infrastructure information in a manner that is not authorized by the statute; and

• Facilitate voluntary sharing of critical electric infrastructure information  between, and by Federal, State, political subdivision, and tribal authorities; the Electric Reliability Organization; regional entities; information sharing and analysis centers; owners, operators, and users of critical electric infrastructure in the United States; and other entities determined appropriate by the Commission.

CEII

A number of commenters on the NPRM requested that the Commission provide more details on what constitutes CEII. The preamble to this rule notes that §824o-1(a)(2) provides a definition of CEII. As a result FERC does not see any need to provide additional guidance on what constitutes CEII. FERC reminds commenters that CEII protections only apply to information submitted to FERC and DOE so no other agencies (including the NRC) may designate information CEII. That does not, however, prohibit other agencies from providing protections to electric grid related information submitted to non-DOE agencies.

Protection of CEII and CUI

FERC declined to provide clarification of what constitutes ‘a secure place’ for storing CEII. The preamble to this rule failed to note that by not specifying regulatory requirements for storing CEII that the controlled unclassified information (CUI) regulations of the National Archives and Records Administration provide the controlling authority to define those requirements (including NIST SP 800-171 for electronic storage and transmission) since CEII is a covered CUI listed in the CUI registry.

Effective Date

This rule will become effective on February 21^st, 2017. As I noted earlier, this rule is unlikely to be considered for review by the 115^th Congress. The rule implements requirements set by the Republican 114^th Congress so there will be little impetus for essentially the same Congress to negate this rulemaking even though it fulfills many of the definitional requirements of a ‘midnight rule’.

Commentary

The CEII program only protects information submitted to FERC and the DOE from disclosure by those agencies or personnel with whom those agencies share the information. It does not establish any requirements for protection of that information by submitting organizations. The only drawback that I see is that FERC/DOE are not required to make a determination that the information actually qualifies for CEII protections until the CEII Coordinator at FERC makes that determination in response to a request for the information.

FERC maintains in this rulemaking that the protect submitted information as if it were CEII until such determinations are made. I think that a good lawyer for a whistleblower could maintain that any disclosures of information by FERC/DOE employee prior to a determination being made by the CEII Coordinator. To my mind it would make more sense to declare all submitted material CEII upon receipt and then to remove that declaration when appropriate when the CEII Coordinator is asked to review the information for possible release.

NARA Publishes CUI Final Rule

Today the National Archives and Records Administration’s (NARA) Information Security Oversight Office (ISOO) published a final rule in the Federal Register (81 FR 63323-63347) to establish oversight regulations for a variety of federal controlled unclassified information (CUI) programs. The new regulation establishes policy (32 CFR 2002) for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI, self-inspection and oversight requirements, and other facets of the Program. The effective date of this rule is November 14^th, 2016.

The notice of proposed rulemaking (NPRM) for this rule was published in May 2015. I did a series of blog posts on the provisions of that NPRM. There were only 14 comments filed in response to the NPMR, but they resulted in a number of changes made in the final rule. This final rule was approved by OMB on August 9^th.

This rulemaking was designed primarily to effect the CUI protection activities of federal agencies, but it also applies to all organizations (sources) that handle, possess, use, share, or receive CUI—or which operate, use, or have access to Federal information and information systems on behalf of an agency.

CUI Registry

Section 2002.10 requires that NARA (the CUI Executive Agency – CUI EA) establish a CUI Registry to act as “the authoritative central repository for all guidance, policy, instructions, and information on CUI” {§2002.10(a)(1). The CUI Registry has been established and among other things it provides the current list of non-classified information protection programs covered under this regulation. Those programs include such critical infrastructure programs as:

• Ammonium Nitrate

• Chemical-terrorism Vulnerability Information*

• Critical Energy Infrastructure Information

• DoD Critical Infrastructure Security Information

• Physical Security*

• Protected Critical Infrastructure Information*

• Water Assessments

The programs marked with an asterisk (*) identify those programs that are codified in the U.S. Code, Code of Federal Regulations, or as a Government-wide policy. This is an important distinction for this regulation. The regulation sets minimum standards for CUI Basic programs, programs while the codifying documents for the CUI Specified programs set program standards that do not conflict with the minimum requirements of the CUI regulations. If existing CUI Specified programs do not meet the minimum security standards set forth in this rule, the programs will have to be updated to come into compliance.

NIST SP 800-171

Federal agencies holding CUI on computer systems are required to conform with the computer system requirements of FIPS Pub 199 at no less than the moderate confidentiality impact level {§2002.14(g)}. For non-federal information systems the computer security standard that must be applied is NIST SP 800-171{§2002.14(h)(2)} for systems used to process, store or transmit CUI.

Commentary

Most private sector organizations are not going to be required to process, store or transmit CUI. With one major exception, CUI information will generally be information that federal agencies will have received from non-federal agencies (including private sector companies). The CUI designation is being used to protect the information while in federal control. Security information that is subsequently shared by the federal agency may have CUI designations to protect the source of the information from public disclosure.

The one major exception is the Chemical-terrorism Vulnerability Information (CVI) program administered under the Chemical Facility Anti-Terrorism Facility Standards (CFATS) program. Again the basis of the CVI (a CUI designation) protections is CFATS security information (Top Screens, Security Vulnerability Assessments and Site Security Plans for instance) being shared by private sector entities to a government agency (DHS Infrastructure Security Compliance Division – ISCD). The CFATS regulations, however, require the originating facility to protect the information using the procedures set forth in the CVI Procedures Manual.

The CVI program is a listed CUI Specific program, so where ever the current CVI procedures meet or exceed the requirements for storage, marking, transmission, sharing, declassifying or destroying the CVI information, no change in the CVI program will be required. The one obvious area where the CVI program does not meet the CUI program requirements is in specifying the NIST 800-171 standard for computer systems used to handle CVI information. Other minor changes may also be necessary.

OMB Approves NARA CUI Final Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the final rule from the National Archives and Records Administration (NARA) concerning the administration of the various Federal Controlled Unclassified Information (CUI) programs. The final rule was submitted to OIRA back in October of last year. The notice of proposed rulemaking (NPRM) was published in May, 2015 and I did a series of blog posts on the provisions of that NPRM.

This rulemaking is mainly targeted at protecting CUI on government and contractor IT systems. It is expected that it will require the implementation of NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, as the IT security standard for contractors and other non-government organization that are required to protect CUI.

Readers of this blog will be interested in this rule making because of its potential effects on the following CUI programs:

Chemical-terrorism Vulnerability Information (CVI);

Sensitive SecurityInformation (SSI);

Protected Critical Infrastructure Information (PCII); and

Critical Energy Infrastructure Information (CEII)

I expect that the final rule will be published in the Federal Register later this week.

NOTE: Corrected SSI program link - 08-10-16 21:30 EDT

NARA Sends CUI Final Rule to OMB

Earlier this week (but available on-line for the first time today) the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that that the National Archives and Records Administration (NARA) had submitted their final rule on Controlled Unclassified Information for review. The notice of proposed rulemaking on this rule was published last May.

NARA has moved pretty quickly on this final rule with the comment period on the NPRM having closed in July. They were assisted on this by the relatively low number of comments (13) received on the NPRM.

It will be interesting to see how long it takes OIRA to approve the final rule. The NPRM took alomost a year to approve (May 20, 2014 to May 5, 2015). I’m sure that a bunch of the delay was working out agreements with the various affected Federal agencies. That may mean that this is a done deal within the government, but you never can tell.