Coast Guard adopts ‘CUI’ framework to better protect sensitive information

Effective immediately, the Coast Guard is transitioning to the Controlled Unclassified Information (CUI) framework. This new standard replaces legacy labels like "For Official Use Only" (FOUO) and "Sensitive But Unclassified" (SBU). All hands must begin marking new, sensitive but unclassified documents with "CUI" to protect our critical operational data and align with our joint force partners immediately.

"Safeguarding our sensitive information isn't just an administrative task; it is a critical component of our operational success and the safety of our crews," said Gregory Govan, Coast Guard Chief Security Officer. "By shifting to the CUI framework, we are speaking the same security language as the rest of the joint force, ensuring we can seamlessly share information while keeping it out of the wrong hands."

Here is what this transition means for you and how we will roll it out across the service.

What all personnel need to do

As of today, we are in Phase 1 (Immediate Implementation) of this rollout. If you create, handle, or share sensitive information, you must take the following steps:

Learn the markings: Familiarize yourself with the new CUI categories. You can find the Quick Start Guidance on the COMDT (CG-SPM) CUI Resources SharePoint page (CAC required).

Mark new documents: Apply CUI markings to all new work products that contain sensitive information. At a minimum, you must place a banner line that reads "CUI" at the top and bottom of your document.

Handle drafts properly: If your document is a draft, pre-decisional, or provisional, use a watermark (e.g., "DRAFT"). Do not combine these administrative labels in the same line as the official CUI banner. If you cannot add a watermark, place the label in the header and footer below the CUI banner.

Preserve legacy documents: You do not need to go back and re-mark or redact legacy SBU or FOUO files as long as they remain under Coast Guard control. However, if you need to release an old document, you must review it first to ensure it meets CUI requirements. Remember: just because an old document isn't marked doesn't mean it is automatically approved for public release.

Protect the data: Continue to safeguard and share CUI exactly as you did for FOUO material. Unauthorized disclosures are prohibited, put our missions at risk and may be subject to criminal, civil, or administrative penalties.

Classified and SSI programs remain unchanged: This shift only applies to unclassified information. Your processes for handling Classified Information and Sensitive Security Information (SSI) are not changing.

Commanders and supervisors

You are responsible for ensuring your teams understand and execute this new policy.

Train Your Team: You must ensure all subordinates review the Department of Defense (DoD) CUI Awareness and Marking briefing, which is available here: https://securityawareness.dcsa.mil/cui/index.html

What happens next

While we are officially adopting the DoD CUI policy and registry immediately (Phase 1), we are assessing our needs as a service. For now, read all references to "DoD" or "DoW" in the policy registry as "DHS" or "USCG."

Behind the scenes, we are working on the next steps:

Phase 2 (Information Systems): The Coast Guard (CG-C5I) is developing technical solutions to automatically apply CUI markings in our IT systems. Until those updates are live, you must manually type the markings on your documents.

Phase 3 (Formal Policy): Once we assess the impacts and lessons learned from these initial phases, we will publish a final Commandant Instruction outlining the permanent Coast Guard CUI Program policy.

Resources and Contacts