On Wednesday September 2, 2026, Michael D. Thomas, Director of the Information Security Oversight Office (ISOO), signed ISOO Notices 2026-07: Executive Agent Guidance for Implementation of the Controlled Unclassified Information (CUI) Program and 2026-08: CUI Program Revised Requirements for Waivers, responsive to continuing requirements for federal agencies under Executive Order 13556 “Controlled Unclassified Information” (E.O. 13556) and 32 CFR 2002
Key Elements of CUI Implementation
In accordance with ISOO Notice 2026-07, implementation of the CUI Program continues to be essential to bring consistency to the protection of sensitive information, as well as to facilitate the appropriate information sharing so critical to our government’s functions, including the application of artificial intelligence (AI) and to ensure compliance with Administration priorities regarding the proper management of data and information.
This includes implementing key safeguarding measures to protect CUI in both the information systems and physical security environments, accurately and consistently designating and marking CUI to ensure it is identified and disseminated to those who it should go to, and ensuring the government provides clear guidance to contractors and non-executive branch entities regarding all facets of its handling.
Waivers as an Element of CUI Program Implementation
ISOO Notice 2026-08 reiterates and clarifies existing requirements in 32 CFR 2002 that govern when waivers of CUI Program requirements are permissible and appropriate. Specifically, it reminds agencies of the types of waivers allowed in CUI Program implementation pursuant to 32 CFR 2002.38, and that all waivers must meet the narrow requirements for each of the three authorized types: limited CUI marking waivers within the agency, limited legacy material marking waivers within the agency, or exigent circumstances waivers.
For all waivers, ISOO will ensure that CUI Senior Agency Officials at each agency are meeting their obligations in accordance with the regulatory provisions as part of the annual CUI reporting cycle, and that the use of waivers adheres to both E.O. 13556 and 32 CFR 2002.